AI scribes and patient audio: ask the BAA question first

Short answer: A dental or medical practice should settle the business associate agreement question before an AI scribe or notetaker receives patient audio. HHS says a cloud provider handling electronic protected health information on a covered entity's behalf is a business associate, including when it cannot decrypt the information. Our recommendation is to hold patient-data use until the practice has confirmed the applicable agreement, covered features and configuration. Ask your counsel or privacy officer to decide how that guidance applies to the actual workflow, and test the proposed setup with invented patient information first.

Obsidian Ridge offers the assessment below. The vendor statements are dated evidence for a procurement discussion; the questions and pilot checklist are our recommendations, not a clinical endorsement.

Key facts

• Do we need a BAA first? For covered cloud uses, HHS describes a provider that will “create, receive, maintain, or transmit ePHI” on the entity's behalf as a business associate. Its guidance calls for an appropriate BAA and applicable safeguards. HHS cloud guidance, checked November 3, 2026.
• Otter.ai: Its help page puts the healthcare agreement route on Enterprise and says, “It becomes a Business Associate only when a signed BAA is in place.” This is the vendor's wording, not our definition of legal status. Otter source, checked November 3, 2026.
• Fireflies.ai: Its security page says, “Business Associate Agreements (BAAs) are available…”. Ask which subscription, storage setup and features the proposed agreement covers. Fireflies source, checked November 3, 2026.
• Read AI: Its overview specifies annual Enterprise+ and says “it is required to set up both SAML authentication and domain capture for the workspace before proceeding with signing the BAA”. Read source, checked November 3, 2026.
• Zoom: Its BAA page describes AI availability for customers with an agreement, but cautions, “Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place.” Confirm the exact feature before enabling it. Zoom source, checked November 3, 2026.

What should we ask before any patient audio goes in?

Ask the vendor to identify the legal entity providing the service, the account it will cover and the functions permitted under its proposed BAA. Attach a plain description of the intended use: who starts the recording, what is captured, where processing occurs, where the draft is stored and how the approved note reaches the practice's record system.

Our recommendation is to make this a written approval gate. A salesperson saying an agreement is available leaves several questions unanswered: whether the practice has executed it, whether the account is on the required plan, whether configuration is complete and whether every feature in the planned workflow is included. Do not let a free trial become a patient-data pilot while those answers are missing.

HHS's business-associate contract guidance says the agreement serves to “clarify and limit” permissible uses and disclosures. It also addresses obligations passed to relevant subcontractors. Ask counsel to review the proposed terms and the vendor's processing chain against the use you have described. HHS business-associate contracts, checked November 3, 2026.

Keep the contractual decision and the technical evidence together. The office manager should be able to point to one record saying which service is approved, for which practice account, with which features and who approved it. Put unanswered questions in the same record so a later employee does not mistake a partly completed review for permission.

How should we compare the four meeting tools?

Compare the evidence needed for your use, rather than selecting a product from a broad privacy claim. The table applies the vendor statements above to concrete next questions. It does not claim that these general meeting tools are clinical scribes or that any one is appropriate for a particular practice.

The dated vendor quotations in Key facts support the middle column. The last column is our recommended procurement question. Review the fuller registry entries for Otter.ai, Fireflies.ai, Read AI and Zoom AI Companion when collecting the source documents.

Those four are general meeting tools that a practice may also use for patient appointments. The scribes built for clinical documentation are a separate purchase and answer these questions in their own words: Freed Scribe, Heidi Scribe and Microsoft Dragon Copilot. Each of those pages records what the vendor publishes about training, retention and a Business Associate Agreement, plan by plan, with the date the page was read, and says plainly where we found no statement. Compare the one the practice is actually considering, on the plan it would actually buy.

The same questions reach past audio. A tool that reads radiographs receives patient information too, so the agreement, account, retention and access answers belong in the same record before any images go into it: Pearl and Overjet.

A missing answer is a reason to hold that use, not a reason to publish that the vendor never offers the capability. Likewise, an agreement route advertised for a business plan does not establish coverage for an employee's existing personal account. Verify the account the clinician will actually use in the room or call.

What needs a decision besides the BAA?

Map the proposed information flow as separate records: original audio, any video or screen capture, transcript, generated draft and the final approved note. Ask which copies exist, who can open each one and what the practice's retention and deletion instructions will be. Include exports to email, shared folders and record systems if the workflow proposes them.

HHS's cloud guidance also calls for the regulated entity to understand the service and conduct its own risk analysis. The BAA is part of that process; it does not replace the practice's risk analysis. HHS cloud guidance, question 1, checked November 3, 2026.

Our recommended questions cover access, data use and the end of the relationship. Who administers accounts? Can an employee share a recap outside the approved audience? What happens to records when a staff member leaves? What does the vendor keep after deletion or termination, including backups and operational logs? Ask for answers for each relevant record type, rather than assuming one retention period covers everything.

A no-training statement answers a model-training question. It does not by itself answer the agreement, access, retention or patient-notice questions. Ask the privacy officer and counsel to settle patient communications, recording permissions and any restrictions that depend on the specialty or information involved. Do not assume a routine appointment and a sensitive consultation can use an identical notice.

How do we run a useful pilot without patient information?

Use a fabricated conversation with no actual names, identifiers, recordings or clinical records. Label it as a test and choose a scenario the authorized clinical reviewer can evaluate. Our recommendation is to test the whole proposed workflow, not merely whether a summary appears on screen.

First, have the administrator show how the approved account starts and stops capture. Inspect any automatic joining or recording settings the tool presents. Check what the user sees when capture is active and what staff should do if an unapproved recorder joins. Record the result rather than assuming the default matches the policy.

Next, inspect the output from a user who should have access and a test user who should not. Check the proposed export destination and any automatically generated sharing links. If a restricted user can retrieve the invented note, fix the permissions and repeat the test before discussing patient use.

Finally, have the clinician compare the draft with the invented conversation. Check attribution, medications mentioned in the test, timing, omissions and invented statements. This is a workflow check, not a validation of clinical performance. Decide who reviews each draft and how a correction is recorded before any approved text enters a patient record.

Ask the privacy officer to approve test retention and deletion steps. Document what the interface shows after deletion and what the vendor says may remain elsewhere. A disappeared item on one screen is evidence about that screen, not proof that every copy has been erased.

What can the practice decide this week?

Use the following checklist to reach a narrow yes, a restricted pilot or a documented hold. These are our recommended operational steps.

1. Choose one workflow. Name the clinical owner, the proposed tool and the exact capture and output functions. Identify where patient information would enter.
2. Confirm the account and agreement. Match the practice account, plan and features to the proposed BAA. Have counsel or the privacy officer resolve scope and prerequisites.
3. Collect the data answers. Obtain the provider and subcontractor details, training terms, access controls, storage locations, retention, exports and exit process relevant to that use.
4. Approve patient communication. Decide the applicable notice or consent process and the alternative when recording is declined. Make the host's instructions usable during a busy appointment.
5. Demonstrate the controls. Run the invented-data pilot, including an unauthorized-access test and the clinical review step. Record failures and unresolved evidence.
6. Authorize a bounded rollout. Name who may use the service, what remains excluded, who checks the first outputs and what change triggers another review.

If patient audio has already entered an unapproved account, use the practice's incident process and involve its authorized privacy and security contacts. Preserve the facts needed for their assessment. Do not promise that deleting the transcript resolves the event or decide notification duties from this article.

Where does the AI inventory fit?

The approved workflow is only useful if the practice knows what staff already use. Ask about meeting bots, phone recorders, desktop tools and assistants inside existing applications. Our AI policy guide can help turn the resulting decisions into staff instructions, and the AI policy builder helps organize them.

Use the AI tool risk checker to collect open questions, alongside the dental industry guidance. Before an assessment itself is deployed in a patient-care environment, agree its access and data-handling scope with the practice's responsible reviewers. The approved offer below describes discovery and recommended fixes; it does not grant permission to collect patient information.

Sources

Opened November 3, 2026:

• HHS cloud-computing guidance: business associates, agreements and risk analysis.
• HHS business-associate contract guidance: contractual use and disclosure boundaries.
• Otter healthcare guidance, Fireflies security guidance, Read security overview and Zoom BAA guidance: vendor statements, not an independent certification of a practice's workflow.