Is That New AI Charting Assistant a HIPAA Risk?

AI-powered scribes, charting assistants, and treatment-plan generators are moving into dental operatories faster than almost any technology we've seen in this industry. They save real time. They also listen to, transcribe, and store some of the most sensitive PHI your practice generates — and most practices are adopting them without asking the compliance questions they'd ask of any other vendor.

What's Actually Showing Up in Practices Right Now

This isn't a future trend — it's already in operatories across the Front Range:

• Ambient AI scribes that listen during the appointment and auto-populate clinical notes
• AI charting assistants built into practice management platforms that suggest treatment codes and narratives
• AI-assisted radiograph analysis that flags caries, bone loss, or other findings on X-rays
• AI chatbots and phone agents handling scheduling, recall, and patient intake
• AI-generated patient communication — treatment summaries, post-op instructions, billing explanations

Every one of these tools touches PHI. Several of them touch it in ways your existing HIPAA risk assessment almost certainly hasn't accounted for.

The Compliance Questions Most Practices Skip

Before any AI tool goes live in your practice, the same vendor-vetting process that applies to any other software touching patient data applies here — but with a few AI-specific wrinkles:

• Will this vendor sign a BAA? Some consumer-facing AI tools (general-purpose chatbots, free transcription apps) won't, because they aren't built for healthcare. If a vendor won't sign one, it cannot touch PHI in your practice — full stop.
• Where does the audio or text go after the appointment? Ambient scribes record the conversation. Ask explicitly: is the raw audio retained, for how long, and is it used to train the vendor's models? Some AI vendors' default terms allow exactly that unless you opt out.
• Is PHI used for model training? This is the question that didn't exist five years ago and now matters most. If your patients' chart notes are feeding a vendor's general AI model, that's a use of PHI well beyond "providing the service to you" — and it needs to be addressed in the BAA, not buried in a terms-of-service page nobody read.
• Can the practice review and correct AI output before it becomes part of the legal record? An AI-drafted note is a draft until a clinician reviews it. Workflow matters as much as the tool itself.

Why "It's Built Into Our Practice Management Software" Isn't Enough

Many AI features now ship bundled inside platforms like Dentrix, Eaglesoft, and Curve Dental, which can create a false sense of security. Your BAA with the core platform vendor may not automatically extend to a newer AI feature, especially if that feature routes data through a separate third-party AI provider behind the scenes. Ask your software vendor directly: does this AI feature process data outside your existing BAA's scope? Get the answer in writing.

Patient Consent and Transparency

Beyond HIPAA, patients increasingly expect to know when they're being recorded or when AI is involved in their care documentation. Several states have wiretapping and recording-consent laws that apply to ambient scribes listening during appointments. A simple disclosure — in your intake paperwork or posted in the operatory — that AI tools may be used to assist with documentation is a low-cost step that closes both a legal and a trust gap.

A Practical Adoption Checklist

1. Inventory every AI tool already in use — including ones front desk or clinical staff adopted on their own without IT or compliance sign-off.
2. Confirm a BAA is in place for each one, and read it — don't assume the platform's existing BAA covers it.
3. Ask about model training use of PHI and get an explicit opt-out in writing if the vendor's default is "yes."
4. Add AI vendor review to new tool adoption going forward, the same way you'd vet a new cloud backup provider.
5. Update patient-facing disclosures so patients know when AI is part of their visit.

The Bottom Line

AI charting and scribe tools are genuinely useful, and they aren't going away. The risk isn't the technology — it's adopting it the way most practices adopt any time-saving tool: quickly, without the same vendor scrutiny applied to a backup provider or an EHR. Treat AI vendors exactly like any other Business Associate, because under HIPAA, that's precisely what they are.