AI scribes are becoming a common part of clinical documentation, which means healthcare organizations are asking more questions about HIPAA security, data retention, and what happens to the information an AI scribe processes. Some scribes are integrated directly into electronic health records, while others operate as separate documentation platforms.
Regardless of where the scribe sits, the technology can create more information than ultimately appears in the final clinical note. A psychiatric encounter may include family dynamics, trauma, work problems, relationship conflicts, substance use, legal issues, and other details that provide important clinical context but may not need to remain in the permanent record.
That raises a practical question for psychiatric practices: what happens to the information used to create the note after the note is finished?
The answer depends on how the scribe is designed. Audio, transcripts, AI-generated drafts, and the final clinician-reviewed note may have different purposes and do not necessarily need to be maintained in the same place or treated as the same record.
PMHScribe was designed around that distinction. It operates as a separate psychiatric documentation workspace, allowing the clinician to determine what ultimately becomes part of the patient’s EHR while keeping the documentation process itself separate from the longitudinal chart.
Not necessarily.
HIPAA gives patients access to protected health information contained in a designated record set, or DRS. That generally includes medical and billing records as well as other records that are used, in whole or in part, to make decisions about an individual.
HHS has specifically addressed recorded information. The HIPAA Privacy Rule does not require healthcare organizations to record oral conversations or to retain audio recordings after they have been transcribed. If a recording is maintained and used to make decisions about the patient, however, it may become part of the designated record set.
HHS: Does HIPAA Require Access to Oral Information?
That makes the way an AI scribe is actually used important. A transcript used to assist with creating a note is different from a transcript that clinicians routinely return to later when making treatment decisions.
It is also important not to oversimplify this into an “inside the EHR versus outside the EHR” rule. PHI maintained by a business associate can still fall within a patient’s HIPAA access rights if it is part of the provider’s designated record set. HHS expressly recognizes that designated-record-set information may be maintained by a business associate on behalf of the provider.
HHS: Access to PHI Maintained by a Business Associate
The important questions are what the system retains, how the practice uses that information, who can access it, and what ultimately becomes part of the patient’s longitudinal record.
This concept isn’t entirely new.
For decades, clinicians dictated notes. The dictation was used to create the medical record, but that did not necessarily mean the original dictation needed to remain forever as a second version of the chart.
AI documentation adds new technology to essentially the same question. A single encounter may now generate temporary audio, a transcript, an AI draft, and ultimately a clinician-reviewed note. There is no reason to assume those materials all need to be maintained in the same place or treated as the same record.
That distinction may be particularly important in psychiatry. A raw conversation can contain much more information than the clinician ultimately determines is appropriate or necessary to document. The note is the clinician’s record of the encounter. It should reflect clinical judgment, not simply reproduce everything that happened to be said while the microphone was on.
HIPAA security is not just about whether a tool sits inside an EHR. It also matters where protected health information is processed, what systems receive it, who can access it, and what happens to it afterward.
The legal and privacy exposure can increase when clinical information is moved outside a protected, purpose-built healthcare environment. Copying a transcript or psychiatric conversation into a general-purpose AI tool may create another copy of that information under a different set of retention, access, and disclosure rules.
That does not automatically make the information discoverable or improperly disclosed. It can, however, expand the number of systems in which sensitive clinical information exists and complicate questions about access, retention, and legal process.
The point is not that one particular technology is inherently unsafe. Clinicians should understand where clinical information is going and whether the environment was designed to handle protected health information as part of a healthcare workflow.
A purpose-built clinical documentation system gives the practice a clearer framework for how information is handled, who can access it, and what ultimately becomes part of the medical record.
“EHR integrated” can mean different things depending on the product.
Microsoft’s current documentation for DAX Copilot for Epic provides a useful example. Microsoft says the recorded audio, note summary text, and transcript for a DAX session are retained for 30 days. The combined transcript is available through the DAX Copilot activity within Epic during that period, while the recordings themselves are stored on Microsoft Azure servers.
Microsoft: DAX Copilot for Epic FAQs
That is not necessarily a problem, and it does not mean those materials automatically become part of the HIPAA designated record set. But it shows why clinicians should look beyond the phrase “integrated with my EHR.”
If the transcript is available while the clinician is inside the patient’s EHR encounter, where does the documentation workspace end and the patient’s permanent record begin? Is the audio retained? Who can access the information? What ultimately becomes part of the chart?
Those questions matter more in psychiatry than simply whether the workflow requires another login.
A recent Washington case provides an early example of a court distinguishing between an AI documentation tool and the medical record it helped create.
In Raphael v. Mantei, a patient sought access to an ambient recording used during a telehealth encounter at The Vancouver Clinic. The system involved Nuance DAX, which generated a draft summary that the physician reviewed and edited before the final documentation entered the chart.
In August 2026, a Washington trial court concluded that using the DAX recording to help prepare the written record served an administrative purpose under Washington law. The recording was therefore exempt from the patient’s records request.
AMA: Patients Don’t Have Right to Ambient AI Recordings, Court Says
The decision is limited. It is a Washington trial-court decision under Washington law, not a nationwide HIPAA ruling, and it did not establish that AI recordings or transcripts are immune from subpoenas or discovery.
What makes the case interesting is the distinction the court was willing to recognize: the tool used to prepare the medical record was not necessarily the medical record itself. That is an important distinction when deciding how an AI scribe should be designed.
PMHScribe takes a separate-workspace approach to psychiatric documentation.
The encounter is processed in PMHScribe, the clinician reviews the generated documentation, and the clinician determines what ultimately enters the patient’s EHR. The transcript remains in PMHScribe rather than automatically becoming part of the longitudinal chart simply because it was used to create the note.
This gives the practice a clearer boundary between the documentation workflow and the permanent medical record.
PMHScribe does not provide clinicians with a retrievable library of encounter audio recordings after processing.
For psychiatry, that distinction is meaningful. A complete recording can preserve every incidental comment and identifying detail from a clinical conversation, including information that never belongs in the final medical record.
HHS itself recognizes that HIPAA does not require healthcare organizations to retain recorded information simply because it was used to create a transcription.
The PMHScribe transcript exists to help the clinician produce the note. It is text used in the documentation workflow, not an audio archive of the psychiatric session, and it remains in PMHScribe rather than becoming part of the patient’s EHR simply because the scribe was used.
The transcript should still be treated as PHI. It may contain highly sensitive and identifying clinical information, which is why practices should understand where transcripts are stored and how they fit into their own records policies.
PMHScribe does not impose a fixed transcript-retention schedule. Transcripts stay in PMHScribe until the provider or organization decides to delete them.
That allows practices to apply their own records policies based on how they use the system rather than relying on a single vendor-selected retention period.
When a transcript is deleted through PMHScribe, it is no longer available to the clinician for later retrieval through PMHScribe.
Practices using PMHScribe can limit the identifying information they display in the system, including using patient initials rather than entering a full name if that is appropriate for their workflow.
That can reduce unnecessary identifying information, but it should not be confused with HIPAA de-identification. A transcript labeled “JD” instead of “Jane Doe” can still be PHI. In psychiatry, the contents of the conversation itself may contain enough information to identify the person.
The point is not that PMHScribe makes clinical information anonymous. It is that practices can limit unnecessary identifiers rather than duplicating full patient demographics across every system they use.
For more about HIPAA de-identification and the 18 Safe Harbor identifiers, see our separate guide on HIPAA, AI, and Mental Health Documentation.
No.
A separate system does not make information legally invisible. If a transcript still exists and falls within the scope of valid legal process, it may potentially become subject to a subpoena, discovery request, court order, or other legal requirement.
The distinction is more practical than that. Using a separate documentation platform means the transcript does not automatically become another artifact within the EHR environment simply because AI was used to write the note. The final clinician-reviewed note can enter the EHR without requiring the entire documentation workspace to accompany it.
Many specialties use ambient AI, but psychiatric documentation is unusually dependent on narrative.
A patient’s clinical encounter may contain information about a spouse, children, employer, trauma, substance use, finances, sexuality, legal matters, interpersonal conflict, or other people who are not even the patient. Much of that information may help the clinician understand the encounter. Far less of it may be necessary in the permanent chart.
There is therefore a legitimate privacy and records-management question in psychiatry: why preserve more of the underlying conversation than the practice actually needs?
The ability to capture an entire encounter does not mean the entire encounter needs to become a permanent digital artifact.
HIPAA compliance is not determined simply by whether an AI scribe is built into an EHR. Clinicians and healthcare organizations should understand how the vendor handles protected health information throughout the documentation workflow.
Important questions include whether the vendor will sign a Business Associate Agreement, where clinical information is processed and stored, who can access it, whether encounter audio is retained, how transcripts are handled, whether patient data is used for purposes beyond providing the service, and whether anything enters the medical record without clinician review.
PMHScribe provides a Business Associate Agreement for HIPAA-regulated customers and was designed specifically for clinical documentation in psychiatry and mental health rather than as a general-purpose AI tool.
Not necessarily.
An AI scribe can be secure and HIPAA-compliant whether it is integrated with an EHR or operates as a separate clinical documentation platform. The more important question is how the system handles the information generated during the encounter.
For psychiatric practices, it is worth asking:
Does the system retain encounter audio?
Where are transcripts and other documentation artifacts stored?
Is the transcript accessible from within the EHR?
Who can access the information?
Does anything enter the medical record before clinician review?
What information ultimately becomes part of the patient’s chart?
Does the vendor use patient information for purposes beyond providing the service?
Will the vendor sign a Business Associate Agreement?
An EHR integration may make the workflow more convenient, but integration itself does not determine whether the underlying privacy architecture is better.
PMHScribe takes a different approach. The documentation workspace remains separate from the EHR, PMHScribe does not provide clinicians with an ongoing library of encounter audio recordings, and the clinician decides what documentation ultimately becomes part of the patient’s chart.
Are AI Scribes HIPAA Compliant?
They can be, but HIPAA compliance depends on how the technology is implemented and how protected health information is handled. Healthcare organizations should evaluate the vendor’s security practices, data handling, access controls, storage, and Business Associate Agreement rather than assuming that every AI scribe is automatically HIPAA compliant.
Is It HIPAA Compliant to Use AI for Clinical Notes?
AI can be used for clinical documentation in a HIPAA-regulated environment when the technology and workflow are appropriately configured to protect PHI. The fact that a tool uses artificial intelligence does not by itself determine HIPAA compliance.
Does a HIPAA-Compliant AI Scribe Need a Business Associate Agreement?
When an AI scribe vendor handles PHI on behalf of a HIPAA-covered entity in a role that makes it a business associate, a Business Associate Agreement is generally required. PMHScribe provides a BAA for HIPAA-regulated customers.
Is an AI Scribe Transcript Part of the Medical Record?
Not automatically. Whether a transcript is part of the HIPAA designated record set depends on how it is maintained and used, including whether it is used to make decisions about the patient.
Does PMHScribe Retain Encounter Audio?
PMHScribe does not provide clinicians with a retrievable library of encounter audio recordings after processing.
What Is a PMHScribe Transcript?
The transcript is a working document used to help generate and review clinical documentation. It remains separate from the patient’s EHR unless the clinician chooses to place information from it into the chart.
Does PMHScribe Automatically Delete Transcripts?
No. PMHScribe allows the clinician or organization to decide whether to retain or delete transcripts based on its own workflow and records policies.
Can Patients Access AI Scribe Recordings or Transcripts?
Possibly. Patient access rights depend on whether the information is part of the designated record set and on applicable state law. In Raphael v. Mantei, a Washington trial court concluded that a particular ambient recording used as a documentation aid was exempt from the patient’s records request under Washington law.
Can AI Scribe Transcripts Be Subpoenaed?
Potentially. Keeping information outside the EHR does not make it immune from lawful legal process.
Is an EHR-Integrated AI Scribe Automatically More Private or Secure?
No. Integration describes the workflow, not necessarily the privacy or security architecture. Storage, access, data handling, clinician review, vendor practices, and what ultimately enters the medical record all matter.
AI scribes create information that goes beyond the final note. In psychiatry, that may mean processing an entire highly personal conversation to produce a relatively concise clinical record.
The important question is what happens to the rest of that information afterward.
PMHScribe keeps its documentation workspace separate from the EHR. It does not provide an ongoing library of encounter audio, the transcript remains in PMHScribe as a working document, the practice controls whether it is retained or deleted, and the clinician determines what ultimately enters the patient’s chart.
For psychiatric practices, that can offer a privacy advantage worth considering when comparing AI scribes: greater control over where sensitive clinical information lives and what ultimately becomes part of the permanent medical record.
This article is for educational purposes only and is not legal advice. HIPAA, state medical-record laws, retention requirements, consent laws, and discovery obligations differ by jurisdiction and by how a healthcare organization uses its technology.
About PMHScribe
PMHScribe is an AI documentation platform built specifically for psychiatrists, psychiatric mental health nurse practitioners, therapists, counselors and behavioral health clinicians. Founded by practicing PMHNP Allison Sikorsky, PMHScribe helps clinicians turn patient encounters into structured psychiatric and mental health documentation while keeping the clinician in control of the final note.
