Clinical Documentation, Reviewed by People

Medical transcription differs from general transcription in what an error costs. A misheard word in a business meeting transcript is an inconvenience. A misheard drug name, a transposed dosage, or "left" rendered as "right" is a clinical error that entered the record looking perfectly clean.

That asymmetry is why human review is a required stage here rather than a premium tier. Automated transcription performs well on ordinary speech and poorly on exactly what carries risk clinically: drug names, dosages, laterality, anatomical terminology, and unusual proper nouns. The failure is silent - the model does not mark uncertainty, it produces its best guess. A reviewer working against the source audio catches the class of error a model cannot flag, because the model does not know it made one.

Documents are returned in the format your workflow already uses - SOAP notes, histories and physicals, progress notes, discharge summaries, operative reports. Where a practice has a house style, we map to it. A transcription service that ignores your template has simply moved the reformatting work to your staff.

On compliance, the honest position is narrower than a badge. HIPAA does not certify software; it imposes obligations on the arrangement. Under 45 CFR 164.308(b)(1) a covered entity must have a Business Associate Agreement in place before disclosing protected health information to a vendor, and a transcription provider handling PHI is a business associate. We encrypt PHI in transit and at rest, log access, and provide a BAA on request. Any vendor unable to produce one should not be receiving your patient information.

The obligation flows downstream as well. A business associate must hold equivalent agreements with any subcontractor that touches PHI, which matters specifically for AI transcription because a vendor may route audio through a third-party model provider. If that provider is not covered by an agreement, PHI has been disclosed outside the chain. Worth asking directly: who else touches the audio, and is my material used to train models? If the answer to the second is yes, PHI is being used for a purpose no patient authorised.

Retention is the requirement most often misunderstood, and it does not come from HIPAA. HIPAA requires HIPAA-specific documentation to be kept six years under 45 CFR 164.316(b)(2) - policies, procedures, and records of required actions - which is frequently misread as a rule about patient charts. The chart requirement is set by state law and varies substantially. Minnesota requires a defined core of the record permanently rather than for a term. Massachusetts treats the duty as surviving retirement, licence lapse, and the physician’s death. Ohio has no general retention statute for physicians while setting a period for facilities, and Illinois sets a hospital period with no equivalent statute for private practices.

Two practical consequences follow for transcription specifically. First, a transcribed document becomes part of the medical record, so the retention obligation follows it - and if a vendor retains finished documents indefinitely, that is a copy of your records held by a third party under your obligations. Second, ask about bulk export before you need it. A vendor whose only export is a per-file download is a real problem when the requirement is to preserve a defined record set for decades, or where a practice is closing and someone must retrieve everything.