AI Medical Scribe Contract Checklist for India

The demo ends with a clean SOAP note. Procurement starts one minute later: Where did the audio go? Which company can open the transcript? What happens to unfinished drafts after termination? The answers belong in the contract.

Key takeaways

• Redline the configured data flow, not a generic description of “the platform.”
• Put retention, deletion, incidents, subprocessors, and exit in binding clauses.
• Attach evidence to each promise. A sales answer without a contract hook is a note, not a control.
• DPDP commencement is phased. Check the current Gazette and get Indian legal advice.
• Keep clinician review explicit: the scribe drafts; the doctor owns the final record and decisions.

This checklist is a procurement aid, not legal advice. An Indian lawyer should map the clinic’s role, notice and consent model, record obligations, employment setup, cross-border processing, and sector-specific duties to the current law and the actual deployment.

The redline matrix

Use this table before negotiating wording. The last column is the useful one: it turns a promise into a document or test the clinic can inspect.

Clause	Contract question	Evidence to attach
Data roles	Who decides purpose and means, and who processes on whose instructions?	Role map signed by both parties
Purpose and instructions	Which uses are permitted, and which are prohibited?	Data-processing schedule tied to the order form
Data inventory	Does the service handle audio, transcript, draft, note, identifiers, logs, or support copies?	Configured data-flow diagram
Hosting and transfers	Where can each data type and backup be processed?	Hosting-region and transfer schedule
Retention	How long does each data type remain in production, backup, logs, and support systems?	Retention table by data type
Deletion and return	What can the clinic delete during service, and what happens at exit?	Tested deletion and export runbook
Access and security	Who can gain access, how is it approved, and what is logged?	Control description and current test summary
Incidents	What triggers notice, how quickly does notice arrive, and what facts follow?	Incident clause and notification template
Subprocessors	Which companies receive data, and how can changes be challenged?	Named list and change-notice process
Data-principal requests	What assistance is provided for access, correction, erasure, and grievance handling?	Request-response operating procedure
Clinical output	Who reviews drafts, suggestions, and prescription text before use?	Acceptance test and user responsibility clause
Exit and continuity	How does the clinic retrieve records, disable access, and prove deletion?	Completed exit drill with named owners

Don’t settle for “industry-standard retention” or “appropriate safeguards.” Ask for the period, the control, the owner, and the exception.

Start with one configured data-flow page

A scribe contract becomes unreadable when every clause describes a different imagined product. Draw the actual route on one page:

Consented encounter input
  -> capture device or browser
  -> processing service
  -> live transcript, if enabled
  -> draft note and suggestions
  -> clinician review and correction
  -> approved export or bundled record system
  -> deletion, retention, backup, and audit-log paths

Add support access, analytics, monitoring, and subprocessors around that route. Mark which steps are optional. If mobile capture, offline capture, a bundled EHR, and use alongside an incumbent EHR create different flows, give each flow its own version.

The order form should identify the selected configuration. Otherwise a strong data schedule can still attach to the wrong product shape.

DPDP status needs a dated sentence

The Digital Personal Data Protection Act, 2023 establishes the statutory framework for processing digital personal data in India (MeitY DPDP Act). Procurement teams should not flatten the framework into a single “DPDP compliant” checkbox.

The Digital Personal Data Protection Rules, 2025 use phased commencement. The official Gazette notification says rules 1, 2, and 17 through 21 began on publication on 13 November 2025; rule 4 begins one year after publication; and rules 3, 5 through 16, 22, and 23 begin eighteen months after publication (Gazette notification). On this article’s source-check date, 29 September 2026, later phases had not all begun.

Put a dated legal-basis note in the procurement file. Recheck it before go-live and renewal using MeitY’s DPDP Rules document page. A future-effective requirement can still be worth contracting for now, but label it accurately.

Write purposes narrowly enough to test

“Provide and improve services” can hide several activities. Split the purpose schedule:

• capture or receive the encounter input;
• generate a transcript when that feature is enabled;
• create a draft note, ICD-10 suggestions, or prescription draft for clinician review;
• store or export the approved material under the selected plan;
• operate security, reliability, and customer support;
• delete or retain each artifact under the agreed schedule.

Then prohibit uses the clinic has not approved. Training, advertising, product analytics on identifiable clinical content, human support access, and secondary research should never be inferred from silence. Record the permitted rule for each activity.

The WHO’s guidance on AI for health places ethics, human rights, accountability, and governance around deployment decisions (WHO AI for health guidance). A contract can’t outsource the clinic’s clinical governance. It can make the vendor’s part inspectable.

Retention requires six answers

Ask separately about audio, transcript, draft, approved note, audit log, and backup. For each one, record:

1. whether it exists;
2. where it exists;
3. the default period;
4. who can change the period;
5. what deletion does to production and backups;
6. which legal or security exception can delay deletion.

Patient Square states that live consultation audio is processed in memory and discarded once the note is drafted. Uploaded recordings use a separate retention mode with explicit consent. Put any relied-upon audio behavior into the agreement or a binding product schedule. Then test it with a trial designed for non-sensitive fictional data.

Avoid a false promise of instantaneous backup erasure. If backups age out on a defined cycle and remain isolated from ordinary use, state the cycle and restriction. If the vendor can’t explain the path, the clinic can’t assess it.

Incident language must survive 2 a.m.

“Without undue delay” is hard to operate without contacts and required facts. The clause should name the notice channel, initial deadline, update cadence, responsible role, and minimum first notice.

At minimum, the first useful notice identifies what happened, when it was detected, which systems and data types may be affected, what containment occurred, what the clinic should do, and when the next update will arrive. The vendor may not know the full scope immediately. The contract should require corrections and updates rather than encouraging silence until an investigation is complete.

Run a tabletop. Send a fictional alert at 2 a.m. and ask both sides to follow the clause. If nobody knows who receives it, the clause failed.

Product claims belong in the acceptance schedule

Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot: an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.

For India, Patient Square states that clinical data is handled to DPDP Act 2023 standards, live consultation audio is discarded after drafting, uploaded recordings use a separate retention mode with explicit consent, access is role-scoped and logged, and notes belong to the practice. SOC 2 Type II is in progress. ABDM integration is on the roadmap. Those are distinct statements. None should be rewritten as certification, an accuracy percentage, live ABDM or ABHA integration, or government approval.

Turn the relied-upon claims into acceptance tests:

Claim under review	Acceptance evidence
Live consultation audio isn’t retained after draft creation	Architecture statement plus contract term and trial explanation
Access is role-scoped and logged	Role demo and sample access event
Clinic can export or delete a visit	Completed fictional export and deletion exercise
ICD-10 output is a suggestion	UI and contract wording preserve clinician review
Prescription output is a draft	No claim of pharmacy transmission or automatic prescribing
ABDM is roadmap work	No live-integration or certification language in the order form

If the product changes, repeat the affected test.

Exit before entry

Negotiate the end while both sides still want the deal. Name the export format, delivery channel, completion window, access shutoff, deletion evidence, backup treatment, outstanding support copies, and the person who signs closure.

Use a 30-minute fictional exit drill before signing:

• export one visit and open it outside the product;
• delete the same visit through the allowed workflow;
• remove a test user’s access;
• request the vendor’s closure evidence;
• record any data that remains and the rule governing it.

The drill often finds a mismatch between sales language and contract language without exposing a patient’s record.

For the product-side review, compare the AI scribe security checklist with the India data-residency guide. Then read the current India security page and Practice Copilot scope beside the proposed order form.

A contract is good when a tired operator can use it. Name the flow, bind the promise, attach the proof, and rehearse the exit.