AI scribes have moved from novelty to default in a lot of practices. The pitch is real — clinicians spend less time typing and more time with patients. The risk is quieter: the note is still the clinician’s, and it is still the thing a regulator, a board, or a plaintiff will read.
What an AI scribe actually changes
It changes who produces the first draft. It does not change who is responsible for the record, what the record must contain, or how the underlying data must be protected.
That distinction sounds obvious and is routinely lost in practice, because a note that arrives already written invites signing rather than reading.
The obligations that do not move
| Obligation | Still applies |
|---|---|
| Accuracy of the record | The signing clinician owns it entirely |
| Documenting clinical reasoning | A transcript is not reasoning |
| Evaluation before treatment | A scribe records the exam; it does not perform one |
| Patient privacy | The vendor is handling PHI — see below |
| Records custody | The record belongs to the professional entity, not the vendor |
| Retention and access | Unchanged by how the note was drafted |
The vendor is a business associate
If a tool processes protected health information on your behalf, you need a business associate agreement with the vendor before it touches patient data. Ask specifically:
- Will you sign a BAA? (If the answer is anything other than yes, stop.)
- Is audio retained, and for how long? Can retention be disabled?
- Is our data used to train your models? Can we opt out in writing?
- Where is data stored and processed, and which subprocessors touch it?
- What happens to our data if we leave?
- Have you had a breach, and what is the notification process?
The training question is the one most often glossed over in sales conversations and most often material to a patient.
The specific failure mode: plausible fabrication
The dangerous error is not a garbled sentence — it is a fluent, reasonable-sounding statement that is wrong. A note recording a normal finding for an exam element that was never performed, or a discussion of risks that never happened, reads perfectly and is false.
That is worse than a blank field. A blank field is an omission; a fabricated normal is an affirmative misstatement in a legal document, signed by a clinician.
Review has to be genuine. If a clinician is signing thirty notes in four minutes, the tool has replaced documentation rather than assisted it.
Consent and disclosure
Recording a clinical encounter raises consent questions that vary by state — several require all parties to consent to recording. Patients should be told, and the disclosure should be documented. “The vendor said it was fine” is not a position.
Practical guardrails
- BAA signed before the tool touches a single patient encounter.
- Written confirmation on training use and retention.
- Patient notification and consent, documented, appropriate to your states.
- A review standard staff actually follow, with sign-off meaning the clinician read it.
- Periodic audit — pull a sample and compare notes against what happened.
- An answer to who is accountable when a note is wrong. It is the signing clinician.
Where this fits for a practice like yours
Aesthetic and wellness practices document less rigorously than primary care, and AI scribes are attractive precisely because documentation is the weak point. That is the reason to be careful: a tool that makes thin documentation look thorough has increased your exposure rather than reduced it.
Good documentation shows a decision being made. That is a clinician’s job, and it is the part no tool does for you.
How MDside approaches this
We build and own the clinical software our practices run on, so records stay inside the professional entity and vendor terms are ours to set. Where a practice uses an outside scribe, our protocols define the review standard and the BAA requirement before it is enabled.
See what is included, or read about what the record has to show.
Frequently asked questions
Do I need a BAA with an AI scribe vendor?
If the tool processes protected health information on your behalf, yes — signed before it is used on patient encounters.
Who is responsible if an AI-generated note is wrong?
The clinician who signed it. Signing is an attestation that the record is accurate.
Can vendors use our patient data to train models?
Some seek to. Ask directly, get the answer in writing, and opt out if the terms permit.
Do patients need to consent to being recorded?
Consent requirements for recording vary by state and several require all parties to consent. Notify patients and document it.
What is the most common problem?
A fluent note describing exam elements or discussions that did not occur. It reads well, which is exactly why it gets signed.
General information about documentation and privacy obligations, not legal advice. Recording-consent and privacy requirements vary by state. Confirm vendor terms and consent practice with healthcare counsel.