The Cost of “Free” Ambient AI:
The Cost of “Free” Ambient AI: Protecting Mental Health Data in Psychiatric Documentation The rapid adoption of ambient AI scribes
PMHScribe is built on the same access controls, data handling standards, and privacy architecture that clinical software has required for decades. Your patients’ mental health records stay exactly where they belong.
No recording files stored. Notes retained until you delete them.
HIPAA’s minimum necessary standard means you share only what the receiving provider needs for treatment. Psychotherapy notes carry additional protections beyond the standard medical record. A consultation note sent to a surgeon does not need to include what a patient disclosed in the session. A HIPAA compliant AI scribe for mental health should reflect that distinction by default, not require a workaround.
Three steps. The session ends, the note is ready, and nothing from the encounter is stored as a recording.
PMHScribe listens through your device's microphone during the session. Speech-to-text converts your words in real time. No audio file is created or saved at any point in this process.
A working draft is generated from the session. Review, edit, and finalize it in the scribe. It is not a verbatim transcript and does not function as a recording.
The completed note goes into your EHR. Psychotherapy content stays where it belongs, separate from the medical record. The draft clears from the scribe when you're done.
Every feature in PMHScribe was built with the reality of psychiatric documentation in mind, not adapted from a general medicine tool.
The most common concern about AI scribing is whether a recording of the session is stored somewhere. PMHScribe uses speech-to-text conversion only. There is no audio file. There is nothing to subpoena, nothing to breach.
HIPAA treats psychotherapy notes differently from standard medical records. PMHScribe keeps that separation intact. Session content does not automatically appear in the chart note unless you put it there.
Documentation going to outside providers contains what those providers need for treatment purposes. The full session is not embedded in coordination of care notes, referral letters, or consultation summaries.
PMHScribe's Imminent Risk Assessment section captures suicidal ideation (SI), homicidal ideation, and protective factors as part of the clinical note. It does not leave the note unless you send it.
Your documentation remains accessible in PMHScribe until you choose to remove it. No automatic deletion schedules, no data disappearing without your action.
PMHScribe is hosted on Amazon Web Services (AWS), the same cloud infrastructure used by Epic, Athenahealth, and most major EHR vendors. Data is encrypted with 256-bit AES at rest. A Business Associate Agreement (BAA) is available for every practice.
HIPAA’s Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards. Here is how PMHScribe addresses each one.
PMHScribe maintains documented HIPAA policies and procedures, conducts regular risk assessments, and has a documented incident response plan. A dedicated security officer and healthcare legal counsel oversee compliance program management and workforce training.
PMHScribe runs on Amazon Web Services (AWS), whose data centers meet strict physical security requirements including access controls, surveillance, and hardware tracking. AWS physical safeguards are among the most audited in healthcare, used by Epic, Athenahealth, and most major EHR vendors.
Data is encrypted with 256-bit AES at rest. Access requires unique provider credentials with two-factor authentication (2FA) available. Audit logs track who accesses documentation, and access is limited to verified, licensed healthcare providers.
The most common concern about AI scribing is whether a recording of the session exists somewhere that could surface in a legal proceeding or a data breach. The answer is no. PMHScribe converts speech to text in real time. No audio file is created. There is no recording that could be subpoenaed, breached, or pulled up later.
What you get is a working draft, not a verbatim record. You edit it, finalize it, and either keep it in the scribe or delete it. What a patient said in a session, and how they said it, does not exist in any stored format beyond the note you write.
Clinical software has required provider verification since long before AI entered the room. PMHScribe follows the same standard.
PMHScribe accounts are provisioned for licensed healthcare providers. This is the same model used by EHRs, prescribing applications, and provider platforms like Doximity. Patient mental health records are not accessible to the general public.
Requiring provider verification before granting access to a clinical documentation tool is not a barrier. It is a baseline. The same expectation applies to any software that touches a patient record.
Group practices can provision access for their providers under a single account. Each provider's documentation remains separate, and access controls reflect how your practice actually operates.
No. PMHScribe uses speech-to-text conversion during the session. Your microphone processes audio in real time and converts it to text. No audio recording is created, saved, or stored at any point. The session does not exist as a recording that could be accessed later.
The rough draft transcript generated during the session is not a word-for-word record of the encounter. You can keep it in the scribe, edit it, or delete it. Your notes remain in PMHScribe until you remove them. Nothing is automatically deleted without your action.
Yes. PMHScribe operates as a HIPAA business associate and a BAA is available for practices that require it as part of their compliance documentation.
HIPAA gives psychotherapy notes stronger protections than standard medical records, requiring separate authorization for disclosure in most circumstances. PMHScribe keeps session content separate from the clinical note. What you choose to document in the finalized note is what goes into the record. Session content does not automatically carry over.
Patients have the right to access their medical records under HIPAA, which includes the clinical note you finalize and place in the EHR. The rough draft in PMHScribe is a working document, not a final medical record. The note you finalize and add to the chart is the record, and it is subject to the same access rules as any other chart note.
Clinical documentation software is built for licensed healthcare providers, and access reflects that. EHRs, prescribing applications, clinical reference tools, and provider platforms like Doximity all require provider verification before granting access to patient-related features. PMHScribe follows the same standard. It is the baseline for any software that touches a patient record.
PMHScribe is used by hundreds of psychiatrists (MD and DO), psychiatric mental health nurse practitioners (PMHNPs), physician assistants or physician associates (PA), and prescribing psychologists (RxP) across outpatient, telehealth, group practice, and integrated care settings.
Yes. PMHScribe runs on Amazon Web Services (AWS), which offers HIPAA-eligible infrastructure and is the same cloud environment used by Epic, Athenahealth, and most major EHR vendors. Data is encrypted with 256-bit AES at rest. Hosting on a recognized clinical-grade cloud platform is part of what makes HIPAA compliance operationally sound, not just contractually documented.
No. PMHScribe does not sell patient data or share it with third parties for purposes outside of operating the service. Your documentation is not used to train external models or distributed beyond what is required to process your note.
The Cost of “Free” Ambient AI: Protecting Mental Health Data in Psychiatric Documentation The rapid adoption of ambient AI scribes
At PMHScribe, we support 42 CFR Part 2 workflows by helping providers control what is included in the EHR. The
HIPAA, AI, and Patient Transcripts: What Clinicians Must Know About De-Identification Before Using AI Tools Artificial intelligence tools are rapidly
Learn why PMHScribe separates psychotherapy add-on documentation from E/M notes to reduce audit risk, protect patient privacy, and improve legal defensibility in subpoenas and court cases.
Patients’ Right of Access: How the 21st Century Cures Act, HIPAA, and Psychotherapy Notes Impact Mental Health Providers and How
Every plan includes a signed HIPAA BAA, NPI validation, and unlimited note retention. No upsells for compliance features.
/Month
or $799/Year
/Month
or $999/Year
More than one user?
PMHScribe gives you the documentation speed you need without trading away the privacy your patients expect. No recordings. Psychotherapy notes kept separate. Built by a PMHNP who has served as a HIPAA officer, trained clinical staff, and defended audits across multiple healthcare settings since 1993.