Your AI Scribe Heard the Confidential Part of the Teen Visit. Here's How It Stays Out of the Parent's Portal.

Every adolescent well visit has a moment when the parent steps out. The clinician asks about school, mood, vaping, sex and safety. The teen answers more honestly because the door is closed.

An ambient AI scribe is still listening in that room. It does not know the parent left. It hears "I've been vaping since spring" and "we don't always use condoms," and it writes them into a tidy Social History section of the draft note, the same section your template has always filled with "denies tobacco, alcohol, drugs."

The clinician signs the note. Under the 21st Century Cures Act, the note becomes available in the patient portal. In many pediatric practices, the parent is the one who reads the portal.

This post covers the workflow that stops that from happening. It is written for pediatricians, family physicians and NPs who see teenagers and use (or are about to buy) an AI medical scribe. It covers what the research shows, what the law actually requires, and a step-by-step process for visits, drafts and portal release.

Why a scribe makes an old problem bigger

Adolescent confidentiality leaks through the portal were a known problem before AI scribes. The scribe raises the stakes in two ways: it captures more of the conversation, and it writes that material into structured note sections that templates expect to be routine.

Two numbers frame the risk:

• Parents are often the ones reading. A cross-sectional study across Stanford Children's Health, Rady Children's Hospital and Nationwide Children's Hospital estimated that guardians accessed 64% to 76% of adolescent portal accounts (ages 13–18) that sent messages. Access was highest for 13- and 14-year-olds. (Ip et al., JAMA Network Open, 2021;4(9):e2124733.)
• Confidential content is common. A Stanford team found confidential content in 21% of adolescent clinical notes (255 of 1,200) in its training set, and 22% in a prospective validation cohort. One of the most common sources of accidental disclosure was an automated phrase that auto-populated tobacco-use history into routine progress notes. (Rabbani et al., Applied Clinical Informatics, 2023;14(3):400–407.)

That second finding matters most here. The leak was not careless clinicians. A documentation shortcut dropped sensitive history into a note section nobody thought of as confidential. An ambient scribe works the same way at a much larger scale: it fills every section from whatever it heard.

What the pediatric scribe research does (and doesn't) cover

Children's hospitals have adopted ambient scribes quickly. In July 2025, Abridge announced deployments at eight of them: Akron Children's, Boston Children's, CHOP, Children's Colorado, Dayton Children's, Lurie Children's, Seattle Children's and UPMC Children's. Peer-reviewed results are now appearing:

• Akron Children's (Abridge). A six-month pilot with 84 pediatric providers found the scribe was used in 69.5% of encounters and saved 2.8 minutes per appointment. Burnout fell from 54.9% to 33.3%. Caregiver likelihood-to-recommend rose slightly. (Pelletier et al., JAMIA Open, 2025;8(4):ooaf068.) The providers' open-ended feedback raised consent questions directly: "if parents consent at the first session, do they need to continue to consent each session? Is there a certain age that the patient could consent without parent being there?"
• Vanderbilt pediatric hematology–oncology (DAX Copilot). The scribe was used in only 3.7% of 11,544 encounters. For shorter visits, documentation time was about 11 minutes with DAX versus 24 minutes without. The authors warn that these encounters "often involve sensitive genetic, prognostic, or adolescent confidentiality topics," and that clinicians must judge a note's "appropriateness for inclusion in the medical record," not only its accuracy. (Talman et al., Applied Clinical Informatics, 2026;17(2):374–379.)
• Hospital Sant Joan de Déu, Barcelona. Forty pediatric subspecialists documented 197 visits. Eye contact rose (median 95.7% vs. 78.6%) and note quality scores improved. However, post-visit review took 33%–38% of total documentation time, and a third of surveyed clinicians reported needing extensive corrections. (Vallejo et al., Medicina Clínica, 2026;166(8).)

None of these studies measured whether confidential adolescent content reached a parent. The efficiency data is useful. The confidentiality question is still unmeasured, so your practice needs its own safeguard for it. The vendor's pediatric note type won't cover it: Abridge's May 2025 announcement of its pediatric well-visit note type, for example, describes age-specific structure and anticipatory guidance but says nothing about confidential content.

What the law actually requires

The rules have three layers. You need all three to design the workflow, because breaking any one of them creates its own liability.

Layer 1: HIPAA decides when the parent is not the "personal representative"

Under HIPAA, a parent is normally the personal representative of an unemancipated minor and can access the child's records. 45 CFR 164.502(g)(3) lists the exceptions: when the minor lawfully consented to the care and no other consent is required, when the minor could lawfully get the care without a parent's consent, or when the parent agreed to a confidential relationship between the clinician and the minor. Even then, state law controls whether the parent can see the information.

State minor-consent law does the real work. According to Guttmacher (as of August 1, 2026), all 50 states and DC let minors consent to STI testing and treatment, and 16 states have provisions that permit or require parental notification in some circumstances. Rules for contraception, mental health and substance use vary much more. Your confidentiality workflow must follow your state's list, not a generic one.

Layer 2: Withholding from the parent must fit an information-blocking exception

Since 2021, the Cures Act information-blocking rule has required clinical notes to be available electronically unless an exception applies. Holding back part of a note from a parent is interference, so it needs an exception. For adolescent visits, three exceptions usually apply:

• Privacy exception (45 CFR 171.202). This covers cases where a legal precondition for disclosure isn't met (for example, state law requires the minor's consent before the parent sees STI information). It also covers an individual's request not to share. The HTI-3 rule (89 FR 102564, December 17, 2024) widened that "request not to share" sub-exception.
• Preventing Harm exception (45 CFR 171.201). When a legal representative such as a parent is blocked, the practice must rest on an individualized determination by a licensed clinician. HIPAA's matching standard is that parent access is "reasonably likely to cause substantial harm to the individual or another person" (45 CFR 164.524(a)(3)(iii)).
• Infeasibility exception. This can apply when the EHR can't separate the confidential portion from the rest. Guidance from medical liability insurer MICA notes that the explanation you send for a denial must not itself reveal that the teen received confidential care.

Each exception requires documentation: either a written policy or a case-by-case record. "The scribe put it there and we hid the note" is not a documented basis.

Layer 3: Blocking too much is now an enforcement risk too

The easy fix would be to hide every adolescent note from parents. That is information blocking. HHS's disincentives rule for providers took effect July 31, 2024: a MIPS clinician found to have blocked information gets a zero in Promoting Interoperability. HHS announced an enforcement crackdown on September 3, 2025, and ASTP/ONC began sending nonconformity letters to EHR developers in February 2026. The pending HTI-5 proposal would narrow parts of the Infeasibility and Manner exceptions.

The target is to withhold narrowly: keep the confidential portion out of the parent's view and release the rest normally.

The AAP's March 2026 policy statement (Pediatrics 2026;157(3):e2025075747) makes the same call from the clinical side. It asks EHR developers and practices to support granular consent and data segmentation rather than all-or-nothing note release.

The workflow: five checkpoints

This is a practical sequence you can adapt. It assumes an ambient scribe and an EHR with some way to mark a note or note section as confidential (many EHRs have an "adolescent sensitive" or "confidential" note type; confirm what yours has before you start).

1. Before the visit: set up consent and the state-law matrix

• Get recording consent from the parent and assent from the teen. Recording laws apply to scribes (see our guide to AI scribe consent and recording laws and the state AI disclosure laws). The Akron clinicians' question about whether consent carries over between visits is a real one. Decide your answer in policy and write it down.
• Build a one-page state matrix. List which services a minor in your state can consent to alone, and whether parental notification is allowed, required or prohibited for each. That list defines "confidential" for your notes. It also becomes the written organizational policy that the Privacy exception expects.
• Tell the teen, in plain words, what the portal shows. Tell them the scribe is recording, what the parent can see in the portal, and what you will keep out of it.

2. During the visit: handle the confidential portion separately

When the parent leaves, choose one of three patterns, make it the practice standard, and train everyone on it:

• Pause the scribe, then document the confidential part by hand in the confidential note type or section. This is the simplest option. The risk is forgetting to resume. Freed's help center warns that a visit left paused may not capture enough audio to generate a note, and that audio for visits paused longer than 14 days is no longer retained. Pause behavior differs by product, so test it on yours before relying on it.
• Run a separate scribe session for the confidential portion. Its output goes only into the confidential note type. This keeps the ambient benefit but requires the clinician to start the second session every time.
• Keep one recording and split the draft afterward. This is the most convenient and the least safe option, because it depends entirely on the review step catching every confidential item. The Stanford tobacco-phrase finding shows how often that fails.

3. Reviewing the draft: check for confidential content before you sign

Before signing any adolescent note, check the draft against your state-matrix categories. Look beyond HPI and Social History, because a scribe spreads content across the whole note:

• Social History and ROS: sexual activity, contraception, pregnancy, substance use (including vaping and tobacco), sexual orientation and gender identity.
• Assessment & Plan and Problem List: a diagnosis like "contraceptive management" or "depression screening positive" leaks the conversation even if the history is clean.
• Orders, codes and after-visit instructions: an STI test order, a prescription, or patient instructions sent to the portal. Diagnosis and procedure codes flow to the explanation of benefits, which the insurer sends to the policyholder, usually the parent. Guttmacher flags the EOB as a key limit on confidentiality for minors on a parent's plan. A clean portal note does not help if the claim tells the story.
• Hedged or invented content: scribes sometimes turn an off-hand comment into a finding (see our summary of what the research says about scribe accuracy). A false "reports marijuana use" is both inaccurate and confidential.

4. At release: withhold narrowly and document the exception

• Move confidential items into the confidential note or section. Release the rest of the note to the portal normally.
• Record which exception applies (Privacy, based on your state matrix, or Preventing Harm, based on an individualized clinician determination) and the reason. Use a smart phrase so this takes seconds.
• Check proxy settings by age. Many practices change proxy access at a set age such as 12 or 13. The Ip study found guardian access was highest in the youngest teens. Confirm what your portal actually shows a proxy at each age before you assume the confidential note type is hidden.

5. Every month: audit a sample

Pull a small monthly sample of signed adolescent notes (10 to 20 is enough for a small practice). Read them the way a parent would in the portal. Log every leak by where it happened (which note section, which scribe template, which clinician habit) and fix the template or the training, not only the single note. This is the same continuous-review loop recommended in our AI scribe rollout guide.

Don't let AI be the safeguard

It is tempting to have AI find the confidential content automatically. The evidence so far says no. A 2024 Stanford study asked GPT-3.5 to flag confidential content in 300 adolescent notes. It caught 97% of notes with confidential content but had only 18% specificity, so it flagged most of the notes that had none. Worse, 87% of the excerpts it quoted as evidence contained a hallucination. The authors concluded the output could not be used for regulatory purposes. (Rabbani et al., JAMA Pediatrics, 2024;178(3):308–310.)

Models have improved since then, and a vendor feature that flags possible confidential content could be a useful second check. It should not replace the clinician's review and a documented exception.

Questions to ask your scribe vendor

Before you roll a scribe out to adolescent visits, get written answers to these:

• Can I pause or split a session mid-visit, and what happens to the audio and the note if I forget to resume?
• Can the output of one session be routed to a specific note type or section (including a confidential one) in our EHR?
• Does the scribe generate patient instructions or portal messages automatically, and can I turn that off for adolescent visits?
• Does it suggest diagnoses, orders or codes from the conversation? If so, can I review them before they reach the chart or the claim?
• How long is audio and transcript retained, and can the parent (as personal representative) request it? A transcript containing the confidential portion is itself a record.
• Does your pediatric note type handle adolescent confidentiality at all? If the answer is no, you have learned that the whole safeguard is your workflow.

Current options for pediatric practices are listed on our AI scribes for pediatricians comparison and the pediatricians page, including Heidi Health, Freed, Suki, Nabla and Tali AI. Enterprise options like Abridge are what the children's-hospital studies above used.

The bottom line

AI scribes appear to work in pediatrics. The Akron pilot showed real time savings and lower burnout, and families were no less satisfied. None of the published studies measured whether confidential adolescent content reached a parent, and that question is the practice's responsibility.

The fix is not to turn the scribe off for teenagers, and it is not to hide every adolescent note. It is a workflow:

• consent and a written state matrix before the visit
• a deliberate split when the parent leaves
• a draft review that covers codes and instructions, not just the history
• narrow withholding with a documented exception
• a monthly audit

Related reading: AI scribes for NPs and incident-to billing, the patient-portal inbox workflow, AI notes for therapists and the psychotherapy-note trap, and what HIPAA compliance means for AI tools.

---

This article is for informational purposes only and is not legal or medical advice. Minor-consent, parental-access and recording laws vary by state and change often, and information-blocking rules are under active revision. Confirm your obligations with counsel and your EHR and scribe vendors before changing your workflow.