Choosing an AI scribe for a small practice: 10 questions to ask before you sign

July 5, 2026 · The Visit to Chart team

There are now dozens of AI documentation tools, and their marketing pages are largely indistinguishable. The differences that matter live in the answers to unglamorous questions about agreements, retention windows, and what happens to your patients' audio after the note is signed. Here are the ten we'd ask any vendor — including us.

The dealbreakers

1. Will you sign a Business Associate Agreement before the first patient use? Not "we're HIPAA compliant" — a signed BAA. Processing PHI through a vendor without one is itself a HIPAA violation, and regulators have brought enforcement actions where the core failure was simply a missing BAA. No BAA, no pilot.
2. Which subprocessors touch patient data, and do you have BAAs with each of them? Most AI scribes are built on cloud infrastructure and third-party models. That's normal — what matters is that every link in the chain (hosting, transcription, the AI model) is under a BAA, and that the vendor will name them.
3. Is our patients' data used to train your models? The answer should be an unqualified no — or a precisely-scoped explanation of de-identification you'd be comfortable defending to a patient. "We may use data to improve our services" is not an answer; it's a yes wearing a trench coat.
4. How long do audio, transcripts, and notes live on your systems — and can we verify deletion? Look for specific timelines (days, not "industry standard practices") and automatic purging rather than delete-on-request.

The workflow questions

5. How does patient consent work? The tool should make consent a step in the workflow — captured before recording starts — not a paragraph in your intake packet that nobody remembers. Multi-state telehealth practices should ask how the tool handles differing state recording-consent laws.
6. What exactly does the physician review before signing? You want a tool that treats the physician as the author of record: clear drafts, easy editing, and an AI disclosure on the note. If the workflow nudges you to sign without reading, the time-savings are borrowing against your license.
7. What stops the AI from writing things that weren't said? Ask directly: what happens when the model is tempted to fill in a normal exam that wasn't performed? The right answer involves explicit guardrails and flagging gaps for the physician — not confidence.
8. Does it fit my specialty? A note format that works for a 10-minute follow-up may collapse under a 90-minute evaluation. Ask to see a draft from a visit that actually looks like yours.

The practicalities

9. What are the security basics? Encryption in transit and at rest, multi-factor authentication, per-user data isolation, and audit logging should be table stakes — stated plainly, in writing.
10. How does the note get into my EHR, and what does it really cost? Understand the export workflow and the pricing model — per user, per note, or per month — and what happens to your data if you leave. A vendor confident in its product makes leaving easy.

A note on trials

Whatever you choose, run a real evaluation: a few weeks, your actual visit types, with you grading the drafts. The compliance answers protect your practice; the draft quality decides whether you'll still be using the tool in six months.

Sources

• BAA Requirements When Using an AI Medical Scribe (Transcribe Health)
• HIPAA Compliance and AI Medical Scribes (Virtual Scrivener)
• Guide to HIPAA-Compliant AI Note Taking (Commure)
• Using AI Scribes and Legal Compliance (DMC Law)