Before You Turn On an AI Scribe in Psychiatry, Map the Data Flow First

A psychiatric practice is ready to test an AI scribe. The vendor offers a business associate agreement. The demo turns a conversation into a polished note. The plan sounds simple: invite the clinicians, connect the electronic health record, and begin.

Then the unresolved questions appear. Does the tool retain encounter audio? Is the transcript stored separately from the draft note? Can vendor personnel review content for support? Are subprocessors involved? What happens when a patient declines recording? Who catches a reversed negation, a medication error, or a sentence attributed to the wrong speaker?

This fictional composite is not a report about a patient, practice, or product. It illustrates the central governance problem:

Federal sources below were reviewed August 14, 2026. They are a U.S. federal baseline, not a state-law conclusion, vendor approval, or clinical standard.

“AI scribe” is a product description. It does not determine the vendor’s legal role or the workflow’s operational risk.

For a HIPAA-covered practice, a non-workforce vendor may be a business associate when it creates, receives, maintains, or transmits protected health information on the practice’s behalf. Subcontractors that handle that information for a business associate can fall within the same federal definition. The answer depends on the actual relationship and data flow, not the product label.

Map each artifact separately:

For each artifact, identify who creates it, where it goes, who can access it, how long it remains, and whether it can be returned or deleted. “The vendor does not store the note” is not an answer about audio, transcripts, logs, backups, or derived data.

When a vendor is a business associate, HIPAA requires a written contract or other arrangement that meets the applicable requirements, including permitted and required uses and disclosures, safeguards, reporting, subcontractors, and return or destruction of protected health information at termination where feasible.

That is a necessary baseline when the rule applies. It is not a federal certification, a technical audit, an accuracy assessment, or approval to deploy.

The practice still needs clear answers to:

The current federal breach rule generally requires a business associate to notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery, subject to the rule’s qualifications. A shorter operational-notice period is a negotiated control, not the federal outer limit.

The current HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information, plus reasonable risk management, activity review, access and audit controls, authentication, incident procedures, and related documentation.

HHS identifies technologies that electronically record or transcribe a telehealth session as creating Security Rule obligations when electronic protected health information is involved. Current guidance directs covered entities to consider risks to recordings and transcripts, including unauthorized access, encryption, authentication, and storage.

Match the analysis to the real system: device and microphone, vendor environment, electronic-health-record integrations, support access, subprocessors, data movement, backups, user provisioning, audit evidence, and the fallback when the tool is unavailable or the draft is unusable. A “HIPAA compliant,” encrypted, locally processed, SOC 2, or HITRUST claim may be relevant evidence. It does not replace that analysis.

The 2024 Security Rule proposal remains proposed; HHS states the current rule remains in effect.

HIPAA governs uses, disclosures, safeguards, and rights within its scope. It does not, by itself, answer whether or how an encounter may be recorded. State recording, health-information, board, minor-consent, and related rules can change the analysis. Relevant locations may include the clinician’s state, the patient’s state, and another participant’s state.

Before launch, obtain a jurisdiction-specific answer to:

A plain-language explanation and a no-recording alternative are operational controls, not a substitute for state-specific legal review.

An AI documentation workflow can create more than one record-like object. Decide, with qualified review, how the practice will treat the transcript, draft, corrections, final note, and any retained audio or supporting data.

HIPAA access and amendment rights apply to protected health information in a designated record set, subject to the rules’ limits. They do not automatically place every temporary AI artifact in that set. Classify each artifact by how it is maintained and used.

Avoid a common retention mistake: the six-year Security Rule retention provision applies to required security documentation—policies, procedures, and required documented actions or assessments. It is not a federal instruction to keep encounter audio, transcripts, prompts, drafts, or model logs for six years.

Define a justified period for each data class—final clinical record, audio, transcripts, drafts, prompts, logs, backups, and derived data—document the authority and purpose, and verify that the system can carry it out. State law, professional rules, contracts, litigation holds, and payer requirements may add obligations.

Treat the output as a draft until the practice’s authorized clinician-review process is complete. The federal sources reviewed here do not contain an AI-scribe-specific sentence requiring a clinician to verify every generated note. Human review is a record-integrity and clinical-workflow control, not a HIPAA quotation or a nationwide standard of care.

In psychiatric documentation, review for high-consequence errors that can hide inside fluent prose:

These are test scenarios, not prevalence claims. This article does not claim a product-specific error rate or that AI documentation improves accuracy, care, clinician burden, coding, or payment.

Require review before a draft becomes the final note, correction of material errors, and a fallback when the output is unusable. Define staff-edit rules, correction attribution, and late changes after signing.

Psychiatric records are not one uniform category. Some encounters may involve separately maintained psychotherapy notes, Part 2 substance use disorder records, minor records, or other specially protected information.

The 2024 Part 2 final rule became effective April 16, 2024, and required compliance by February 16, 2026. Application depends on the program, records, and facts. The rule also created separately maintained SUD counseling notes. A general AI-scribe checklist is not a Part 2 or state-law analysis.

Before activation, identify which encounter types the tool may not process until additional controls are approved:

An effective pre-launch review produces one of three outcomes for every unresolved control:

The required evidence exists and the control is approved.

The answer is missing, contradictory, or unacceptable.

The control does not apply, with the reason documented.

Keep the launch on hold when material questions remain about roles, secondary use, recording rules, retention and deletion, access and incidents, record classification and human review, specially protected records, or fallback. That is not resistance to technology. It is the difference between testing a tool and transferring an uncontrolled data flow into psychiatric care.

Four questions are enough:

If any answer is unknown, name an owner and keep that part of the rollout on hold. A signed BAA can be necessary. A smooth demo can be encouraging. Neither replaces a mapped data flow, verified controls, a patient workflow, and a documented decision about the clinical record.

This issue was selected from a public/provider discussion signal about AI-assisted charting. That signal is used only to generate the research question. It does not establish prevalence, safety, effectiveness, accuracy, patient preference, burden reduction, a legal duty, a clinical standard, or vendor compliance.

General educational information for U.S. psychiatric practice governance. Not legal, privacy, security, billing, compliance, or clinical advice; does not approve a vendor or workflow. Verify the actual workflow with current authoritative sources and qualified reviewers.