---
title: "List privacy issues for a practice that wants a clinical scribe"
url: "https://ailawframework.com/practice/health-and-medical-law/advise-a-gp-practice-on-medicolegal-risk-of-ai-scribes/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A32-B8-1-US"
practice_area: "Health & Medical Law"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# List privacy issues for a practice that wants a clinical scribe

> List whether the practice is described as a covered entity, what protected health information the scribe would receive, and what the papers say about a breach.…

Canonical page: https://ailawframework.com/practice/health-and-medical-law/advise-a-gp-practice-on-medicolegal-risk-of-ai-scribes/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Health & Medical Law](https://ailawframework.com/practice/health-and-medical-law.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List whether the practice is described as a covered entity, what protected health information the scribe would receive, and what the papers say about a breach. Do not classify the product and do not write the advice letter. |
| What the lawyer must review | You write the advice. 45 CFR § 164.502 bars a use or disclosure the subpart does not permit. The HHS covered-entity page is the starting point for whether the practice or the vendor is a covered entity or a business associate. The HHS breach page requires notice without unreasonable delay and no later than 60 days after discovery, and media notice when more than 500 residents of a State or jurisdiction are affected. Formal Opinion 512 applies to client information the scribe would receive. The required terms of a business-associate contract in § 164.504(e) were not opened. |
| Written for | United States |
| Applies to | [Advise a GP practice on medicolegal risk of AI scribes](https://ailawframework.com/practice/health-and-medical-law/advise-a-gp-practice-on-medicolegal-risk-of-ai-scribes.md) |

## Checking plan

- What the AI does: List whether the practice is described as a covered entity, what protected health information the scribe would receive, and what the papers say about a breach. Do not classify the product and do not write the advice letter.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- This is the issues list. A separate check compares a named product's papers.
- Do not recite § 164.504(e). It was not opened.

## Sources

- [45 CFR § 164.502 (uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (checked 2026-10-22)
- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-10-22)
- [HHS: HIPAA Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*