Healthcare AI FAQ

Most credible AI medical scribes are HIPAA compliant when used correctly — the vendor signs a Business Associate Agreement (BAA), encrypts data in transit and at rest, and operates inside HIPAA-aligned cloud infrastructure. HIPAA compliance is the floor, not a differentiator. The specifics that matter are the BAA terms, the audio retention policy, whether training uses customer PHI, and the breach-notification timeline. The RFP-questions checklist covers each.

Yes, but the deployment must satisfy provincial health-privacy law (PHIPA in Ontario, Quebec Law 25, Alberta HIA, BC PIPA / FIPPA) in addition to PIPEDA federally. Cross-border PHI processing requires explicit contractual residency commitments. Most U.S. cloud scribes do not commit to Canadian-region processing by default; verify region and residency in writing before signing. See the Canadian compliance hub for the full layered analysis.

Not without serious caution. ChatGPT is not HIPAA / PHIPA / Quebec Law 25 compliant for PHI by default. OpenAI offers enterprise tiers with BAAs, but cross-border processing and consent rules under Canadian provincial law remain. For clinical documentation, use a purpose-built AI scribe with proper compliance posture or run a private model on-premises.

Yes. Patient consent for AI scribe use — specifically for audio recording and AI-generated documentation — is required under HIPAA in the U.S. and provincial health-privacy law in Canada. Quebec Law 25 Section 12 adds explicit algorithmic-transparency disclosure. PIPEDA's 2026 amendments clarify that AI consent differs from service-delivery consent.

A BAA is the HIPAA contract that lets a vendor handle Protected Health Information on the hospital's behalf. It governs how PHI is used, audit access, breach notification timelines, retention, and indemnification. Every credible AI scribe vendor signs a BAA with enterprise customers. The specific terms — particularly audio retention and breach timelines — matter more than the existence of the BAA itself.

PHIPA is Ontario's Personal Health Information Protection Act. Section 18 governs consent for AI use of PHI; Section 10 governs permitted uses; Section 12 imposes audit-trail requirements. The IPC of Ontario strongly recommends Privacy Impact Assessments for new health-information systems. Ontario PHIPA modernization in 2024–25 strengthened cross-border data-transfer documentation requirements.

Quebec's modernized privacy law (formerly Bill 64), in force since 2023 with a phased rollout completed in 2024. Section 12 requires organizations to disclose use of automated decision-making and explain principal factors. Section 17 governs cross-border PHI transfers. The strictest Canadian penalty regime — aggregate Q1 2026 enforcement fines crossed $C2.3M. Mandatory PIA for any technology processing personal information.

The peer-reviewed npj Digital Medicine framework analysis (2025) reported a 1.47% hallucination rate and 3.45% omission rate across 12,999 sentences from 18 model configurations. 44% of hallucinations were major (clinically significant). Per-vendor accuracy varies; the UCLA NEJM AI RCT showed Nabla cut time-in-note by 9.5% (statistically significant) while DAX Copilot showed a non-significant −1.7%. See the safety reference for the full breakdown.

AI scribes are safe when used with explicit safeguards: retain the original audio for verification, mandatory clinician review before signature, section-stratified sample audits, edit-distance monitoring, and written stop conditions. "Clinician reviews the draft" alone is not a safety control — automation bias is documented and patterned. OpenAI's own documentation warns against using Whisper-based tools in high-risk domains.

A hallucination is AI-generated content that does not appear in the source audio — a fabricated symptom, an invented diagnosis, a documented physical exam that never happened. Distinct from an omission (something present in the audio the AI failed to document). The published hallucination rate is 1.47% across 12,999 sentences; 44% of hallucinations are classified as major and could change clinical management.

Two compounding sources: the speech-to-text layer (Whisper has documented hallucinations under silent or noisy audio) and the LLM that summarizes the transcript (large language models can produce confident, plausible-sounding text that fills perceived gaps). The most dangerous hallucinations are the ones that read fluently — physical exams that never happened, dropped negations like "denies chest pain" rendered as "chest pain."

Whisper is OpenAI's open-source speech-to-text model, used by most ambient AI scribes including Nabla. It has documented hallucination issues — invented sentences appearing in roughly 1% of audio segments under controlled study, much higher in informal testing. OpenAI's own documentation explicitly warns against use in "high-risk domains" and "decision-making contexts." Use Whisper with safeguards: retain original audio, audit against the source, monitor edit distance over time.

Yes — most AI scribes record audio of the encounter, transcribe it, and use the transcript to generate the note. Audio retention varies: some vendors delete audio after note generation (Freed, Nabla); others retain audio by default for quality and verification. Patient consent for recording is required under HIPAA and equivalent Canadian provincial regimes.

A well-designed pilot has written stop conditions and a documented restart path. The steering committee should agree in advance on the patterns that pause the rollout: section-stratified omissions, audited hallucination rate above a stated threshold, clinician-reported safety event. Termination-for-cause language in the contract should match the pilot framework. If the pilot fails on safety grounds, escalate to vendor; if it fails on economics, consider a hospital-owned alternative. See How to Test an AI Scribe Safely.

Pricing ranges from $39/month (self-serve individual, e.g., Freed) to negotiated enterprise contracts at $84–$200+ per clinician per month for larger systems. Most enterprise vendors do not publish pricing. Heidi Health and Freed publish pricing transparently; Abridge, Nabla, Dragon Copilot, Commure Ambient, and others negotiate via sales. Use the WalledCare ROI calculator to estimate against your specialty mix and clinician hourly cost.

Real but modest by peer-reviewed measurement, larger by vendor self-report. The UCLA NEJM AI RCT measured 41 seconds saved per note for Nabla (9.5%, p=0.02); Mass General Brigham JAMA reported 13.4 minutes/day total EHR-time reduction. Vendor case studies often claim ~2 hours/day; STAT News reporting in 2026 found this is an upper-bound depending on adoption depth.

Based on the peer-reviewed Mass General Brigham JAMA cohort (13.4 min/day total EHR-time reduction per provider), a 100-clinician deployment at $200/hour loaded cost and 220 workdays would save roughly 4,900 hours/year (~$980,000 of labor-time value). Vendor fees at $150/clinician/month total $180,000/year. Net before revenue-cycle and burnout-retention upside: ~$800,000/year. Use the WalledCare ROI calculator for your specific inputs.

There is no single best — it depends on the binding constraint. Abridge is the deepest Epic integration and strongest published evidence base. Nabla has the cleanest peer-reviewed RCT result. Dragon Copilot fits Microsoft-standardized organizations. Heidi Health and Freed offer published pricing for clinician-led ambulatory use. On-prem alternatives fit Canadian residency-bound buyers. See the vendor side-by-side comparison.

Abridge has the deepest Epic integration (Epic's first "Pal"), the largest deployment scale (150+ U.S. health systems, including Kaiser's 24,000-clinician rollout), and a strong peer-reviewed evidence base. Nabla has the strongest single peer-reviewed result (UCLA NEJM AI RCT: −9.5% time-in-note, p=0.02), no-audio-stored default privacy posture, and broader European market presence. Both are cloud-only — neither offers on-prem deployment.

The 2025 UCLA randomized clinical trial published in NEJM AI compared Nabla, Microsoft DAX Copilot, and usual care across 238 outpatient physicians in 14 specialties. Nabla cut time-in-note by 9.5% versus control (statistically significant, p=0.02); DAX showed −1.7% (not significant, p=0.66). Both arms showed ~7% burnout improvement. The cleanest peer-reviewed head-to-head in the category.

Human scribes are trained medical-documentation specialists who shadow the clinician (in-person or virtually) and write the note in real time. AI scribes capture audio and generate a draft note via speech recognition and a language model, which the clinician edits and signs. Hybrid models (Augmedix Notebuilder Live) combine AI drafting with human reviewer validation. Cost, scalability, and consistency favor AI; nuanced accuracy on complex visits still favors trained humans.

Six categories: (1) Security and privacy — BAA terms, audio retention, subprocessor disclosure, training-data use. (2) Clinical safety — measured hallucination and omission rates, Whisper guardrails, audit trail. (3) EHR integration — depth on your specific EHR, write-back support, fallback behavior. (4) Evidence — named peer-reviewed studies, customer references in your specialty. (5) Pricing — total cost in writing, year-2 escalation, cancellation. (6) Vendor risk — funding, ownership changes, insurance. See WalledCare's 30-question RFP checklist.

Increasingly yes, though most ambient scribes started outpatient. Abridge Inside for Inpatient is deployed at UPMC across 12,000+ clinicians. Commure Ambient supports inpatient via the Augmedix product line. Inpatient adds higher-stakes failure modes — handoff documentation, shift-change SBAR / I-PASS, OR / PACU notes — that benefit from stricter human-review safeguards than outpatient ambient documentation.

Yes, with specialty-specific tuning. Most vendors support 30–55 specialties; Heidi Health reports 200+. Specialty performance varies — high-acuity inpatient, surgical, and procedural workflows have different failure modes than outpatient primary care. Ask for specialty-matched customer references during evaluation; pilot with a tight rubric on edit distance and section-stratified omission rate for your specialty.

RAG (Retrieval-Augmented Generation) is a pattern where an AI model retrieves relevant documents from a private corpus (policies, SOPs, guidelines, EHR records) and uses them as context to answer questions or generate text. It's the dominant pattern for hospital document Q&A and private medical search because it keeps data inside the hospital and lets answers be cited to specific source documents. See the Document Q&A category page.

Not always. CPU-only inference is viable for small workloads and pilots using llama.cpp or quantized models. For production-grade serving (multiple concurrent users, real-time clinical workflows), a GPU is required — typically a single A100 80GB for 70B-class models at department scale, or 4× H100 for hospital-system scale. See the WalledCare on-prem reference architecture for sizing.

On-premise AI means the AI models run on hardware the hospital owns and operates, inside the hospital's own network — no audio, transcripts, or generated notes ever leave the hospital's infrastructure. The trade-off is more upfront operational lift (GPU procurement, infrastructure, ops staff) versus zero cross-border-transfer concerns and one stack that can serve multiple AI workflows. See the cloud vs local guide.

Cloud wins on speed-to-pilot, fewer ops responsibilities, and established BAA-based procurement. On-prem wins on data residency (especially under Quebec Law 25, PHIPA, HIA, FIPPA), audit control, and multi-workflow stack reuse. The binding constraint usually decides: if PHI residency is non-negotiable, on-prem; if speed is paramount and BAA processing is acceptable, cloud. See WalledCare's local-vs-cloud checklist.

Google's open-weight medical Gemma model, released in 4B and 27B variants (both multimodal under MedGemma 1.5). Built on Gemma 3, tuned for medical text and image reasoning. Runnable locally through Ollama, vLLM, or llama.cpp. Real deployments include Taiwan's National Health Insurance Administration (preoperative lung-cancer surgery assessment from 30,000+ pathology reports) and Qmed Asia's clinical-guidelines interface in Malaysia. See the MedGemma profile.

Cloud scribes deploy in two weeks to a few months once contracted — Abridge reports two-week clinician implementation cycles once Epic integration is complete. On-prem deployments run 30–90 days for a pilot on hospital-owned hardware, longer if GPU procurement is from scratch. The procurement phase typically takes longer than implementation: 4–8 weeks of vendor evaluation, RFP, and contracting.