Where Does Your Patient Data Go When You Use an AI Scribe?

The data journey most providers never think about

You tap "start" on your AI scribe. The patient describes their symptoms. Ten seconds later, a SOAP note appears on your screen. Magic.

But between that tap and that note, your patients most sensitive health information traveled through multiple systems, got processed by machine learning models, and landed in a database somewhere. Most providers have no idea where "somewhere" is. And that's a problem.

Knowing exactly where patient data flows isn't just good practice - it's a HIPAA requirement. You need to understand the complete data lifecycle before you can properly assess risks or hold your vendor accountable.

Stage one: audio capture and local processing

The journey starts on your device. When the AI scribe is listening, it captures raw audio of the patient encounter. What happens next depends on the architecture:

Edge processing (better for privacy): Some AI scribes perform initial audio processing directly on your device - noise reduction, speaker identification, and sometimes even partial transcription. Less raw audio leaves your device, which reduces exposure.

Cloud-only processing: Other tools stream the raw audio directly to cloud servers with minimal local processing. More data leaves your device, but the processing power of cloud infrastructure can improve accuracy.

In both cases, the audio data on your device should be encrypted immediately upon capture and stored only in volatile memory - not written to the devices permanent storage. If the app caches audio files on your phone or tablet, that's data sitting outside the vendor's security perimeter.

Stage two: transmission to the cloud

Your audio data needs to reach the vendor's servers. This transmission should happen over TLS 1.2 or higher, creating an encrypted tunnel between your device and the server.

But "the server" isn't one thing. It's a collection of services, possibly spread across multiple data centers:

• Load balancers that receive incoming connections
• API gateways that authenticate and route requests
• Processing queues that hold audio jobs waiting to be transcribed
• Compute instances running the AI transcription models
• Databases storing the finished transcriptions

Each of these components might be running in different availability zones or even different cloud regions. Ask your vendor for a data flow diagram that shows every service that touches PHI.

Stage three: AI processing

This is the stage most people are curious about. The AI model receives your audio and converts it to text. But the specifics matter enormously for data privacy:

Self-hosted models (most secure): The vendor runs their own speech-to-text and clinical NLP models on their own infrastructure. PHI never leaves their controlled environment.

Third-party AI APIs (higher risk): Some vendors send audio to third-party services like general-purpose speech-to-text APIs. This means your patient data travels to yet another company's servers. That company becomes a subcontractor and needs its own BAA.

Hybrid approaches: Some vendors use their own models for transcription but call external AI services for specific tasks like medical terminology extraction or note formatting. Each external call is another data hop.

Processing Model	PHI Leaves Vendor?	Additional BAAs Needed?	Data Control
Fully self-hosted	No	No	Highest
Third-party speech API	Yes	Yes	Medium
Third-party AI for formatting	Partially	Yes	Medium
Consumer AI API	Yes	Often unavailable	Lowest

Stage four: storage and retention

After processing, your transcription lands in a database. Here's what you should know about where it sits:

Cloud provider and region. Is it AWS us-east-1? Google Cloud northamerica-northeast1? Azure Canada Central? The specific region determines which country's laws govern the data and how close it is to your patients.

Data residency for Canadian providers. If you practice in Canada, provincial health privacy laws may require patient data to remain within Canadian borders. Ontario's PHIPA, for example, restricts the transfer of personal health information outside of Ontario without consent. Make sure your vendor offers Canadian data residency if you need it.

Backup locations. Your vendor almost certainly maintains backups for disaster recovery. Those backups might be in a different region - or even a different country - than the primary database. Ask specifically where backups are stored.

Retention periods. How long does the vendor keep your data? Do they automatically delete transcriptions after a set period? Can you configure retention policies yourself? When you stop using the service, what happens to everything they stored?

Stage five: access and integration

Stored data doesn't just sit there. People and systems access it:

• Your clinical team views transcriptions through the web app or mobile app
• EHR integrations pull notes into your electronic health record system
• The vendor's systems may access data for backups, maintenance, or (if you're not careful) analytics
• Billing integrations might extract procedure codes from notes

Each access point is a potential vulnerability. Role-based access controls should limit who on your team can see what. And the vendor should have strict internal controls preventing their employees from accessing your patient data - with audit logs proving it.

What to demand from your vendor

Get straight answers to these questions:

• Where exactly is my data stored? Give me the cloud provider, region, and data center.
• Does patient audio or text ever leave your infrastructure for any reason? If yes, where does it go?
• Do you use any third-party AI services to process patient data?
• Where are backups stored? Are they in the same country as primary data?
• Can I choose my data residency region?
• What happens to my data if I cancel the service?
• Can your employees access my patient data? Under what circumstances?

A vendor that can answer all of these clearly and without hesitation has nothing to hide. One that deflects or gives vague responses? Your patients data might be going places you wouldn't approve of.

---

Transcribe Health gives you full visibility into where your data lives. Choose your data residency region, review audit logs showing every access, and maintain complete control over retention and deletion. Your patient data stays exactly where you expect it.

---

This article is for informational purposes only and does not constitute legal or compliance advice. Data residency requirements vary by jurisdiction. Consult with a qualified healthcare compliance professional for guidance specific to your organization.