
HIPAA-Compliant AI: How to Use LLMs With PHI Safely
How to build HIPAA-compliant AI: when LLM providers need a BAA, data minimization, de-identification, audit controls and a reference architecture.
How to choose an AI medical scribe: features to compare, EHR integration options, consent and BAA requirements, accuracy checks and questions to ask vendors.

AI medical scribes listen to a clinical visit and draft the note, so clinicians spend less time typing and more time with patients. The market has grown quickly, and "best scribe" lists go out of date within months. A better approach is to know what to look for and how the tool will fit into your EHR, privacy program and clinical workflow. This guide covers features, EHR integration options, consent and privacy, accuracy checks and the questions to ask any vendor.
Capture: the app records the conversation on a phone, tablet or computer, with the patient's agreement.
Transcription: speech recognition converts audio to text and separates speakers.
Note generation: a language model turns the transcript into a structured note, such as a SOAP note, in the clinician's preferred format.
Review: the clinician edits and signs the draft.
Write-back: the signed note, and sometimes orders or codes, move into the EHR.
The clinician remains responsible for the final note. Our article on the ambient AI medical scribe explains the technology in more depth.
| Feature | Why it matters |
|---|---|
| Specialty templates | Notes need to match how each specialty documents |
| Multi-speaker and multilingual capture | Visits often include family members, interpreters or more than one clinician |
| Source linking | Linking note sections to the transcript makes review faster and safer |
| Customization | Clinicians want control over style, length and section order |
| Orders, codes and patient instructions | Some tools draft more than the note, which adds value and review burden |
| Device and setting support | Clinic, inpatient, telehealth and mobile use may need different setups |
How the note reaches the EHR has a big effect on adoption.
| Option | How it works | Trade-off |
|---|---|---|
| Copy and paste | Clinician copies the draft into the EHR | Quick to start, but adds clicks and risk of pasting into the wrong chart |
| Embedded in the EHR | The scribe runs inside the EHR through a vendor program or SMART on FHIR launch | Best workflow fit, but depends on EHR vendor support |
| API write-back | The note is written to the record through FHIR or vendor APIs | Less manual work; needs integration and testing with your EHR team |
Our article on SMART on FHIR explains the launch model many embedded tools use.
Patient consent: tell patients the visit is being recorded and why, and let them decline. State laws on recording conversations differ, and some require every party's consent, so agree a consent process with your legal team.
Business associate agreement: the scribe vendor handles PHI, so it must sign a BAA, and its own subprocessors, including any LLM provider, must be covered (HHS sample BAA provisions).
Data retention: ask how long audio and transcripts are kept, where they are stored and whether they are used to train models.
Security: ask for encryption details and an independent security assessment.
Our guide to HIPAA-compliant AI covers these requirements for LLM-based tools.
Scribes can omit details, attribute statements to the wrong speaker or add content that was never said. Before rolling out:
Run a pilot with clinicians from each target specialty.
Review a sample of notes against the recordings for omissions, errors and invented content.
Track edit time and how much clinicians change each draft.
Ask clinicians whether the notes are complete enough to rely on.
Keep auditing a sample of notes after go-live.
The table below lists some well-known ambient documentation vendors as a starting point. It is not a ranking or an endorsement; check each company's site for current features, integrations and pricing.
| Vendor | Product |
|---|---|
| Microsoft | Dragon Copilot, which combines Dragon Medical One dictation with ambient capture |
| Abridge | Ambient clinical documentation |
| Suki | AI assistant for clinical documentation |
| Ambience Healthcare | Ambient documentation and coding support |
| Nabla | Ambient AI assistant for clinicians |
Which EHRs do you integrate with, and how: embedded, API write-back or copy and paste?
Will you sign a BAA, and which subprocessors handle our data?
How long do you keep audio and transcripts, and do you train on our data?
What accuracy evidence can you share, and will you support a pilot with our clinicians?
How do you handle model updates, and how will we be told about changes?
Healthtech teams building scribe or documentation features into their own products can see our AI implementation support.
The right AI medical scribe is the one that fits your EHR workflow, meets your privacy and consent requirements and produces notes your clinicians trust after a real pilot. Compare features, integration depth, BAA coverage and accuracy evidence, then keep auditing notes after launch.
If you are planning to adopt or build an AI scribe, book a consultation with Ekipa's HealthTech engineers.
Software that records a clinical visit, transcribes it and drafts a structured note for the clinician to review and sign.
They can be, if the vendor signs a BAA, covers its subprocessors, secures the data and follows agreed retention rules. Compliance depends on the vendor and how you configure the tool.
Patients should be told about the recording and allowed to decline. Recording laws vary by state and some require every party's consent, so set a consent process with your legal team.
Through copy and paste, an embedded app inside the EHR (often via SMART on FHIR or a vendor program), or API write-back of the signed note.
Accuracy varies by vendor, specialty and setting. Pilot with your own clinicians, review notes against recordings and keep auditing a sample after go-live.

How to build HIPAA-compliant AI: when LLM providers need a BAA, data minimization, de-identification, audit controls and a reference architecture.

Practical data migration planning guide for healthcare teams. Scope, mapping, compliance, validation, cutover and rollback decisions explained end to end.

Smart on FHIR guide for healthtech engineers. Learn the OAuth 2.0 launch model, scope syntax, backend services, and US regulatory requirements.
Connect with our team to explore how AI expertise can transform your business.