AI scribes for dental notes: questions to ask a vendor

This post is general education from Copeland Consulting Services. It is not legal, compliance or purchasing advice. It names no products. Ask your attorney and privacy officer to review any vendor agreement.

What is an AI scribe?

It is software that turns a recorded or transcribed visit into draft clinical notes. The AI dental scribe falls under the wider area of artificial intelligence in dentistry. The ADA says AI use in the dental industry “is increasing” and curates resources on it on its digital dentistry page.

ADA News also lists “administrative support” among AI uses in practices, such as scheduling and billing help. Notes are a clinical record, so a scribe sits closer to patient care than a scheduling helper. That raises the bar for review.

Why does HIPAA matter for a scribe?

A scribe handles patient information, and HIPAA governs that information. HHS says its Privacy, Security and Breach Notification Rules apply to covered entities, which include health care providers who transmit health information electronically in connection with a covered transaction. A dental practice is usually one of them. See HIPAA for the basics.

HHS defines a business associate as, generally, a person engaged by a covered entity to carry out health care activities or provide services that involve the use or disclosure of protected health information (PHI). A business associate agreement is the written arrangement that makes the vendor promise to safeguard the data.

HHS gives examples that sit close to a scribe:

• An “independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician.”
• A cloud service provider “engaged to create, receive, maintain, or transmit electronic PHI.”
• An IT vendor that supports systems requiring access to electronic PHI.

Whether a particular tool is a business associate is a fact question. Your attorney can answer it from the tool’s design and contract.

What does a business associate agreement have to say?

HHS says the agreement must describe the permitted and required uses and disclosures of PHI. It must provide that the vendor will not use or further disclose PHI other than as the agreement permits or as law requires. Under the Security Rule, it must require compliance with applicable security requirements and reporting of security incidents, including breaches of unsecured PHI, to the practice.

HHS also says a business associate must have its own agreement with any subcontractor before it shares PHI. That matters when a scribe vendor relies on a cloud host or another software company. Ask who the vendor’s subcontractors are.

Which questions should a practice ask a vendor?

Ask these in writing and keep the answers. The questions are general prompts to discuss with your own advisers. They draw on the HHS and ADA points above.

What other terms should the contract cover?

Beyond the agreement for PHI, a vendor contract should answer practical questions. These are suggestions, not HHS rules.

1. Price and term: what is charged, for how long, and what notice ends the deal?
2. Support: who fixes errors, and how fast?
3. Integration: how do notes reach the practice management system and the electronic health record?
4. Changes: how will the vendor tell the practice about new features or data uses?
5. Liability: what does the vendor owe if its tool causes a breach?

The ADA digital dentistry page notes that “implementation and use of dental office technology are often challenging.” A short trial with a written review step lets the team test a tool before relying on it.

What should the team do with the notes?

Treat the draft as a draft. The ADA states that “human expertise and clinical judgment remain essential.” A clinician should read each AI-drafted note before it goes into the record. The practice should decide in advance what counts as a correction, who makes it, and how the original draft is handled.

Also ask your attorney whether patients should be told a scribe is in use, and what your state requires for recording a conversation. Those are legal questions, and the answer depends on state law.

What else do ADA standards say?

ADA News says standards matter for patient safety, data privacy and security, ethics, interoperability, and training. On privacy it says standards “help establish protocols for data privacy and security, ensuring patient information is protected and handled in compliance with relevant regulations.”

Standards for image analysis were in development as of that 2023 article. No single standard replaces a careful contract and a documented review step. For a wider view of the evidence, see AI in dentistry: what the research says. For the compliance side, see the dental compliance checklist guide.

Next step

The AI in the dental practice guide covers uses, evidence and risks. To discuss a related project, contact Dr. Copeland about consulting.