Michael Bannach
At 4:40 on a Thursday, one of the physicians at a five-provider family medicine practice stops the practice administrator in the hallway. For six weeks she has been using an AI note-taking app on her phone. It listens to the visit, drafts the note, and she pastes the draft into the EHR. She has been home for dinner every night, and she wants the practice to buy it for the other four providers. The administrator opens the vendor’s pricing page to look for a Business Associate Agreement. It is there, on the enterprise plan. The physician is on the individual plan, signed up with her personal email, under terms that let the vendor keep recordings to improve its product. The administrator spends what is left of the afternoon confirming the physician has stopped using the app and writing down which account it ran under and when it was first used. Tomorrow the physician charts the old way, and she will not be home for dinner.
Many AI note-taking tools are sold straight to individual clinicians. Signing up takes an email address and a phone. The app solves a problem most providers have, which is the hour of charting after the last patient leaves. Your practice has a process for the EHR, the billing company and the IT provider, because those arrived through the front office with a contract attached. The note-taker arrived through an app store. It never went near the BAA folder, the risk analysis or the access review, so as far as your records were concerned, it did not exist.
The App Became A Business Associate The First Time It Heard A Visit
A recording of a patient visit is protected health information. So is the transcript, and so is the draft note. A vendor that receives, stores or processes that information on your behalf is a business associate, and HIPAA requires a written Business Associate Agreement before it handles any of it. The consumer terms she clicked through are not that agreement. Those terms were written to protect the vendor. They do not commit the vendor to the safeguards and breach reporting a BAA requires.
The missing BAA is the headline problem, and it is rarely the only one. The account sits on a personal email address the practice does not control, possibly without multi-factor authentication. It is not on the access list, so nobody would think to close it when the physician leaves. The recordings may live on her phone, in the vendor’s cloud, or both. And no one at the practice can answer the questions an auditor would ask: where the audio goes, how long it is kept, who at the vendor can hear it, and whether it can be deleted on request.
What You Owe Once You Find It
Patient information went to a vendor without the agreement HIPAA requires. That has to be worked through as a possible breach, in writing, ending in a documented decision about whether patients must be notified. The analysis belongs with your privacy officer and your healthcare attorney. Your IT provider’s job is to gather the facts from the physician and the vendor and hand them over: which devices had the app, which account it ran under, how far back the use goes, and what the vendor confirms in writing about retention and deletion.
Two practical points. A BAA signed next week covers use from the signing date forward and does nothing for the six weeks before it. Before anything is deleted, have the physician, as the account holder, ask the vendor in writing what it holds, where, and whether any of it was used to improve its product. Once counsel has what it needs, ask for deletion in writing and a written confirmation when it is done. That confirmation goes in the incident log, next to the date you found the app and what you did about it.
A Ban On AI Tools Will Not Hold For Long
The tempting response is a one-line email telling everyone to stop using AI. The charting problem does not go away, and the next app the physician finds will have a different name and the same terms. A rule nobody can live with pushes the tool somewhere you cannot see it.
The rule that holds is a short path to yes. Any tool that hears, sees or stores patient information goes through one named person before anyone signs up. The vendor signs a BAA before the first visit is recorded. The account is opened under a practice email address with multi-factor authentication turned on, so it shows up in access reviews and gets closed when someone leaves. The tool goes into the risk analysis as a new place patient information lives. And the practice decides, with counsel, how patients are told the visit is being recorded, because the rules on recording conversations vary by state. The physician keeps her evenings, and the practice can show what the tool does with the audio.
Three Questions For Your Practice Administrator
- Which apps does anyone here use that hear, see or store patient information, and which of them have a signed BAA in our folder?
- If a provider started using a new tool on her own phone tomorrow, how would we find out?
- When a provider leaves, what happens to the patient information in accounts she opened with her personal email address?
If the answer to the first question is a guess, there is probably a tool in the building you have not found yet.
How We Handle It
Stealth RX is our managed IT for medical and dental practices, and both packages include routines that make a tool like this easier to find and easier to bring in properly. Every Stealth RX practice has a Business Associate Agreement with us. That agreement covers us. The note-taker needs its own. Multi-factor authentication goes on email and clinical logins. Access reviews and documentation are kept in a form you can hand to an auditor or a cyber insurance carrier, so the accounts you do know about get reviewed and the review is on paper. Annual HIPAA compliance and security awareness training for all employees comes with completion records. Vendor coordination is included, so when a software vendor needs to be involved, we work with them on the technical side. Regular business reviews with a named account manager give you a standing place to bring the next tool before anyone signs up for it.
To see how your practice measures up today, take the four-minute IT and security scorecard. You get back a written roadmap built from your answers, and the conversation that follows is free.
