HIPAA and AI Scribes for Dental Practices: What to Ask

An AI scribe can be HIPAA compliant for a dental practice when four things are true: the vendor signs a business associate agreement, the recording and transcript stay inside the patient record under that agreement, playback is limited to the practice's own signed-in team, and the drafted note contains only what the provider actually said. A "HIPAA compliant" badge on a vendor's website is not the test. The life cycle of the recording is.

That question matters more this year because note taking is where dentists are heading with AI first. In the American Dental Association Health Policy Institute's dentist AI survey, published July 2026, charting and note taking was the single largest planned use of AI.

This post is about the recording: what gets captured, where it lives, who can hear it, and when it goes away. Our earlier post on BAAs for AI vendors covered the agreement itself. Here we follow the audio. Nothing below is legal advice, so confirm the specifics with your own compliance advisor.

Why are dentists putting AI on notes before anything clinical?

The ADA Health Policy Institute's July 2026 survey gives a clear picture of where dentists draw the line:

• 43.3 percent of responding dentists already use AI for at least one type of task, and another 26.4 percent plan to.
• 34.8 percent plan to use AI for charting and note taking, the largest planned use in the survey, ahead of insurance verification (32.6 percent) and imaging and diagnostics (25.4 percent).
• 82.6 percent do not plan to use AI for treatment recommendations, and 68.3 percent do not plan to use it to explain clinical findings to patients.

Read those numbers together and the pattern is plain. Dentists want AI on the paperwork and off the judgment. A scribe sits squarely on the paperwork side.

That changes what the compliance conversation is about. When the AI is only drafting a note the dentist will review and sign, the risk is not an AI making a clinical decision. The risk is data handling: a new recording of a patient visit now exists, and somebody has to be accountable for it.

What makes an AI scribe a business associate?

HIPAA answers this in the definitions. Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information." A recording of a patient visit is protected health information the moment it exists. A vendor that stores or processes that recording for you is doing exactly what the definition describes.

The same definition goes one layer deeper. It includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate." In practice, that means the cloud platform running the AI model is part of the chain too.

So the practical questions come in pairs:

• Will the scribe vendor sign a BAA with the practice?
• Does the vendor have a BAA with the cloud provider that actually runs the model and stores the audio?

A good working rule: no signed BAA, no recording. If a vendor hesitates on either layer, that is your answer. Treat that as a rule of thumb for the conversation, and let your compliance advisor make the final call.

Where does the recording go, and who can play it back?

This is the part most sales demos skip, and it is where the real differences between products live. Ask every vendor these four questions and write down the answers:

1. Where are the audio and the transcript stored? Inside the patient's record, or in a separate system the vendor controls?
2. Who can play the audio back? Anyone at the vendor? Anyone with a link? Or only your own signed-in staff?
3. When is it deleted? When the note is deleted, when the patient is removed, when you cancel? Or never?
4. Is the recording used to train anyone's models? And what do the vendor's and the cloud provider's terms actually say?

The reason these answers matter is simple. A recording that lives outside the patient record, or that outlives the note it was made for, is a second copy of protected health information that your practice cannot see and cannot manage. When a patient asks what you have on them, or a state board asks for the record, you want one place to look.

Patients should also know the visit is being recorded. Recording and consent rules vary by state. We covered that side, and how dictation compares with a room microphone, in our post on AI clinical notes in your own voice, so we will not repeat it here.

Which handles PHI more safely: ambient recording, chairside dictation, or typing?

There are three common ways to get a visit into a note. They differ most on what gets captured in the first place, because data you never capture is data you never have to protect.

Method	What is captured	Where it lives	Who can hear it
Ambient scribe (records the whole visit)	Everything said in the room, including small talk and anything a family member says	Depends on the vendor; ask whether it stays in the patient record	Depends on the vendor's access controls
Chairside dictation (Smile PreVue AI Clinical Notes)	Only what the provider chooses to say out loud	Saved with the patient's note in Smile PreVue	The clinic's signed-in staff only
Typed templates or macros	No audio at all, only typed text	Your practice software	No recording exists

The honest trade-off runs in both directions. Typing captures the least but takes the longest. Ambient recording asks the least of the provider but captures the most, including conversation that has nothing to do with the chart. Dictation sits in the middle. It asks the provider to speak the findings out loud, which is more deliberate than ambient capture, and that deliberateness is exactly why the draft can be limited to what was said.

No method is automatically compliant or automatically risky. What decides it is the life cycle behind each column, which is why the four questions above matter more than the category.

How does Smile PreVue AI Clinical Notes handle the recording?

Here is how AI clinical notes for dentists works in Smile PreVue, answered against the same four questions.

How the note gets made. The provider dictates or types raw notes chairside on the Smile PreVue iPad or iPhone app (version 1.2 or later, live in the App Store since September 8, 2026) or in a desktop browser. Smile PreVue drafts the note in that provider's own writing style, learned from a one-time upload of a few past notes. The draft only uses what the provider said. Anything missing becomes a "[confirm: ...]" placeholder instead of a guess, and the raw transcript is always viewable.

Where it lives. Dictation recordings are saved with the patient's note, and notes stay in the patient record in Smile PreVue. There is no separate recordings library to manage.

Who can hear it. Audio plays back only for the clinic's signed-in staff, and opening a recording is logged.

When it goes away. Recordings are deleted with the note, the patient, or the clinic.

The BAA layers. AI Clinical Notes runs on Google Cloud (Vertex AI) under the Google Cloud BAA and is HIPAA-compliant. Google's terms for Vertex AI state that customer data is not used to train its models without permission.

What it never does. The AI drafts. The dentist reviews and signs every note. It never diagnoses or plans treatment, which lines up with where the ADA survey says most dentists want AI to stay out.

How it fits your chart. Copy and paste the signed note into whatever practice software you already use. There is no integration to set up.

AI Clinical Notes is included in the Smile PreVue subscription at no extra cost, and every provider in the practice gets their own note style. It sits inside the same app practices use for the cosmetic consult, so the preview, the close, and the note all happen in one place.

FAQ: HIPAA and AI scribes in a dental office

Do I need a BAA with an AI scribe vendor? Yes, if the vendor creates, receives, maintains, or transmits protected health information for you, and storing or processing a visit recording does exactly that. Ask about the cloud provider behind the vendor too.

Is dictation safer than an ambient scribe? It captures less, so there is less protected health information to protect. It also asks more of the provider, who has to say the findings out loud. Whether either is safe depends on where the recording lives and who can reach it.

Who can listen to the recording in Smile PreVue? Only the clinic's signed-in staff. Opening a recording is logged, and the recording is deleted with the note, the patient, or the clinic.

Does the AI write the diagnosis? No. It drafts from what was dictated or typed, flags anything missing as a placeholder to confirm, and the dentist reviews and signs every note.

Does it connect to my practice management software? There is no integration. You copy and paste the signed note into the chart in the software you already run.

Ask the recording question first

Most practices evaluate an AI scribe on how good the draft sounds. That matters, but it is the second question. The first is what happens to the recording: who signed for it, where it sits, who can hear it, and when it disappears.

If you want to see how dictation, the style-matched draft, and the recording rules work in a real operatory, start a 3-day free trial of Smile PreVue at smileprevue.com/download and dictate your first note this week.