This depends entirely on the vendor, which is why this question is important during the vetting process. The AMA's reporting on the University of Iowa Health Care deployment shows this clearly: their privacy and security team approved only a tool that did not generate a permanent audio recording. Their position was clear: if a recording is created and kept, the tool does not qualify for deployment. Vendors handle this differently. Some discard audio as soon as the note is generated, while others keep it for a set period before deletion. Before you sign anything, get their exact retention and deletion policy in writing, not just a summary—ask for the actual terms.
The answer you give patients should be specific to your vendor. For example, Azalea Health's Clinical Assistant handles this question: the system is fully encrypted, no user data is used to train the AI, original audio recordings and full transcripts are permanently purged within 30 days, and data is processed in a de-identified way. No patient demographics are stored or used, even temporarily. This level of detail is what patients want. A confident, precise answer builds much more trust than a vague compliance statement.
