AI scribes raise patient privacy concerns

• AI medical scribes are rapidly being adopted by Indian clinicians
• Adoption has tripled in a year, aiming to reduce physician burnout
• Patients face privacy risks as consent rules under the DPDP Act lag

The next time you visit your doctor, there might be a third party in the room: an AI scribe. These tools promise to reduce physician burnout by automating note-taking, but their rapid rise in India raises urgent questions about patient privacy.

The Doctor’s New Assistant

Imagine a doctor’s appointment where the physician can give you their full attention, without once looking down to type notes. This is the promise of AI medical scribes. These systems use ambient artificial intelligence to listen to the conversation between a doctor and patient, transcribing it in real-time and automatically structuring the information into a clinical note. For India's overburdened clinicians, who face immense patient volumes, the appeal is obvious. The technology can significantly reduce administrative work, a major contributor to physician burnout, freeing up doctors to focus on care rather than paperwork. Proponents argue that this leads to better patient engagement, more accurate records, and improved efficiency. With a more than three-fold increase in AI adoption among Indian clinicians in the last year alone, these digital assistants are quickly becoming a part of the healthcare landscape.

Efficiency vs. Privacy

While the benefits are compelling, the technology introduces significant risks. At the heart of the issue is the sensitive nature of the data being collected. Every detail of a private medical consultation—symptoms, histories, personal anxieties—is recorded and processed by an algorithm. This raises concerns about data security and vulnerability to cyberattacks. Furthermore, the AI itself is not infallible. These systems can 'hallucinate' or fabricate details, misinterpret medical terminology, or fail to capture nuance, potentially leading to critical inaccuracies in a patient's medical record. The ultimate responsibility for the accuracy of these notes still rests with the clinician, who must meticulously review every AI-generated output, sometimes creating a new burden of 'fact-checking' the machine.

The Murky Waters of Consent

This brings us to the central problem: consent. Are patients in India being clearly informed that their private conversation is being recorded and analysed by a third-party AI? Most have no idea AI is even involved in their care. India's Digital Personal Data Protection Act (DPDPA), 2023, establishes a new framework for data privacy. It mandates that consent must be free, specific, informed, and unambiguous. For health data, which the law treats as sensitive, these requirements are even stricter, demanding explicit consent. However, the on-the-ground reality is often a simple, blanket consent form signed at registration, which may not explicitly mention the use of an AI scribe. This falls short of the meaningful, informed consent required when a machine is listening to, and storing, one's most private health information.

India's Regulatory Framework

India is not navigating this new territory without a map. The Indian Council of Medical Research (ICMR) has released ethical guidelines for AI in healthcare, emphasizing principles like autonomy, safety, and data privacy. These guidelines state that patients must be informed about AI involvement in their care and that human oversight is essential. The DPDP Act provides the legal backbone, giving patients rights over their data and holding healthcare providers accountable as 'Data Fiduciaries'. However, there are still gaps. The specific rules for implementing the DPDP Act are still awaited, and there isn't yet a specific legal regulation that governs AI in the healthcare sector directly. This leaves a grey area where rapid technological adoption outpaces clear, enforceable rules for tools like AI scribes.

Crafting a Prescription for Trust

For AI scribes to be a force for good, a framework built on transparency and trust is essential. Clearer consent rules are the first step. This means moving beyond fine print and creating a process where doctors explicitly inform patients about the presence and function of an AI scribe before the consultation begins. Patients should have the simple, clear right to say no without affecting their care. Hospitals and clinics must ensure the AI tools they use are validated for accuracy, particularly with India's diverse languages and accents. They must also have robust security measures to protect the data collected. Ultimately, the ICMR guidelines suggest a 'human in the loop' approach is non-negotiable; the doctor must always be in control, using the AI as a tool, not a replacement for their own judgment and responsibility.