Can Patients Get the AI Scribe Recording? HIPAA Access Rights After Raphael v. Mantei

A patient calls the front desk: "I want a copy of the recording from my visit." Your clinic uses an ambient AI scribe, so a recording exists, at least for a while. Most practices have never decided whether they have to hand it over.

In August 2026 a Washington state court gave the first published answer. It also left most of the question open. This guide covers what the court decided, why the ruling doesn't settle the HIPAA question, how HIPAA's "designated record set" test applies to scribe audio, transcripts, and drafts, and the decision your practice should write down before that call comes in.

The case: Raphael v. Mantei

The patient, Gail Renee Raphael, had a telehealth visit at The Vancouver Clinic in Vancouver, Washington, in spring 2026. The clinic used Microsoft's DAX ambient documentation product to record the visit and generate a draft note. According to the AMA's account of the case, the visit covered her unsuccessful search for a rheumatologist and the physician's withdrawal as her doctor. She asked for the recording, the clinic declined, and she sought a preliminary injunction in Clark County Superior Court.

On August 7, 2026, Judge Derek Vanderwood ruled for the clinic. The ruling turned on one clause of Washington's Uniform Health Care Information Act. RCW 70.02.090(1)(d) lets a provider deny a patient access to health care information that "was compiled and is used solely for litigation, quality assurance, peer review, or administrative purposes."

The court read "administrative purpose" by its ordinary meaning, "for the internal operation or use of an institution." It found that the clinic used the audio to help with the internal job of preparing the written record, and concluded: "The DAX recording is exempt from disclosure under the Uniform Healthcare Information Act."

The AMA Litigation Center, the Washington State Medical Association, and the Washington State Hospital Association filed an amicus brief for the clinic. Their argument was that an ambient recording is the modern version of dictation and handwritten notes: "Ambient AI simply updates that same process with new technology, but the distinction between the record of care and the process of producing that record is not changed."

What the ruling does not decide

The ruling has real limits, and they matter for practices outside Washington, and for practices inside it too.

• It's a trial-court ruling on a preliminary injunction. It doesn't bind other courts, even in Washington. As far as we could find, no appeal had been reported as of early October 2026.
• It interprets Washington law only. Other states have their own medical-records access statutes with different wording. Many have no exemption phrased like Washington's "administrative purposes."
• It doesn't decide the HIPAA question. HIPAA's right of access is a federal floor, and as the law firm Hooper Lundy noted, the decision does not "resolve how HIPAA's right of access applies to AI-generated recordings."
• It doesn't address consent. Whether you could record in the first place is a separate question, covered in our guide to AI scribe patient consent and recording laws.

The HIPAA point is the important one. Under HIPAA's preemption rules, a state law is "more stringent," and survives alongside HIPAA, when it "permits greater rights of access" (45 CFR 160.202). A state exemption that gives patients less access than HIPAA doesn't shrink the federal right. So a practice can win under state law and still face an OCR complaint under HIPAA. HIPAA has no private right of action, so a patient can't sue under it directly. Complaints go to the HHS Office for Civil Rights (OCR) instead, and OCR enforces the access right actively.

The HIPAA test: is it in the designated record set?

HIPAA gives patients the right to inspect and get a copy of protected health information (PHI) in a designated record set (45 CFR 164.524). The definition, at 45 CFR 164.501, covers:

• the medical records and billing records a provider maintains about individuals, and
• any other group of records "used, in whole or in part, by or for the covered entity to make decisions about individuals."

A "record" is any item that includes PHI and is "maintained, collected, used, or disseminated by or for a covered entity." That language covers material a vendor holds for you, not just what sits in your EHR.

OCR's access guidance also describes what falls outside the designated record set. Patients don't have a right to PHI that is "not used to make decisions about individuals." OCR's examples are quality-improvement records, patient-safety records, peer review files, and business planning records, which "may be generated from and include an individual's PHI but may not be in the covered entity's designated record set(s)."

There is no HIPAA exception for "administrative purposes." The only categorical carve-outs from the access right are psychotherapy notes and information compiled in reasonable anticipation of litigation (164.524(a)(1)). So under HIPAA, the question for each scribe artifact is a factual one: is this record used to make decisions about the patient?

Artifact by artifact

An ambient scribe usually creates up to four things. They don't all fall on the same side of the line.

• The signed note. This is clearly in the designated record set. It's part of the medical record, and patients can get it.
• The draft note before clinician edits. The strongest argument that it's outside the set is the amicus brief's dictation analogy: the draft is a working document, and the signed note replaces it. But if drafts are kept and someone later relies on one, for example to settle what was said, that argument gets weaker. Treat retained drafts with caution.
• The transcript. This is the hardest case. Some products are built so clinicians check the note against the transcript. Abridge's Linked Evidence feature, for example, lets a clinician highlight text in the note, see "exactly which part of the transcript it came from," and play the original audio. If a clinician uses the transcript to confirm a medication dose or a symptom before signing, the transcript is arguably being used, "in part," to make decisions about the patient. Our accuracy research roundup explains why that kind of verification is good practice. It may also pull the transcript closer to the record.
• The audio. If audio is deleted automatically once the note is generated, there's usually nothing to request. A request covers only what exists, and OCR says a covered entity "is not required to create new information." If audio is kept for days or weeks and clinicians replay it, the Washington court's framing ("internal operation") is the best argument for withholding it. HIPAA doesn't use that framing, though.

Retention is the hinge. A record that no longer exists can't be requested. A record you keep and use is much harder to call purely administrative. This is why the vendor retention policies covered in our consent and recording laws guide matter for access, and not only for privacy.

Why the same line also governs information blocking

The designated-record-set decision also controls your information-blocking exposure. Under the 21st Century Cures Act rules, electronic health information (EHI) means electronic PHI "to the extent that it would be included in a designated record set" (45 CFR 171.102). The only exclusions are psychotherapy notes and information compiled for legal proceedings.

So if your practice treats retained transcripts as part of the designated record set for HIPAA purposes, they are EHI too, and unreasonably withholding them can be information blocking. Where you draw the line once applies under both regimes.

The deadlines if a request comes in

If you decide something is in the designated record set, the standard HIPAA rules apply:

• 30 days to act on an access request, with one 30-day extension if you notify the patient in writing (164.524(b)(2)).
• Electronic copies in the form and format requested if the information is "readily producible" that way, including an audio file if you have one (164.524(c)(2)).
• Partial denials are allowed, but must be specific. If you deny part of a request, you still have to provide the rest, and the written denial must give the basis and explain how to complain (164.524(d)).
• Amendment requests run on a 60-day clock (164.526). You can deny an amendment request for information that "is not part of the designated record set," which is another reason to decide in advance where scribe artifacts sit.

OCR enforces these deadlines. In August 2026 it announced its 55th Right of Access Initiative enforcement action: a $50,000 settlement with Azul Vision, a California eye-care provider. The patient first asked for records in January 2023 and received them in January 2025. The settlement includes two years of monitoring. These cases are often against small practices, and most involve delay, not exotic legal questions. A scribe-recording request that sits on a desk while staff work out what to do with it can turn into the same kind of case.

The decision to make now

HIPAA already requires you to document "the designated record sets that are subject to access by individuals" (164.524(e)). Most practices did this years ago with a short list: EHR chart, billing system, imaging. Ambient AI is a good reason to update it.

1. Inventory what your scribe actually keeps. For each artifact (audio, transcript, draft, signed note), write down where it lives, who can see it, and when it's deleted. Get the answers from your vendor's documentation and your BAA, not the sales deck. Our HIPAA guide for AI tools has the vendor questions.
2. Decide how each artifact is classified, and write down why. A defensible position for many practices: the signed note is in the designated record set; audio and drafts are transient production materials that aren't used to make decisions and are deleted on a set schedule. If clinicians routinely use transcripts to verify notes and you keep them, either shorten retention or treat transcripts as part of the record.
3. Make retention match the classification. Calling audio "transient" doesn't work if it sits on a server for 90 days and gets replayed in disputes. Short, automatic deletion is the cleanest position. Watch for one exception: once litigation is reasonably anticipated, a legal hold can require you to preserve material you would otherwise delete.
4. Write the front-desk answer before you need it. Staff should know to route the request to your privacy officer, start the 30-day clock, and never tell a patient that "recordings aren't part of your record" without the documented policy behind it.
5. Handle behavioral health separately. Psychotherapy notes are excluded from the access right, but a scribe-drafted progress note is not a psychotherapy note. See our AI therapy notes privacy guide for where that line sits.
6. Check your state's access law. Washington's statute has an administrative-purposes exemption. Your state's may not, and a state law that gives more access than HIPAA applies on top of it.

How this fits with the rest of your scribe program

Access requests are one of several governance questions an ambient scribe raises. Alongside consent, accuracy review, and coding, they belong in the policies you set before rollout. Our AI scribe rollout guide covers the rest. For adolescent patients, where parents may have proxy access to the portal, see the adolescent confidentiality workflow.

If you're still choosing a scribe, retention and transcript features are worth comparing directly. Browse the AI medical scribe category or check vendor pages such as Abridge, Freed, Suki, Nabla, and Heidi Health. For a side-by-side view, see AI medical scribes for family medicine.

The bottom line

• One Washington trial court held that a DAX recording used to draft a note is exempt under that state's "administrative purposes" clause. That's a useful signal, but it isn't binding precedent and it isn't a HIPAA ruling.
• HIPAA asks a different question: is the record used to make decisions about the patient? HIPAA has no administrative-purposes exception.
• The signed note is always accessible. Audio and drafts deleted promptly are the easiest to keep outside the record. Retained transcripts used for verification are the gray zone.
• The designated record set also defines EHI, so the same decision controls your information-blocking exposure.
• Write down your classification and set retention to match it before the first request arrives. OCR's enforcement record shows that delay and improvisation cause problems more often than the legal question itself.

---

This article is informational only and is not legal advice. Raphael v. Mantei is a Washington trial-court ruling on a preliminary injunction and may be appealed or limited by later decisions; it does not establish how HIPAA applies to AI scribe recordings. HHS has not issued guidance specific to ambient AI artifacts as of October 2026. Vendor features and retention practices change; verify them with your vendor and in your BAA, and consult qualified health-care counsel about your state's medical-records access law.