Blog Posts
Voice cloning takes minutes and costs nothing. Polygraf AI documents how deepfake audio is being used to impersonate executives in fraud schemes.
Ambient AI scribes are one of the fastest adopted technologies in medicine since the EHR. They reduce documentation time and burnout – but peer reviewed studies show up to 31% of AI notes are hallucinations and the technology creates a whole new HIPAA exposure. Accuracy and compliance are two different problems. Here's how to solve both.
The clinical note is a paradox: essential for care, communication and legal defense, and one of the biggest drivers of physician burnout. The note is after the visit, on the keyboard, with the patient gone and the next one waiting. Ambient AI scribes attack this directly: they listen to the encounter and generate a draft note automatically, and the productivity gains are real. One npj Digital Medicine review documented a 29.3% reduction in after-hours EHR work, and a study of 263 physicians found burnout dropped from 51.9% to 38.8% within 30 days of adoption.
But two different problems travel with that benefit and they are often confused. The first is accuracy: AI scribes hallucinate, miss, and misattribute clinical content that can have direct impact on patient safety. The second is HIPAA compliance: ambient recording generates new flows of protected health information that trigger Business Associate Agreement, consent, and security obligations most documentation workflows were never designed for. A note can be perfectly compliant and dangerously inaccurate – or perfectly accurate and a HIPAA violation. You have to solve both.
Before we get to the specifics: find out where is your AI-documentation workflow. Polygraf's AI Risk Calculator models your risk and shows you exactly which obligations apply to you: BAA coverage, HIPAA Security Rule, state recording-consent laws and breach-notification timelines, based on your specialty, data types and existing controls.
AI scribes write plausible but clinically incorrect content: hallucinated drugs, fake history, misattributed symptoms, important omissions. The error rate is low (1–3%) but in medicine the consequence of one error is serious. It is a patient-safety and malpractice problem.
Ambient recording sends audio and transcripts of the encounter to a third-party vendor — this creates PHI flows that require a signed BAA, patient consent (in many cases under state recording laws as well) and inclusion in your security risk analysis. This is a regulatory and legal-liability issue.
The numbers for headline accuracy are encouraging. Today's ambient scribes report error rates of 1–3% in general, far below the 7–11% error rates of older speech-recognition dictation. But the aggregate rate hides the real risk: AI scribes fail in specific, characteristic ways that differ from human error, and several of them are hard to catch on a quick review. A validated blinded study using the PDQI-9 framework found hallucinations in 31% of ambient notes versus 20% of physician-written notes — meaning the AI introduced fabricated content more often than clinicians did.
Hover the highlighted spans below to see the four common failure modes in a realistic note draft.
The overall error rate and per-note hallucination rate measure different things: a note can have a low character-level error rate and still have one fabricated detail. In medicine, it is the one detail that counts. Sources: npj Digital Medicine 2025; PDQI-9 validated study 2025.
The accuracy problem has a second-order effect on the efficiency case. One study found ambient scribes saved only 34 seconds per note, with high individual variability — because the time saved on drafting can be offset by the time spent on the painstaking correction of AI mistakes. The point is not that AI scribes are not useful: they are, if properly used, clearly useful. The point is that the review step is not a discretionary overhead which can be bypassed to capture the savings – it is part of the workflow and there the risk of inaccuracy is actually controlled.
What changes the instant you turn on an ambient scribe – the audio and transcript of the clinical encounter, both full of PHI – is that it goes to a third party vendor, is processed and comes back as a note. That vendor is, by definition, a business associate under HIPAA – it creates, receives, maintains and transmits PHI on your behalf. That is the single trigger for a whole host of obligations.
This is not a hypothetical risk. In November 2025, patient Jose Saucedo filed a proposed class action against Sharp HealthCare in the San Diego Superior Court alleging that Sharp used an ambient AI documentation tool to record clinical encounters without patient consent – in violation of California's all-party-consent wiretapping statute (CIPA) and the Confidentiality of Medical Information Act (CMIA). The most damaging allegation is that the EHR had boilerplate language stating that patients were "advised" and "consented" to recording when, per the complaint, no such consent was obtained. The proposed class could be over 100,000 patients and CIPA has statutory damages of $5,000 per violation. In addition, California's AB 3030 (effective January 1, 2025) requires providers to add a disclaimer when generative AI produces patient clinical communications unless a licensed provider first reviews the output. Malpractice carriers are now actively flagging AI-documentation hallucinations as an emerging risk category.
"If an AI scribe makes up or alters clinical content (a fact) and a physician approves without proper review, the provider has the malpractice exposure. It is not a hypothetical. It is a new risk category that malpractice carriers are already flagging."
— Health Law Attorney Blog, February 2026Solving accuracy and compliance together is about building the right operational workflow – one where the guardrails are part of how the work is done, not an audit you run after the fact. Here's the right sequence.
Polygraf AI doesn't replace your ambient scribe, it is the guardian of the data it is protecting. Our Behavioral Control Plane is where clinical staff engage with AI tools, so that PHI only flows to approved BAA-covered endpoints and never leaks to consumer AI tools or unapproved scribe apps. It detects the 18 HIPAA identifiers in real time, blocks or redacts PHI going to ungoverned destinations and logs every interaction for the audit trail OCR expects. It is on-premise with no data egress, so the inspection itself does not create a new PHI exposure. For the compliance side of the AI-notes equation – keeping patient data in the governed pathway – it is the enforcement layer that makes the policy real.
Polygraf AI guarantees that patient data from AI documentation is only sent to approved BAA covered tools – it detects all 18 HIPAA identifiers in real time and blocks leakage to consumer AI. On-premise, no data egress, full audit trail..
At Polygraf, we envision a future where AI augments human capabilities without compromising safety, privacy, or ethical standards. Trust in our commitment to building this future with you.
© 2026 Polygraf AI. All rights reserved.
Our Solutions
RegulationsYour download will start now.
Please provide information below and we will send you a link to download the white paper.
Data Privacy
Data Provenance
Content Generation