AI Scribes, PHI, and Healthcare Data Security
AI scribes generate a whole chain of data: audio, transcripts, prompts, drafts, edits, and logs. Every link in that chain can contain protected health information. How AI scribes, PHI, and healthcare data security connect matters more than just asking whether the vendor is HIPAA compliant. For the legal and consent side of that question, see Are AI Medical Scribes HIPAA Compliant? This article covers what data flows where, and what controls protect it.
AI scribes generate multiple PHI-containing artifacts: raw audio, transcripts, AI prompts, draft notes, edits, and audit logs, not just the final note. Each requires the same HIPAA Security Rule safeguards, including access control, audit controls, integrity, authentication, and transmission security. Integration architecture matters too. Clipboard-based scribes create unlogged PHI exposure, while direct EHR write-back keeps data inside a monitored, auditable system.
What PHI Actually Flows Through an AI Scribe?
What Counts as Protected Health Information?
Under HIPAA, PHI generally means individually identifiable health information held or transmitted by a covered entity or business associate. It includes anything related to a person's health, healthcare, or payment for healthcare.
For an AI scribe specifically, that means:
- Patient name and identifying details
- Medical history and symptoms
- Diagnoses and medications
- Treatment information
- Voice recordings or transcripts containing identifiable health information
- Clinical notes, draft or final
What's the Difference Between PHI and ePHI?
PHI is the broader category, and it can exist in electronic, paper, or spoken form. ePHI specifically means PHI that's maintained or transmitted electronically, which is what triggers the HIPAA Security Rule's technical requirements.
This difference matters for AI scribes because the moment a conversation becomes a digital audio file, transcript, or generated note, it's ePHI. It becomes subject to encryption, access control, and audit requirements, not just general privacy expectations.
Here's how the actual AI scribe PHI data flow maps out, across several distinct PHI-containing artifacts rather than one final document:
- Raw audio of the patient encounter
- Transcripts generated from that audio
- Prompts and context sent to the AI model, which may include prior diagnoses, medications, or other historical data
- Generated draft notes and structured data
- Clinician edits and final signed documentation
- Audit logs of access, edits, and posting
Each of these can independently contain ePHI and needs protection under the HIPAA Security Rule, not just the note that ends up in the chart.
What Does the Full Data Lifecycle Look Like?
A simplified version of the actual workflow: patient conversation, audio capture, transcription, AI processing, clinical note, clinician review, then storage or transfer.
Each stage raises distinct security considerations:
- Collection: does the tool record audio, when does recording start and stop, and is patient consent required?
- Processing: the AI transcribes speech, identifies clinically relevant information, and generates structured notes or SOAP-style documentation
- Storage: where is information stored, for how long, and can the organization configure retention?
- Transmission: data may move between the clinician's device, the AI scribe platform, cloud infrastructure, and the EHR. Each hop is a transmission-security question
What Security Rule Safeguards Actually Apply to AI Scribes?
HHS describes three broad categories of safeguards that apply to ePHI:
- Administrative safeguards (45 CFR 164.308): policies, workforce training, risk analysis, and assigned security responsibility
- Physical safeguards (45 CFR 164.310): facility access controls, workstation security, and device and media controls
- Technical safeguards (45 CFR 164.312): the five specific controls detailed below
Most AI-scribe discussions focus only on the technical category. The other two matter just as much. An AI scribe used on an unsecured personal device, without staff training on consent and handling, fails on administrative and physical grounds regardless of how well encrypted the vendor's servers are.
| Safeguard | What It Means for AI Scribes |
|---|---|
| Access control | Only authorized users and systems can access audio, transcripts, prompts, and notes |
| Audit controls | Every access, edit, and posting event to AI-generated content is logged and reviewable |
| Integrity | Transcripts and notes are protected from improper alteration, including undetected tampering |
| Person or entity authentication | Verifying that the user or system accessing PHI is actually who it claims to be |
| Transmission security | PHI moving between the clinic, scribe vendor, and EHR is protected in transit |
Worth knowing: a proposed rule from HHS OCR, published in the Federal Register on 6 January 2025, would make many currently "addressable" Security Rule specifications mandatory instead. "Addressable" has never meant optional, since organizations must implement the measure or document a risk-based equivalent, but this proposal would tighten that further. It remains a proposed rule: as of mid-2026 no final rule has been issued, and the Office of Management and Budget's regulatory agenda now targets July 2027 for final action. The existing Security Rule stays in force in the meantime.
HHS OCR's own guidance reinforces that the Security Rule's risk-analysis requirement covers new technologies specifically, including AI tools, not just legacy systems.
Clipboard vs. Direct EHR Write-Back: Which Is More Secure?
How an AI scribe actually delivers its output to the EHR matters as much as what safeguards it claims to have.
What's the Risk With Clipboard-Based Scribes?
Some AI scribes copy generated text to a device clipboard or browser memory for manual pasting into the EHR. Industry analysis suggests this can create PHI exposure outside the EHR's own security and audit perimeter: unlogged, harder to attribute to a specific user, and often flagged by data-loss-prevention tools as an uncontrolled risk.
What's Different About Direct EHR Write-Back?
Direct integration, for example via SMART on FHIR, keeps PHI inside the EHR's existing security and audit perimeter throughout, supports proper OAuth-based authorization, and creates clearer authorship and versioning than a manual copy-paste step.
What Should Organizations Track for Retention and Deletion?
- How long audio, transcripts, prompts, and draft notes are retained
- Whether logs themselves contain PHI, and how they're redacted or protected
- How data is deleted at the end of a contract or upon request
- Whether immutable records preserve the provenance of edits and changes
Why Does PHI Governance in AI Research Matter Too?
A scoping review published in the Journal of Medical Internet Research in November 2025 examined how studies using patient health information with large language models report their privacy protections. Screening 9,823 studies and including 464 published between 2022 and 2025, the review found that 38.4% failed to report whether effective PHI protection measures were implemented, 31.9% did not document patient informed consent, and 9.7% neglected ethical review, with a significant lack of transparency in anonymization and de-identification methods.
Worth being precise about: that review covered LLM research using patient health information broadly, not AI scribes specifically. The relevant lesson still transfers directly: don't assume "de-identified" or "research" uses of PHI in AI systems are automatically safe or compliant. Verify the actual de-identification method used.
Security shouldn't be an afterthought.
Ask any AI scribe vendor directly how PHI moves from audio to your chart, and whether that path stays inside an auditable system the whole way. That answer matters as much as the note itself.
See HosTalky's AI ScribeWhat Should You Know About Business Associate Agreements?
When an AI scribe vendor creates, receives, maintains, or transmits PHI on behalf of a healthcare organization, it qualifies as a business associate under HIPAA. Covered entities need satisfactory assurances that the vendor will appropriately safeguard ePHI, usually documented through a signed Business Associate Agreement (BAA).
When evaluating a vendor's BAA, look for clear terms on:
- Vendor responsibilities and security obligations
- Breach notification timelines and responsibilities
- Subcontractor and subprocessor requirements
- Specific data handling and permitted-use terms
Healthcare organizations should have their own legal counsel review any BAA before signing.
What Are the Biggest Security Risks of AI Scribes?
- Unauthorized access: compromised accounts, excessive permissions, or inappropriate access to recordings and notes
- Data exposure: misconfigured cloud storage, insecure third-party integrations, or improper data sharing
- Unintended disclosure: recording the wrong conversation, leaving a recording active by mistake, or sending information to the wrong destination
- Third-party subprocessors: an AI scribe often relies on multiple infrastructure and technology providers, and organizations should know who actually handles their data and why
- AI-generated inaccuracies: an inaccurate generated note can introduce incorrect information into the permanent record, which is a documentation-integrity risk as much as a privacy one
How Can Organizations Actually Protect PHI When Using an AI Scribe?
- Conduct a risk assessment. HHS requires regulated entities to conduct an accurate, thorough assessment of potential risks and vulnerabilities to ePHI, and an AI scribe needs to be explicitly included in that assessment, not assumed to be covered by a general IT review.
- Understand the vendor's actual data practices. Review the privacy policy, security documentation, retention and deletion practices, model-training policies, and subprocessor list directly. Don't rely on marketing language alone.
- Control user access deliberately. Appropriate authentication, permissions, and workforce access policies matter as much as the vendor's own controls.
- Train staff specifically on this tool. Staff should know when recording can be used, how to obtain consent where required, and what to do if something goes wrong.
- Review AI-generated documentation before it's finalized. Security includes protecting the integrity of the clinical record, not just its confidentiality. Clinicians should review generated notes, not sign them reflexively.
What Should a Practical AI Scribe Security Checklist Include?
Bringing AI scribes, PHI, and healthcare data security together into one practical framework means checking these specific items before adoption, not after:
- BAA and subprocessors: does the agreement cover the scribe service and all subcontractors, including model-training restrictions?
- Encryption: is it documented for both transit and storage, not just claimed generically?
- Access controls: role-based access and multi-factor authentication for all staff touching PHI
- Audit logs: immutable, reviewable records of who accessed or edited what, and when
- Retention and deletion: clear, configurable policies matching your organization's own requirements
- Integration architecture: direct EHR write-back rather than clipboard-dependent copy-paste
- Risk analysis: is the AI scribe specifically included in your organization's own HIPAA risk analysis, not just the vendor's?
- Model training: is patient data used to train or improve the underlying AI model, and can your organization opt out?
What Exact Questions Should You Ask a Vendor?
These direct questions surface most of what matters:
- Will you sign a Business Associate Agreement when applicable?
- Is patient data encrypted in transit and at rest?
- Is audio stored, and if so, for how long?
- Can our organization control our own data retention settings?
- Is our data used to train your AI models?
- Who has access to our patient data, internally and among subprocessors?
- What happens, procedurally, if there's a security incident?
- How is data deleted at the end of a contract?
- How are AI-generated notes reviewed and corrected before they enter the record?
Key Takeaways
- PHI in an AI scribe workflow is not limited to the final note. Audio, transcripts, prompts, edits, and logs all count.
- All five HIPAA technical safeguards (access control, audit controls, integrity, authentication, transmission security) apply at every stage.
- Clipboard-based scribes create PHI exposure outside the EHR's audit perimeter, while direct EHR write-back keeps data inside a monitored system.
- A signed BAA covers vendor obligations, but the healthcare organization must still run its own risk analysis and controls.
- "De-identified" AI research uses of PHI aren't automatically safe. Verify the actual method used.
- The January 2025 Security Rule proposal is still proposed, not final, with July 2027 currently targeted for final action.
FAQs
What parts of an AI scribe's workflow actually count as PHI?
More than just the final note. Raw audio of the encounter, the transcript, the prompts and context sent to the AI model, draft notes, clinician edits, and even audit logs of who accessed what can all contain protected health information and must be secured accordingly.
What are the 5 technical safeguards HIPAA requires under the Security Rule?
Under 45 CFR 164.312: access control, audit controls, integrity, person or entity authentication, and transmission security. Each applies directly to how an AI scribe handles audio, transcripts, and generated notes.
Why do some experts recommend against clipboard-based AI scribes?
Scribes that copy generated text to a device clipboard or browser memory create PHI exposure outside the EHR's security and audit perimeter. It is unlogged, harder to attribute, and often flagged by data-loss-prevention tools as an uncontrolled risk. Direct EHR write-back keeps PHI inside a monitored, auditable system.
Is a signed BAA enough to make an AI scribe secure?
No. A BAA covers the vendor's contractual obligations, but the covered entity must still conduct its own risk analysis, implement its own access controls and audit logging, and demonstrate its own compliance controls independent of what the vendor provides.
Is an AI-generated medical note considered PHI?
Yes. Once a note contains individually identifiable health information, and it almost always does, it is PHI. If it is stored or transmitted electronically, it is ePHI subject to the same Security Rule protections as any other electronic health record.
Can AI scribe companies use patient data to train their AI models?
Only if permitted under the signed BAA and applicable privacy rules. This is not automatic or universal across vendors. Healthcare organizations should ask directly whether their data is used for model training and whether they can opt out.
Sources & References
▾
