Who is liable when an AI medical scribe gets the note wrong?

The clinician signs the note, so the clinician owns it

An AI medical scribe listens to a visit and drafts the note. The clinician reads it, edits it and signs it, and the signature is what makes it the clinician’s record. The Federation of State Medical Boards put it plainly in April 2024: boards regulate the physicians who use AI tools, not the tools, and the physician is ultimately responsible for the use of AI.

The same policy singles out scribes. It says AI is growing in use for this, holds promise for the burnout it relieves, and warns that records generated without proper oversight can be inaccurate and lead to patient harm for which the physician will likely be accountable. A practice that adopts a scribe has not outsourced the duty to read the note.

Some states have written the review duty into law. Texas S.B. 1188, in effect since September 1, 2025, conditions a practitioner’s use of AI for diagnostic purposes on reviewing all records created with AI and on telling patients the technology is in use. Nevada’s AB 406, in effect since July 1, 2025, lets a mental health provider use AI for notes but requires the provider to independently review their accuracy.

Where the scribe vendor comes in

A patient hurt by a wrong note usually sues the clinician and the practice. The vendor reaches the case in three ways. The contract may say the vendor indemnifies the practice for claims arising from the product. A plaintiff or the practice’s insurer may argue the product was defective. And a regulator or customer may rely on what the vendor said about accuracy.

That last route has a real example. In 2024 the Texas Attorney General reached a settlement with Pieces Technologies, whose AI drafts clinical notes inside hospital records. Texas alleged its advertised hallucination rate, under 0.001%, may have been misleading; the company denied wrongdoing. The agreement requires it to explain how any accuracy metric is defined and measured, and to document known risks including physical injury from inaccurate output.

A scribe that only transcribes and drafts is documentation software. One that also suggests diagnoses, billing codes or next steps is closer to clinical decision support, which FDA treats under separate criteria, and an underwriter reads it more like a professional than like software. Tell the insurer which one you sell.

Recording the visit is its own legal question

Most scribes work from audio, so the first legal question is about the recording, not the note. California makes it a crime to intentionally record a confidential communication without the consent of all parties to it. Whether an exam room conversation is confidential, and what counts as consent, depends on the facts and on the law of the state where the patient sits.

Illinois has written consent into its therapy law. A licensed professional there may use AI on a recorded or transcribed therapy session only after telling the patient in writing that AI will be used and for what, and getting consent. A consent flow that records who was told what, and when, is the evidence a practice or vendor will want if a patient later says they never agreed.

The HIPAA agreement and what it does to your insurance

A scribe vendor that handles patient information for a practice is a business associate under HIPAA, which means the practice needs a business associate agreement with it, and the vendor is directly answerable for safeguarding the recordings and transcripts. The same rule reaches the vendor’s own subcontractors, such as the cloud host and the model provider underneath.

For insurance, that moves a breach of recordings and transcripts onto cyber for the vendor and for the practice. Check that each policy covers regulatory defense and notification costs for protected health information, and that the vendor’s model provider is covered by its own agreement. The guide on HIPAA-compliant AI covers which AI tools will sign one.

Which policy answers which part of the claim

The practice’s malpractice policy responds to a patient claiming the clinician’s care fell short, which includes failing to catch an error in a note the clinician signed. The vendor’s technology E&O responds to claims that its product failed or its promises were wrong, but it usually excludes bodily injury unless contingent bodily injury is added, and on at least one major form that grant is not offered at all.

Cyber covers the recordings and transcripts. A recording-consent claim is the hardest to place: ask both sides whether any policy excludes wrongful collection or recording of data, because that exclusion can sit in a cyber or privacy section. The table sets out the usual split. Your wording decides the real answer.