The Audio, the Drafts, the Questions: What Does Your Hospital's AI Save?

Picture a deposition eighteen months from now. The plaintiff's attorney begins by playing the audio recording of the encounter. They ask about the transcript, the AI's first draft, every edit you made, and every question you asked the AI that night.

The record behind the record

Your signed note is the medical and legal record of the encounter. So you thought.

If you use your facility's AI, much more than your signed note can be kept:

• The audio recording of the entire conversation, small talk included, along with whatever a family member said from the corner of the room.
• The transcript of that audio, transcription errors included. Did you proofread and correct it? If you did, that's likely saved too.
• The AI's draft notes, before your edits.
• Your prompts, inputs, and questions: typed instructions, corrections, and whatever you asked the built-in AI assistant.
• Other data kept to debug or improve its models.

None of that was in the chart you signed.

What other tools keep

Here’s what we found:

• Microsoft Dragon Copilot (formerly DAX Copilot): Microsoft's own documentation states that Dragon Copilot "retains audio, recognized text, transcript, and flowsheet value data for up to 90 days." Its privacy white paper adds that select customer data, audio and transcripts included, is copied to a research environment and anonymized for ongoing model training. For the legacy DAX Copilot product, Microsoft's FAQ states that summaries and transcripts are accessible for 30 days and then "automatically deleted from both the desktop and mobile app," that recordings "are stored on Microsoft Azure Servers" with no stated deletion timeline for those server copies, and that a clinician cannot delete a summary, only archive it. And it isn't just audio: Microsoft's data collection white paper lists "all versions of edited AI drafts," your corrections, and the final signed documentation as required service data.
• Abridge: Abridge's privacy policy publishes no retention number. CPCMG tells patients audio and transcripts are deleted after 30 days; UC Davis Health says all recordings are deleted after 30 days; UChicago Medicine says recordings never last more than a week. In litigation filed against Sharp HealthCare in early 2026, a patient who asked for his recording to be deleted was reportedly told that Abridge retains data for 30 days and the recording could not be promptly removed. How long draft notes and your edits persist is not published anywhere. Abridge also says its newest foundation model will be trained with de-identified data.
• Suki: Suki's security FAQ states that the original audio recording "is permanently deleted after 30 days" and the transcript on the same schedule, but the final clinical note "is retained for the duration of your service contract," and its privacy policy keeps an open-ended clause that can extend past the relationship. De-identified data is used for model training.
• Nabla: Nabla's trust center states "By default, we don't store audio" and that clinical notes are retained for 14 days, configurable per client. Its terms still reserve the right to "freely use any patient information" once it has been fully de-identified.
• Your hospital's specific setup: retention is set by the contract between the health system and the vendor, and often by hospital policy on top of it, so the same product can behave differently at different hospitals. The Abridge deployments above range from under a week to 30 days, and Cleveland Clinic says recordings from its Ambience scribe are held for about 30 days, then de-identified. Retention can also outlive the vendor's window entirely: Microsoft offers health systems a Fabric integration that "creates a historical repository of DAX Copilot interactions," transcripts and audio files included, under the hospital's own control. The American Bar Association's health law group notes that these recordings and transcripts create new data flows, storage points, and access risks, and advises counsel to assume AI documentation may be scrutinized in malpractice claims, privacy actions, and regulatory investigations.

The deposition problem

Retained data can be discoverable data. Don't take our word for it:

• ProAssurance, a major malpractice carrier, puts it plainly: "If a system retains a complete audio recording of the patient-physician interaction, it will undoubtedly be discoverable in litigation." The same piece warns that even a seemingly minor inconsistency between the recording and the note "could undermine the accuracy and reliability of the entire medical record."
• Health-law firms warn about the dual-record problem: when audio and transcripts exist behind the note, a plaintiff's lawyer can claim the medical record produced in litigation is incomplete, and allege spoliation of evidence if that data was deleted.
• MICA, another carrier, is blunt about the drafts: it is always the clinician's duty at the electronic-signature stage to catch and correct AI errors before they become part of the permanent record. It also notes that vendors may retain recordings, and that recordings must sometimes be kept for regulatory reasons or under a litigation hold.

Think about what a plaintiff's expert can do with three versions of one encounter: what was said (audio), what the AI heard (transcript), and what you signed (note). Your note says "neuro exam nonfocal." In the transcript, the patient's daughter mentioned a stumble over a curb last month. That didn't make it in the chart. You practiced good medicine. The attorney disagrees, and the AI is now testifying against you.

Speech recognition is good, but it's not perfect. In benchmarks, the best systems still make 4-5 errors per hundred words. "No chest pain" transcribed as "chest pain" is now in the record. Eighteen months later you're explaining why your note contradicts the transcript.

Correct the transcript, and that correction is saved too. Now the argument is about whose ears to trust. A plaintiff's attorney can suggest you changed what the patient actually said. Or as everyone can clearly see from the transcript, you misheard the patient.

It's not just the scribe

Many EMR-integrated platforms include an AI-powered medical reference. The questions you ask it can be saved too.

Microsoft's transparency documentation for Dragon Copilot says the system ingests "typed or pasted text, and natural-language prompts," counts "clinician inputs" among the customer data it processes, and offers an Information Assist feature whose own example queries include "What antibiotics are recommended for a diagnosis of Community-Acquired Pneumonia?" and "Can metformin be crushed and administered via feeding tube?" Microsoft says "the extension and relevant prompts are being continuously evaluated for enhancement and optimization." What none of its Dragon Copilot documentation publishes is a retention period for those questions. The 90-day statement covers audio, recognized text, transcripts, and flowsheet data.

Abridge invites you to "ask any clinical question in natural language" mid-visit, and offers CME credit for point-of-care questions, which only works if those questions are logged in a way that's attributable to you. Abridge does not publish how long it retains clinicians' questions. Suki markets its assistant for asking questions about the chart, and its only published retention schedule covers ambient sessions.

So what's the issue? Double-checking a dose or guideline is done all the time. In the AMA's 2026 survey, 81% of physicians report using AI in practice, and in one academic hospitalist study the single most common use of AI was answering clinical questions.

The problem is that it's a timestamped, verbatim record of what you weren't sure about, held by a third party, tied to a patient encounter. EMR audit trails taught plaintiff attorneys this playbook years ago: "every keystroke leaves an electronic footprint," as one malpractice carrier puts it, and audit trails are routinely requested and produced in malpractice litigation. ProAssurance's guidance on AI and privilege extends that to the next layer: a clinician's research on AI platforms is not privileged, the searches themselves "may be discoverable through written discovery or deposition," and defense counsel now tell clinicians to stop researching on any platform, AI included, the moment litigation is possible.

In the New York Times' copyright litigation against OpenAI, a federal court ordered OpenAI to preserve ChatGPT logs, including chats users had asked to delete, and later ordered 20 million de-identified conversations produced to the plaintiffs.

Here's the next question in your deposition: "Doctor, at 2:41 a.m. you asked the AI how to dose this medication. Do you routinely need help with that?"

The palmER difference

palmER was built by physicians who use it on their own shifts. We know that anything retained is something we may have to answer to later. So we made sure that could never happen.

Retaining data is a choice, and it's a choice that serves someone other than you. And you're left carrying the risk.

How we built palmER:

• Audio is never saved. It is transcribed and then immediately discarded. Audio never touches storage, it's never sent to a third party, and nobody, including us, can ever listen to an encounter.
• Everything else is permanently deleted within 24 hours. Your inputs, transcripts, chats, and generated drafts, including the questions you ask, exist only as long as you're using them.
• Zero-retention agreements. The AI providers we use are contractually barred from retaining any data.

Five questions you should ask

1. How long is the audio kept, and where? "It's deleted" is not an answer. Ask for the number of days and the storage location.
2. What else is retained? Transcripts, drafts, edit history, prompts, and the questions you ask the built-in assistant. Ask for the full list of artifacts.
3. Who can access it, and can it be pulled for litigation? If it exists, assume it can be subpoenaed. Ask how a litigation hold works.
4. Can a patient (or a clinician) get it deleted on request? In the Sharp HealthCare case, a patient who asked was reportedly told the recording could not be promptly deleted.
5. Is any of it used to train models? "De-identified" is doing a lot of work in many vendor answers.

The bottom line

You already carry the medicolegal weight of every chart you sign. You should not also have to answer for a shadow record of the encounter: one you've never seen, hosted by a vendor you've never met, retained under a contract you've never read.

Your signature should be the last word on the record. With palmER, it is. And when an attorney asks what else exists, you already know the answer: nothing.

---

This article discusses publicly documented vendor policies and general commentary as of July 2026. Retention behavior varies by institution and contract, and policies change. It is not legal advice; for questions about your exposure, talk to your risk management team or an attorney.

Sources: Microsoft Learn, Dragon Copilot FAQ on retention · Microsoft's Dragon Copilot privacy white paper · Microsoft's Dragon Copilot data collection white paper · Microsoft's DAX Copilot FAQ on data retention · Microsoft Learn on DAX Copilot data in Fabric · Abridge privacy policy · Abridge on its foundation model · CPCMG on Abridge privacy and retention · UC Davis Health on clinical note-taking technology · UChicago Medicine on ambient documentation · Suki's security and compliance FAQ · Nabla's trust center · Medical Daily on the Sharp HealthCare AI scribe lawsuit · Business Insider on Cleveland Clinic's Ambience scribe · Microsoft's Dragon Copilot transparency white paper · Microsoft's Information Assist transparency white paper · Abridge Clinical Decision Support · Suki Assistant · ASCO Post on the AMA's 2026 physician AI survey · JMIR survey of hospitalist AI use · Cooperative of American Physicians on EHR audit trails · Frier Levitt on EMR audit-trail discovery · ProAssurance on AI and privilege · Jones Walker on the OpenAI chat-log production order · ProAssurance on ambient listening risk · McAfee & Taft on virtual scribes and discoverability · MICA on AI scribe liability · ABA Health Law on ambient AI scribes · Hugging Face Open ASR Leaderboard