Your practice owns the notes an AI scribe drafts, not the vendor. The scribe is a tool that types the record; the record belongs to you. So the questions that actually protect you are practical ones: can you export every visit yourself, can you delete any visit yourself, and what happens to your data the day you cancel. If a vendor can’t answer all three cleanly, you don’t fully own your data, whatever the marketing says.
That’s the thesis. The rest of this walks through what ownership means in law, the export and delete rights worth demanding, the five lock-in red flags, and the one case where a little lock-in is actually a fair trade. We sell a scribe, so test every claim here during a trial.
Key takeaways
- The clinical record belongs to the practice. A trustworthy AI scribe processes your data; it doesn’t own it.
- Demand self-serve export of every visit and self-serve delete of any visit. Both, testable in a trial.
- HIPAA gives patients an access right and expects your practice to manage its own records. Build that into the vendor test.
- Five lock-in red flags: no self-serve export, closed-format export, ownership claims in the terms, unclear deletion, silent cancellation terms.
- Accept lock-in only when you can name the concrete benefit you’re buying with it.
The non-negotiables: own the notes, export any visit, delete any visit
Lock-in signals to catch before you sign, not after
Export and delete should be self-serve, not a support request you wait on
Who actually owns the notes an AI scribe drafts?
You do. The clinical record is the practice’s record, created by the clinician, and a scribe, silicon or human, doesn’t change who authored it. The vendor’s correct role is a processor: it handles your data to draft your notes, under your instruction, and acquires no ownership of the clinical content.
The place this gets tested is the contract. Read the terms for two things. First, does the vendor explicitly state that your notes belong to you? It should be a sentence they’ll sign, not a vibe on a landing page. Second, what rights does the vendor claim over your content, for “service improvement,” model training, or anything else? Any claim of ownership, or a broad license over your clinical notes, is a deal-breaker. A processor needs permission to do its job and nothing beyond it.
Our position, stated plainly: notes belong to your practice, not to us. We act as a processor of your data, we don’t sell or share clinical data, and you can take it with you whenever you want. The full posture, what’s stored, who can access it, what’s logged, is on our security page, and the broader vetting routine is in the AI scribe security checklist.
What export and delete rights should you demand?
Ownership without export is ownership on paper. Two functional rights make it real.
Start with export. You should be able to pull every visit yourself, any time, in a format you can actually use outside the tool. Not a screenshot. Not a PDF dump that loses the structure of the note. And not an export you have to open a support ticket for and wait on. The test is simple. During the trial, export a week of notes and see if they come out complete and readable somewhere else. Can’t run the export yourself? Then you don’t control your data. The vendor does.
Delete is the other half. You should be able to remove any single visit yourself, any time, without “contact support to request deletion.” Granular self-serve deletion is the clearest signal a vendor treats the data as yours. It’s also a legal expectation. HIPAA frames patients’ access rights and expects practices to manage their own records, which you can’t do if removing a single visit means filing a ticket and waiting.
There’s a deeper version of this for the most sensitive artifact, the audio. The cleanest delete is the one that already happened. A scribe that never stores the visit audio has nothing to delete, because it processed the recording in memory and discarded it at note draft. Ours works that way. The cross-vendor audio question is its own decision, walked through in what happens to your visit audio across major scribes.
The five lock-in red flags
Run any vendor’s terms and product through this. Each one is a way a vendor makes leaving harder than joining.
| # | Red flag | Why it traps you | What to ask instead |
|---|---|---|---|
| 1 | No self-serve export | You can only leave on the vendor’s timeline and goodwill. | ”Can I export every visit myself, today, without asking you?“ |
| 2 | Closed or lossy export format | Your data comes out unusable, so it might as well stay in. | ”What format is the export, and does it keep note structure?“ |
| 3 | Ownership or broad-license terms | The vendor claims rights over your clinical content. | ”Does the contract say my notes belong to my practice?“ |
| 4 | Unclear deletion | You can’t remove a visit without asking, or at all. | ”Can I delete any single visit myself, any time?“ |
| 5 | Silent cancellation terms | At exit, the vendor has the least reason to help. | ”What happens to my data if I cancel, and on what timeline?” |
The pattern across all five: a vendor confident in its product makes leaving easy, because it expects you to stay because the product is good. When leaving has been made deliberately hard, ask why the product needs the friction to keep you.
What happens to your data when you cancel?
This is the red flag buyers check last and regret first. Cancellation day is exactly when the vendor has the least reason to be helpful. So the protections have to be in the contract before you sign, not negotiated after.
A good cancellation clause is specific: your notes are returned or destroyed on your instruction, within a stated window, and the vendor confirms when it’s done. A bad one is silence, or a sentence buried in a terms page that says the vendor “may retain data as required.” Get the exit terms in writing up front. Our stance is that your data leaves with you, exportable any time, deletable any time, and we don’t hold clinical content hostage to a renewal conversation. The technical side of the same trust question, what’s encrypted, who can access notes, and how the audio is handled, sits alongside this one in the AI scribe security checklist.
When is some lock-in a fair trade?
Honestly, sometimes it is. Not all friction is a trap, and pretending otherwise would be its own kind of dishonesty.
If a scribe is wired deep into your EHR, with a certified integration that writes notes straight into the chart and pulls patient context automatically, pure portability gets harder. But that integration can save real time and cut double-entry, and for a large health system that workflow benefit can outweigh the lower portability. That’s a legitimate trade. The honest rule: accept lock-in only when you can name the concrete benefit you’re buying with it. Write-back into the chart, a managed audit trail inside the EHR, enterprise identity at scale, some practices should pay portability for those.
And here’s the truth about us. We don’t integrate with EHRs. So if that deep-integration benefit is what you need, a health-system platform embedded in your EHR will serve you better than we will, and you’ll accept more lock-in to get it. What we offer is the other side of that trade. Low lock-in. Notes exportable and deletable any time. Audio never stored. A product you stay on because it works, not because leaving hurts. Pick the side your practice actually needs.
The canonical line, so you know what you’d be staying with or leaving: AI Medical Scribe by Patient Square is an ambient AI medical scribe that listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft, ready to review and sign about two minutes after the visit.
How to verify ownership and exit before you sign
Twenty minutes of contract reading saves a painful migration later.
- Find the ownership sentence. The terms should say your notes belong to your practice. If they don’t, ask for it in writing.
- Run the export yourself during the trial. A week of notes, exported by you, complete and readable elsewhere.
- Delete a test visit yourself. Confirm it’s granular and self-serve, not a support ticket.
- Read the cancellation clause. Return or destruction, on your instruction, within a stated window.
- Price the lock-in. If there’s friction, name the benefit you’re buying with it. No benefit, no friction worth accepting.
The cleanest test of all of this is a real week with the product, exercising export and delete with your own hands. Book a demo, ask who owns the notes and how you’d leave before you ask anything about features, then run the 7-day trial and try to take your data out. A vendor that makes that easy is showing you something the sales deck can’t.