Why we delete visit audio after sign-off

Once a note is signed, the audio has done its job. The transcript stays with the note, so anyone reviewing it can see where each line came from. The recording itself is the most sensitive thing we hold, so by default we delete it as soon as the clinician signs.

Here is why we made that the default, and how a clinic can keep audio longer when it has a reason to.

Why we treat audio differently

A visit recording holds the patient's own voice and every word said in the room, including the parts that never reach the note. HHS guidance says that disposing of diagnosis and treatment information may warrant more care, because inappropriate access to it could lead to discrimination or harm to a person's reputation. A recorded visit is full of both.

Keeping recordings would make some things easier, for us and for clinics. A question about a draft could be settled months later by going back to the audio. We weighed that against holding a growing archive of recorded visits and chose to hold as little as we can. Once a recording is gone, there is nothing left of it for an attacker to take.

What stays after sign-off

The signed note goes to the EHR. By default, the timestamped transcript stays with the note in Charted, encrypted at rest with AES-256 in your hosting region. Health system admins can set a department's transcripts to delete at sign-off. Each line of the note still links to the moment in the transcript it came from, so a reviewer can trace any sentence without the audio.

No one at Charted can open your notes by default. Support staff can open one only when your admin grants temporary access, and each view is logged.

When clinics keep audio longer

Some clinics want to spot-check drafts against the original audio during a pilot. Admins can set a review window of up to 30 days. Every deletion, on schedule or early, is written to the audit log.

If you set a window, choose the shortest one that covers your review and decide in advance who does the checks. The audio is deleted when the window closes, whether or not anyone listened.

What the audit log shows

The HIPAA Security Rule's audit controls standard asks for mechanisms to record and examine activity in systems that contain electronic protected health information, and the rule requires procedures to review those records regularly. Our audit log records every recording, view, edit, signature and export with a user and a timestamp, along with every deletion. During a review window, use it to see who viewed each visit and to confirm each recording was deleted on schedule.

How deletion works

We don't use audio, transcripts or notes to train models, and we don't keep backups of audio past its deletion date. If a patient asks, their clinic can delete a recording at any time before then. Backups, like the rest of your data, stay in your hosting region.

HHS says the Privacy and Security Rules don't require a particular disposal method. Each covered entity has to review its own circumstances, decide which steps are reasonable and write policies to carry them out. In deciding, it should weigh the risks to patient privacy and the form, type and amount of information involved. The Security Rule does require policies for the final disposition of electronic protected health information and the hardware or media it's stored on. Since the HITECH Act, those safeguards apply to business associates the same way they apply to covered entities, and we sign a business associate agreement on every plan before the first recorded visit.

Questions we get

Can we keep audio for longer than 30 days?

No. Thirty days is the longest review window. After that, the signed note is still there for any question about the visit, and so is the transcript unless your admins set it to delete at sign-off.

What should we tell patients?

Our For Patients page says the recording is deleted after the clinician signs and that some clinics keep it for up to 30 days to check quality. If you set a review window, say so when you ask for consent.