- A security design the review board could approve, instead of another stalled pilot
- Draft notes written into the EHR only after clinician approval
- Every recording, draft and edit traceable through one audit trail
- An evaluation set that gated model and prompt changes before release
Anonymised composite. Client names, identifying details and confidential figures are withheld; public facts are cited in the references.
The situation
A multi-specialty provider group had a documentation problem everyone could describe: clinicians finishing notes after clinic, and patients getting less eye contact than they deserved. Ambient AI scribes looked like the answer, and several vendor pilots had been started. Each one stalled in the same place: security and privacy review. Reviewers could not get clear answers about where audio went, who could see transcripts, how long anything was kept, or how a wrong sentence in a note would be caught.
The ask was not "pick a better vendor". It was to design a pipeline the organisation could own end to end, so those questions had answers before the first recording.
What had to be true
- Consent first: no recording without a recorded patient consent, and an easy way to stop.
- Data stays inside the boundary: audio, transcripts and drafts processed on infrastructure the organisation controls.
- A human signs every note: the model drafts, the clinician decides.
- Least privilege into the EHR: the app sees the current patient and encounter, nothing more.
- Provable history: who recorded, what was generated, what was changed, what was filed.
Architecture
The design split the problem into capture, private inference, review and filing, with audit running across all of them.
Speech recognition used a Whisper-class model, a family trained on large-scale weakly supervised audio and released with open weights1, which made private hosting practical. Note drafting ran on vLLM, whose PagedAttention memory management is designed for high-throughput serving on limited GPU memory2. Serving patterns are in LLM inference serving with vLLM and private LLMs on-premises.
The data flow, end to end
- ConsentApp checks recorded consent for this encounter before the microphone is enabled
- CaptureAudio encrypted on device and uploaded against the encounter context
- TranscribePrivate ASR with speaker separation; transcript stored with the session
- DraftLLM drafts the note in the specialty template, each sentence linked to transcript spans
- SignClinician reviews, edits and signs; unsupported sentences are flagged for attention
- FileSigned note written to the EHR; audio deleted on the agreed retention schedule
The app launched inside the EHR using SMART on FHIR, requesting only the patient and encounter context and the narrow scopes it needed3. The signed note was filed as a FHIR DocumentReference4. More on scope design in SMART on FHIR authorisation for AI apps.
The hard part: trust in the draft, not the transcript
Transcription quality was rarely the argument. The concern was a fluent note that said something the patient never said. Three choices addressed it:
- Grounded drafting: every sentence in the draft carries a link to the transcript span it came from, and sentences without one are highlighted.
- Clinician-scored evaluation: a curated set of consented encounters, scored by clinicians for omissions and unsupported statements, gated every model and prompt change. See evaluation sets that predict production.
- Edit capture: what clinicians changed was recorded, so recurring corrections fed back into templates and the evaluation set.
An AI scribe is approved on the strength of its failure handling. Reviewers need to see how a wrong sentence is caught, not how rarely it appears in a demo.
How it ran
- Confirms consent
- Reviews linked draft
- Signs note
- Transcribes privately
- Drafts with sources
- Files signed note
- Audit every action
- Gate releases on evaluation
- Enforce retention
Audit records followed the shape of the FHIR AuditEvent resource (who, what, when, outcome), so the trail could be queried alongside other EHR audit data5.
- Threat model with security
- Consent and retention policy
- Data flow sign-off
- ASR and LLM on private GPUs
- SMART launch and scopes
- Audit trail
- Small clinician cohort
- Evaluation set from consented visits
- Template tuning
- More specialties
- Release gate runbook
- Internal ownership
Key decisions and trade-offs
| Decision | Alternative | Why |
|---|---|---|
| Private inference | Hosted scribe API | Answers data residency and access questions directly; costs GPU operations effort |
| Clinician signs every note | Auto-file low-risk notes | Keeps accountability with the clinician and the model out of the record |
| Sentence-level source links | Free-text summary | Makes unsupported statements visible during review |
| Narrow SMART scopes | Broad backend access | Least privilege that reviewers can verify |
| Evaluation as release gate | Ad hoc spot checks | Model and prompt changes cannot silently regress |
What I'd do again, and differently
Again: take the design to the security board before building anything, and treat evaluation as infrastructure. Differently: involve clinicians in template design earlier. Most edits were about structure and specialty conventions, not model accuracy, and that work is cheaper before the pilot than during it. The broader architecture patterns are in ambient AI scribe architecture.
If you have an AI pilot stuck in review, the AI architect page describes how I approach these engagements, or analyse your challenge and bring the result to a call.
- 1Robust Speech Recognition via Large-Scale Weak SupervisionRadford et al., arXiv · 2022
- 2Efficient Memory Management for Large Language Model Serving with PagedAttentionKwon et al., arXiv · 2023
- 3App Launch: Scopes and Launch Context (SMART App Launch)HL7 International
- 4DocumentReference (FHIR R4)HL7 International
- 5AuditEvent (FHIR R4)HL7 International