HIPAA-Compliant AI for Clinical Notes

The 9 things to verify before signing

1. BAA (Business Associate Agreement) signed and on file. Without a BAA, the vendor is technically not allowed to handle PHI on your behalf. Should be standard, free, and signed before any PHI is sent.
2. Encryption in transit (TLS 1.2+). All audio uploads and note downloads should be encrypted end-to-end. Verify in vendor security documentation.
3. Encryption at rest (AES-256). Stored audio and notes should be encrypted on disk. Standard for any HIPAA-eligible cloud service.
4. Access controls and audit logging. Who can see your PHI? When was it accessed? You should have access to audit logs.
5. Data residency (US-based). PHI should be stored on US servers (or your country's sovereign infrastructure). Vendors using overseas processing are higher-risk.
6. Data retention policy. How long does the vendor keep your audio/notes? Default should be configurable, not "forever."
7. Sub-processor list. Many AI tools use third-party LLMs (OpenAI, Anthropic, etc.). Each sub-processor must also have a BAA. Vendor should disclose their stack.
8. Breach notification within 60 days. Required by HIPAA. Verify the vendor's policy commits to this.
9. SOC 2 Type II report or equivalent. Independent audit of security practices. Optional but strongly preferred.

Patient consent considerations

HIPAA covers the data side. Patient consent for recording is a separate (state-law) issue:

• One-party consent states (most US states): provider-only consent is sufficient. You can record without explicit patient permission, though this is poor practice.
• All-party consent states (CA, FL, IL, MD, MA, MT, NV, NH, PA, WA): all parties must consent. Get verbal consent at the start of every visit.
• Best practice across all states: verbal consent script at the start of every visit. "Today I'm going to use an AI assistant to help me take notes during your visit. It listens to our conversation and helps me create the chart. Is that okay with you?" Documented in chart.

Red flags in AI scribe vendors

• "HIPAA-compliant" claim without BAA available — actual non-compliance risk
• Vague answers about which sub-processors handle PHI
• Free or cheap tier without BAA — never send PHI
• Vendor based in country without GDPR-equivalent privacy framework
• Marketing materials that describe collecting PHI for "training" their AI without explicit opt-in and de-identification
• No audit log access for customer

Questions to ask in vendor evaluation

1. "Can you sign a BAA before I send any PHI?"
2. "Where physically are my audio recordings and notes stored?"
3. "Who has access to my PHI within your organization, and is that logged?"
4. "What's your data retention default for audio recordings?"
5. "What sub-processors handle PHI on my behalf?"
6. "What's your breach notification timeline and process?"
7. "Do you have a SOC 2 Type II report or equivalent?"
8. "In the event of contract termination, how is my data returned or destroyed?"
9. "Is my PHI used for training your AI models?"

Frequently Asked Questions

Is OpenAI HIPAA-compliant?

OpenAI offers HIPAA-eligible enterprise tiers with BAA available. The standard ChatGPT product (consumer tier) is NOT HIPAA-compliant. Vendors building on OpenAI must use the enterprise tier and have a BAA in place to handle PHI.

Can I just use ChatGPT to draft notes?

No — sending PHI to consumer ChatGPT (the free or Plus tier) is a HIPAA violation. Use HIPAA-eligible enterprise tiers, or use a healthcare-specific AI scribe vendor with BAA.

What's the penalty for a HIPAA breach?

Tiered structure: $100-$50,000 per violation, with annual maximum of $1.5M per violation type. Willful neglect (knew the rules and ignored them) carries higher penalties than reasonable cause.

Do I need cyber insurance specifically for AI tools?

Most cyber liability policies cover AI-related breaches the same as any other technology breach. Verify with your broker and ensure your policy covers third-party processors.

What if my AI scribe vendor has a breach?

Per HIPAA, business associates must notify the covered entity (you) within 60 days. You then have responsibilities to notify affected patients. Strong vendor BAAs include indemnification language for the practice.

Related guides

• How to Write a Dental SOAP Note
• How to Write a Medical SOAP Note
• AI Medical Scribe vs Human Scribe
• Reduce Dental Practice Charting Time
• SOAP Note Examples by Specialty
• Physician Burnout & EMR Charting
• Patient Consent for Recording Visits