10 Questions Every Emergency Clinician Should Ask an AI Scribe Vendor.

Most AI scribe sites lead with the same claims: HIPAA compliance, SOC 2, strong security, and protected patient data.

Those claims do not tell you how a vendor handles audio, transcripts, or drafts. One vendor may never write audio to disk while another archives it for years under a hospital contract. Both can say they are HIPAA-compliant.

Before signing, ask 10 specific questions. Where does audio live during transcription? How long are audio and every other artifact retained? Who can access patient data, and how is that access logged? Does patient data train models? What reaches logs? What is the data path from your browser to the model and back? How are deletion requests and breaches handled? When was the last outside audit? The answers should include names, locations, and time periods.

Why "HIPAA-compliant" is where the conversation starts

HIPAA compliance involves obligations for safeguarding patient information. A compliance claim alone does not tell you how a product handles audio, transcripts, or drafts.

The questions below are designed to produce answers you can compare. Ask them in writing. Verbal answers tend to become vague, while written answers require a commitment. If a vendor will not put a privacy claim in writing, record that as part of your evaluation.

10 privacy questions to ask an AI scribe vendor

Each question includes the detail a useful answer should contain.

1. Where is the audio while it is being transcribed?

A useful answer names the infrastructure: servers the vendor operates, or a named outside service under a signed BAA. "Our secure cloud" is not enough.

2. How long is the audio kept?

A useful answer gives a number or a mechanism. "Processed in memory and discarded when transcription completes" is specific. "Retained 30 days for quality review" tells you a recording exists for 30 days. "Handled according to our security policies" tells you nothing. Your AI Scribe Wrote the Note. Did It Keep the Audio? covers what to ask about saved recordings.

3. How long is everything else kept?

Audio is only the first artifact. The transcript, the AI's first draft, every edit, and every question to the built-in assistant can each have a different retention period. Ask for the full list with a number next to each item. If the vendor cannot provide that list, you still do not have an answer.

4. Who inside your company can access patient data, and how is that access logged?

A useful answer names roles, the access-control mechanism, and the audit log. "Only authorized personnel" is incomplete. Ask whether support staff can open a clinician's transcripts and drafts, and under what circumstances.

5. Is any patient data used to train models?

Look for a clear yes or no and a description of the data flow. Some vendors train on de-identified customer data; some do not. Ask what "de-identified" means for a verbatim conversation.

6. What ends up in your logs?

Ask what is logged, what is scrubbed, where logs live, and how long they persist. Request-body logging on a transcription route can place audio in a system that otherwise claims not to store it.

7. What is the data path from my browser to the model and back?

A useful answer traces every hop: application server, transcription service, language model, observability tooling, database, and the controls at each. "It goes through our pipeline" does not document the flow at a useful level.

8. How do you handle a deletion request?

Ask what happens when a patient or clinician requests deletion and how quickly it occurs. A vendor with short automatic retention may be able to say the data is already gone. A vendor with a 30-day archive and litigation-hold process should explain why an encounter cannot be promptly removed.

9. What is your breach notification procedure?

HIPAA sets the outer bound. A useful answer describes the vendor's timeline, who is notified, through which channel, and what the notice contains. "We comply with breach notification requirements" restates the law without describing the plan.

10. When was your last independent security audit, and by whom?

A recent SOC 2 Type II report or equivalent, with a date and an auditor, is evidence. A vendor without an outside audit should say so rather than imply one.

What to do with the answers

Put the responses in a table, one column per vendor. Comparing vendors side by side makes differences easier to see. Then weigh privacy alongside clinical quality, product fit, and price for your environment. An academic center with a prior breach may weigh privacy heavily; a small group may weigh it differently, but should still know what it accepts.

If the buying decision was made above you, ask your compliance team which questions procurement answered. If the answer is none, the tool's actual privacy posture is unknown, and asking for it is reasonable.

How palmER answers

palmER was built by emergency medicine physicians who use it on their own shifts. Its data-handling rules are straightforward.

Audio is not stored. It is transcribed and discarded, and the product has no player. Transcripts, drafts, edits, and questions auto-delete within 24 hours. Nothing you enter is used to train AI models. Data is encrypted and processed in US data centers, and the outside AI services palmER uses are contractually barred from retaining anything. The security page states these details in plain language, while What Does Your AI Scribe Save? shows what major tools publish for comparison.

Specific answers show that a vendor has mapped its data handling and made decisions about it. Vague answers leave you to guess.

Start your free 30-day trial of palmER and see the answers for yourself on your next shift. No credit card required.