--- title: "AI scribes for dental notes: questions to ask a vendor" description: "A question list for vetting an AI scribe for dental notes, built on HHS guidance on business associates and ADA material on AI standards and privacy." url: https://joncopeland.multisites.ai/blog/ai-dental-scribe-questions publisher: Copeland Consulting Services email: drcopeland@joncopelanddds.com contact: https://joncopeland.multisites.ai/contact --- # AI scribes for dental notes: questions to ask a vendor An AI scribe listens to a visit and drafts notes, so it handles patient information. HHS says a vendor that creates, receives, maintains or transmits protected health information for a practice is generally a business associate, which calls for a written agreement. Ask about data use, storage, errors, review, and exit terms before signing. Clinical and technologyPublished October 26, 20264 min read This post is general education from Copeland Consulting Services. It is not legal, compliance or purchasing advice. It names no products. Ask your attorney and privacy officer to review any vendor agreement. ## What is an AI scribe? It is software that turns a recorded or transcribed visit into draft clinical notes. The [AI dental scribe](https://joncopeland.multisites.ai/glossary/ai-dental-scribe) falls under the wider area of [artificial intelligence in dentistry](https://joncopeland.multisites.ai/glossary/artificial-intelligence-in-dentistry). The ADA says AI use in the dental industry “is increasing” and curates resources on it on its digital dentistry page. ADA News also lists “administrative support” among AI uses in practices, such as scheduling and billing help. Notes are a clinical record, so a scribe sits closer to patient care than a scheduling helper. That raises the bar for review. ## Why does HIPAA matter for a scribe? A scribe handles patient information, and HIPAA governs that information. HHS says its Privacy, Security and Breach Notification Rules apply to covered entities, which include health care providers who transmit health information electronically in connection with a covered transaction. A dental practice is usually one of them. See [HIPAA](https://joncopeland.multisites.ai/glossary/hipaa) for the basics. HHS defines a business associate as, generally, a person engaged by a covered entity to carry out health care activities or provide services that involve the use or disclosure of protected health information (PHI). A [business associate agreement](https://joncopeland.multisites.ai/glossary/business-associate-agreement) is the written arrangement that makes the vendor promise to safeguard the data. HHS gives examples that sit close to a scribe: - An “independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician.” - A cloud service provider “engaged to create, receive, maintain, or transmit electronic PHI.” - An IT vendor that supports systems requiring access to electronic PHI. Whether a particular tool is a business associate is a fact question. Your attorney can answer it from the tool’s design and contract. ## What does a business associate agreement have to say? HHS says the agreement must describe the permitted and required uses and disclosures of PHI. It must provide that the vendor will not use or further disclose PHI other than as the agreement permits or as law requires. Under the Security Rule, it must require compliance with applicable security requirements and reporting of security incidents, including breaches of unsecured PHI, to the practice. HHS also says a business associate must have its own agreement with any subcontractor before it shares PHI. That matters when a scribe vendor relies on a cloud host or another software company. Ask who the vendor’s subcontractors are. ## Which questions should a practice ask a vendor? Ask these in writing and keep the answers. The questions are general prompts to discuss with your own advisers. They draw on the HHS and ADA points above. Topic Question to ask Why it matters Agreement Will you sign a business associate agreement before any PHI moves? HHS ties the arrangement to safeguarding PHI Subcontractors Which companies host or process the practice’s data? HHS says subcontractors need their own agreements Storage Where are audio, transcripts and notes stored, and for how long? Retention affects breach exposure Data use Is the practice’s data used to train or improve your models? Use beyond the agreement is limited by the agreement Access Who at your company can see the practice’s data? Limits who can disclose it Incidents How and when do you tell us about a security incident? HHS says the agreement covers incident reporting Accuracy How are errors found, and how often is the tool tested? ADA standards stress validated, reliable systems Review Who reviews each note before it enters the record? The ADA says clinical judgment remains essential Exit What happens to the practice’s data if the contract ends? Prevents orphaned records ## What other terms should the contract cover? Beyond the agreement for PHI, a vendor contract should answer practical questions. These are suggestions, not HHS rules. 1. Price and term: what is charged, for how long, and what notice ends the deal? 2. Support: who fixes errors, and how fast? 3. Integration: how do notes reach the practice management system and the [electronic health record](https://joncopeland.multisites.ai/glossary/electronic-health-record)? 4. Changes: how will the vendor tell the practice about new features or data uses? 5. Liability: what does the vendor owe if its tool causes a breach? The ADA digital dentistry page notes that “implementation and use of dental office technology are often challenging.” A short trial with a written review step lets the team test a tool before relying on it. ## What should the team do with the notes? Treat the draft as a draft. The ADA states that “human expertise and clinical judgment remain essential.” A clinician should read each AI-drafted note before it goes into the record. The practice should decide in advance what counts as a correction, who makes it, and how the original draft is handled. Also ask your attorney whether patients should be told a scribe is in use, and what your state requires for recording a conversation. Those are legal questions, and the answer depends on state law. ## What else do ADA standards say? ADA News says standards matter for patient safety, data privacy and security, ethics, interoperability, and training. On privacy it says standards “help establish protocols for data privacy and security, ensuring patient information is protected and handled in compliance with relevant regulations.” Standards for image analysis were in development as of that 2023 article. No single standard replaces a careful contract and a documented review step. For a wider view of the evidence, see [AI in dentistry: what the research says](https://joncopeland.multisites.ai/blog/ai-in-dentistry-research). For the compliance side, see the [dental compliance checklist guide](https://joncopeland.multisites.ai/guides/dental-compliance-checklist). ## Next step The [AI in the dental practice guide](https://joncopeland.multisites.ai/guides/ai-in-the-dental-practice) covers uses, evidence and risks. To discuss a related project, [contact Dr. Copeland about consulting](https://joncopeland.multisites.ai/contact?topic=consulting). ## Frequently asked questions ### Does an AI scribe need a business associate agreement? HHS says a business associate is generally a person or business that creates, receives, maintains or transmits protected health information on behalf of a covered entity, or provides certain services involving it. HHS lists transcription vendors and cloud providers as examples. Ask your attorney how it applies to the tool. ### What does the ADA say about AI and privacy? ADA News says AI systems in dentistry often rely on sensitive patient data. It says standards help set data privacy and security protocols so patient information is protected and handled in line with relevant regulations. ### What should a practice ask an AI scribe vendor? Ask where audio and text are stored, who can access them, whether data trains the vendor's models, how errors are caught, who reviews each note, and what happens to data when the contract ends. Put the answers in writing. ## Terms on this page - [Artificial intelligence in dentistry](https://joncopeland.multisites.ai/glossary/artificial-intelligence-in-dentistry) - [Business associate agreement](https://joncopeland.multisites.ai/glossary/business-associate-agreement) - [Electronic health record](https://joncopeland.multisites.ai/glossary/electronic-health-record) - [Compliance checklist](https://joncopeland.multisites.ai/glossary/compliance-checklist) - [Digital dentistry](https://joncopeland.multisites.ai/glossary/digital-dentistry) - [AI dental scribe](https://joncopeland.multisites.ai/glossary/ai-dental-scribe) - [HIPAA](https://joncopeland.multisites.ai/glossary/hipaa) - [ADA](https://joncopeland.multisites.ai/glossary/ada) ## Sources 1. [HHS: Business Associates Frequently Asked Questions (FAQs)](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) 2. [ADA: Digital Dentistry and Technology](https://www.ada.org/resources/practice/practice-management/digital-dentistry-and-technology) 3. [ADA News: Artificial intelligence and dentistry (June 7, 2023)](https://adanews.ada.org/ada-news/2023/june/artificial-intelligence-and-dentistry/) Written by Copeland Consulting Services and checked against the sources above on October 26, 2026. Rules, data and guidance change, so check the linked page before you act on it. ## Keep reading - [AI in the dental practice: what it does, what studies show and what to checkAI in dentistry mostly means software that reads images or handles office tasks. Studies of radiograph tools show promising accuracy but often rest on weak designs. Some image tools are regulated by the FDA as prescription devices. Any tool that touches patient data raises HIPAA questions you should settle before use.](https://joncopeland.multisites.ai/guides/ai-in-the-dental-practice) - [Dental practice compliance checklist: OSHA, HIPAA and infection controlA dental compliance checklist covers three federal areas: OSHA workplace safety, HIPAA privacy and security, and CDC infection control. OSHA has no dentistry-specific standard but applies general industry standards such as bloodborne pathogens. HIPAA covers patient information. Use the checklist to organize questions, then confirm requirements with your own advisers.](https://joncopeland.multisites.ai/guides/dental-compliance-checklist) - [Dental associate contracts: terms, pay models and red flags to ask aboutA dental associate contract sets pay, status, duties, term, termination, insurance and limits on work after you leave. The ADA publishes a guide to key provisions and a compensation explainer. Pay models differ in what they count, so read the formula. Have an attorney in your state review any contract before you sign.](https://joncopeland.multisites.ai/guides/dental-associate-contracts) - [AI in dentistry: what the research says so farTwo peer-reviewed reviews find that most dental AI work is image-based diagnosis, with promising results in experimental settings and open problems in data quality, bias, generalization, privacy and liability. The ADA describes AI as a tool that aids clinicians, and says human judgment stays essential. Standards are still being written.](https://joncopeland.multisites.ai/blog/ai-in-dentistry-research) - [HIPAA for dental offices: a plain checklist for ownersHIPAA has three rules most dental offices must know: the Privacy Rule, the Security Rule and the Breach Notification Rule. The Security Rule asks for administrative, physical and technical safeguards for electronic patient information. After a breach, notice goes to patients and HHS, and sometimes the media. Ask a qualified adviser about your office.](https://joncopeland.multisites.ai/blog/hipaa-for-dental-offices) - [Dentist employment agreement: key provisions to readA dentist employment agreement sets pay, duties, term, insurance, and limits that can last after the job ends. The ADA guide to key legal provisions covers compensation, termination, malpractice insurance, non-competes, non-solicitation, dispute resolution, and liquidated damages. This post explains each and lists questions for an attorney.](https://joncopeland.multisites.ai/blog/dentist-employment-agreement-provisions) ## Talk with Dr. Copeland [Contact Dr. Copeland](https://joncopeland.multisites.ai/contact)[Email](mailto:drcopeland@joncopelanddds.com)