Microsoft and Nuance: the recording is the asset to govern

The week

On April 12, 2021, Microsoft announced an agreement to buy Nuance Communications for $56 per share in cash. The price was a 23% premium to Nuance’s closing price on the previous trading day. The deal was valued at about $19.7 billion including net debt (the company’s borrowings, net of its cash, which the buyer takes on). At the time, only Microsoft’s 2016 purchase of LinkedIn had been larger.

Nuance had done more than most to change a familiar scene in clinics across the country. A doctor finishes seeing a patient, turns to the computer and spends the next stretch typing, or speaking into a microphone, to produce the note the record requires. Many doctors finished those notes at home, late at night. Physicians have a name for it: “pajama time.”

Nuance was best known in healthcare for Dragon Medical, speech recognition software widely used by clinicians to dictate notes. Speech recognition is the technology that turns spoken words into written text; for doctors, it replaced typing with talking. Nuance’s newer product went further. The Dragon Ambient eXperience, known as DAX, captured the conversation between clinician and patient and turned it into draft clinical documentation. “Ambient” means the software listens in the background to the whole visit, rather than waiting for the doctor to dictate. The doctor talks to the patient; the software works out what belongs in the note.

Microsoft’s announcement made large claims about Nuance’s reach. It said Nuance’s products were used by more than 55% of US physicians, 75% of US radiologists and 77% of US hospitals. Those were the buyer’s figures, but they explain the price. Radiologists mostly used PowerScribe, Nuance’s reporting product, to dictate the reports that turn an image into a diagnosis. Physicians increasingly used Dragon Medical One, a cloud version of the dictation software that, the announcement noted, already ran on Microsoft’s Azure cloud. Microsoft also said Nuance’s healthcare cloud revenue had grown 37% in Nuance’s 2020 fiscal year.

The two companies were not strangers. In 2019 they had announced a partnership to develop ambient clinical intelligence, the technology behind DAX, and to run it on Azure. Nuance had also been narrowing its focus. In 2019 it spun off its automotive voice business as a separate public company, Cerence. What remained was healthcare plus an enterprise unit selling customer-service automation and voice biometrics, which banks and telecom carriers used to recognize callers by the sound of their voices.

Microsoft framed the deal around its cloud for healthcare and its push into industry-specific cloud services. A cloud, in this sense, is computing power and storage rented over the internet from a provider’s large data centers, rather than run on a hospital’s own servers. Industry-specific clouds bundle that capacity with tools, data formats and compliance features tailored to one sector. Microsoft had introduced its Cloud for Healthcare in 2020. It said the acquisition would double its addressable market among healthcare providers, by its own estimate to nearly $500 billion. Buying Nuance gave Microsoft a product clinicians already used every day, and a doorway into the clinical workflow itself.

Nuance’s chief executive, Mark Benjamin, was to stay on and report to Scott Guthrie, who ran Microsoft’s cloud and AI group. That reporting line signaled where Nuance would live: inside the cloud business, alongside Azure, rather than as a standalone healthcare unit.

Hospital security teams had reason to remember a less flattering chapter. In June 2017 the NotPetya malware attack hit Nuance and took down its hosted transcription services for hospital customers for weeks. Nuance later reported tens of millions of dollars in lost revenue in its securities filings. Clinicians who relied on those services had to fall back on other ways of documenting care. The episode showed how much clinical documentation already depended on one vendor’s infrastructure.

The acquisition was not instant. It needed shareholder and regulatory approvals in several jurisdictions, and Microsoft said it intended to close within 2021. The European Commission cleared it without conditions in December 2021, after examining, among other things, whether Microsoft could use Nuance’s data to disadvantage rivals. The UK Competition and Markets Authority, the last major hurdle, cleared it in early March 2022. The deal closed on March 4, 2022.

At the time, most of the headlines were about the price tag and what it said about Microsoft’s ambitions. For hospital leaders, a less obvious question mattered more: if software is going to listen to every patient visit, someone has to govern what it hears.

Much of the 2021 commentary on the deal focused on the price and on Microsoft’s healthcare ambitions. The consequential question for health systems was what ambient documentation asks of an organization.

The difference from dictation is easy to state and easy to underestimate. Dictation captures what a clinician chooses to say. Ambient tools listen to the whole encounter, including the patient. That changes three things, which we take in turn: the recording, a new class of clinical data; the workflow that turns it into a signed note; and the agreement that governs what the vendor may do with both. Before those three, we explain how the technology works and what it puts at stake. After them, we cover how to measure value, what vendor consolidation changes, and who should own each decision.

From microphone to signed note

Ambient documentation is a chain of steps, each of which can go right or wrong. Each step also creates something that has to be stored, secured and eventually destroyed.

Capture

The chain begins with capture. A microphone, often a phone or a small device in the exam room, records the conversation between clinician and patient. That audio is sent, usually over the internet, to the vendor’s computers in the cloud.

The choice of device carries more weight than it seems. A clinician’s own smartphone is cheap and convenient, but it puts protected health information on a personal device, at least briefly, while audio buffers or uploads. That makes mobile device management part of the project: the ability to require a passcode, keep the app’s data separate and wipe it remotely if the phone is lost. A fixed room microphone avoids personal devices but costs more, needs network ports and maintenance, and records whoever is in the room whether or not the clinician has started a session.

Telehealth visits change capture again. The audio may come from the video platform rather than a microphone, and the patient may be in a different state from the clinician, which matters for the recording laws discussed below.

Transcription

Next comes transcription. Speech recognition software converts the audio into text and tries to tell who is speaking, a step engineers call diarization. This is the same family of technology as the voice assistant on a phone, trained on enormous amounts of speech, and in Nuance’s case tuned for medical vocabulary.

Transcription quality varies with conditions a pilot may not test. Heavy accents, crosstalk, a family member answering for the patient, background noise in an emergency department and visits conducted through an interpreter all strain it. A visit conducted largely in a language other than English may be handled poorly or not at all. Those are exactly the visits where a garbled draft is hardest for a hurried clinician to spot.

Summarization

Then comes summarization, the genuinely new part. A transcript of a visit is long, rambling and full of small talk. A clinical note is short, structured and organized under familiar headings: the patient’s complaint, their history, the examination, the assessment and the plan. Software trained on examples of conversations and the notes doctors wrote from them produces a draft in that format. The result resembles minutes written up by an assistant who sat in on the visit.

In 2021 this step was not purely automated. As later press coverage described, the DAX product of that era used human reviewers working for the vendor as a quality check on drafts before they reached the clinician. That made the output more reliable. It also meant that people outside the health system could hear patients’ conversations, which has consequences for the agreement discussed later.

Review

Finally comes review. The draft goes to the clinician, who reads it, corrects it and signs it. Only then does it become part of the official medical record.

Two features of this chain matter most. First, every step produces data: audio, a transcript, a draft, the clinician’s edits and the final note, plus usage logs showing who recorded what and when. Each is a separate asset with its own risks. Second, the software is fluent but not infallible. It writes in confident clinical prose whether or not it got the facts right, which is exactly why the review step cannot be a formality.

Recordings, retention and a platform choice

Every recorded visit leaves audio on a vendor’s computers that a litigant can demand and a privacy regulator will ask about. Ambient documentation touches nearly every part of a health system’s risk and economics.

Staff. Documentation burden is one of the most common complaints clinicians make about modern medicine, and it contributes to burnout and departures. A tool that genuinely gives clinicians their evenings back is a retention tool, and replacing a physician is slow and costly. A tool that merely shifts the work, from writing notes to correcting them, is not.

The calculation differs by type of organization. An academic medical center may care most about faculty time for research and teaching. A rural hospital that struggles to recruit may value retention above everything else. An ambulatory network paid largely per visit will look hardest at throughput, and a health system in value-based contracts at the quality of the documentation that supports risk adjustment.

Patients. When the doctor is not typing, the doctor is looking at the patient. Many clinicians describe that as the main benefit. But patients also have a stake in being recorded, and some will be uneasy about it. How the organization asks permission says a great deal about how it treats people.

Some encounters deserve special handling. An adolescent may discuss sexual health or substance use with a parent out of the room. A behavioral health visit may cover trauma. Records from federally assisted substance use disorder programs are governed by 42 CFR Part 2, which is stricter than HIPAA. A program that records every visit by default, with no carve-outs, has made a decision about these patients without discussing it.

Legal and regulatory risk. Recordings are evidence. They can help defend a clinician whose note is challenged, and they can be demanded by the other side in a dispute. Once litigation is reasonably anticipated, an organization generally must preserve relevant material, so a short retention rule has to yield to a legal hold. Privacy regulators will expect the organization to know where the audio is, who can hear it and when it is destroyed. A breach of recorded conversations would be far more damaging to trust than a breach of billing codes.

Security and continuity. The audio leaves the building. That is normal for cloud services and not a reason for alarm in itself. But the hospital’s control over the data now runs through a contract rather than through its own locked doors. It also means clinicians depend on the vendor being up. Nuance’s own 2017 outage showed what happens when a documentation service disappears for weeks, and downtime procedures should assume it can happen again.

Money. Subscription fees per clinician add up quickly, and the benefits are partly financial (more visits, fewer departures) and partly hard to price (less burnout, better attention to patients). Leaders need both sides of that ledger, honestly measured.

Strategy. Choosing an ambient tool is increasingly choosing a platform partner. That decision shapes negotiating power for years.

The recording: a new class of clinical data

Ambient capture records the full conversation. That may include sensitive disclosures, family members in the room, and information that never makes it into the note. A patient might mention a relationship problem, a worry about immigration status or a relative’s illness. When held by or for a covered entity, the audio and transcript are protected health information, the category of data the federal HIPAA privacy law protects. They raise questions most organizations had never answered for dictation.

How is the patient told the encounter is being recorded, and how do they decline? Is the audio kept after the note is signed, and if so for how long and why? Who can listen to it, and is it part of the designated record set, the collection of records a patient has a right to request?

Notice and consent

HIPAA itself permits using patient information for treatment without written authorization, so the federal privacy rule is rarely the obstacle. State laws on recording conversations add a layer. Several states, California, Florida, Pennsylvania and Washington among them, generally require the consent of every party to a private conversation. A health system operating in several states needs its lawyers to map these rules state by state, including for telehealth visits that cross state lines.

Most multi-state systems end up applying the strictest rule everywhere, because a single process is easier to train and audit than a patchwork. That means an explicit verbal request at the start of each visit, a notice posted in the room, and a field in the record showing that consent was obtained. The field matters. It should be completed by a person at the moment consent is given, never pre-filled by a note template.

Consent also has to be revocable mid-visit. A patient who agrees at the start may want the device off before discussing something sensitive. Clinicians need a simple, visible way to pause capture, and the note should reflect that part of the visit was not recorded.

Retention and the record set

Each retention answer has a cost. Deleting audio soon after signing limits breach exposure and discovery risk, the chance that recordings are demanded in a lawsuit. But it removes the ability to check a disputed note against what was said. Keeping it supports quality review and model improvement, but creates a large, sensitive archive: hours of intimate conversations, held on a server somewhere, waiting to be stolen or subpoenaed.

The designated record set question has practical consequences. If audio is used to make decisions about a patient, it may fall within the set, and patients may request copies under HIPAA’s right of access. Audio that is deleted within days, and used only to generate a draft, is easier to argue is outside it. That is a judgment for counsel, and it should be written down, because the answer drives how access requests are handled.

There is no universally right answer on retention. There is a wrong process, which is letting the vendor’s default retention setting decide. Privacy, compliance, clinical leadership and information security need to settle these questions together, before the first pilot clinic goes live.

Take a community hospital planning a pilot in two primary care clinics. If it starts the pilot first and asks the retention question later, it will discover that months of audio already exist under whatever rule the vendor shipped with. Changing course then means deciding what to do with an archive nobody meant to create. If it asks first, the pilot runs under rules the hospital chose: a patient notice posted in each room, a script for clinicians to ask permission, a clear way to say no, and a defined period after which audio is deleted.

Access and security

The HIPAA Security Rule requires a risk analysis that covers where protected health information is created, received, maintained or transmitted. An ambient program adds new flows: device to vendor, vendor to any human reviewers, vendor to EHR. Each needs to appear in the analysis, with encryption in transit and at rest, and with logs showing who played back which recording.

Voice adds a biometric dimension. Some products build a voice profile of each clinician to tell them apart from patients. Illinois’s Biometric Information Privacy Act and a Texas statute both cover voiceprints, and the Illinois law gives individuals a private right of action. Organizations with clinicians in those states should ask counsel whether enrolling a clinician’s voice triggers notice and consent duties toward their own staff.

Research, teaching and secondary use

Once an archive exists, other parts of the organization will want it. Researchers may see a rich source of data on how clinicians and patients talk. Educators may want examples for training residents. Quality teams may want to study communication failures. Each use may be worthwhile, and each is a different purpose from the one patients were told about.

At an academic medical center, research use generally runs through an institutional review board and needs either patient authorization or a waiver under HIPAA’s research provisions. Teaching and quality improvement fall under different rules, but they still deserve a written decision. The simplest defensible position is that recordings are used only to produce the note and audit its accuracy, unless a separate approval process says otherwise.

The workflow: where the draft lands and who checks it

An ambient tool produces a draft. The clinician reviews, edits and signs it. The quality of that loop decides whether the tool saves time or moves work around.

Where the draft lands

Location matters more than it sounds. If the draft lands outside the EHR, the electronic health record system the clinician works in all day, and must be copied in, the gain shrinks and errors creep in. If it lands inside the note, with clear marking of AI-generated text until the clinician accepts it, review is faster and the record is clearer. Anyone reading the record later can tell what the clinician wrote and what the machine proposed.

Patients are among those readers. The federal information blocking rules under the 21st Century Cures Act reached their compliance date on April 5, 2021, a week before the Nuance announcement. They pushed providers toward releasing clinical notes to patients through portals, often promptly. A draft error that once lived unread in a chart can now be read by the patient within hours, sometimes before the clinician has noticed it.

Failure patterns and training

Clinical accountability must stay explicit. The signed note is the clinician’s, and policies should say so. Training should cover the specific ways these drafts go wrong: omissions of things said late in a visit, findings attributed to the wrong body side, and plausible statements nobody made. That last failure is the most dangerous, because it reads exactly like a correct note. A tired clinician skimming a well-written draft may not notice a sentence describing an examination that never happened.

A short example shows why. Suppose a patient mentions, as she is putting on her coat, that the pain is actually in her left knee, not the right one she described earlier. The software, weighting the longer earlier discussion, drafts a note about the right knee. The clinician, running behind, skims the draft, which reads perfectly, and signs it. Weeks later a referral goes to a specialist with the wrong side recorded. Nothing about the software “crashed.” The failure was a fluent draft meeting a hurried review. Training that names this exact pattern, the late correction, is what helps clinicians catch it.

A second pattern is note inflation. Drafts tend to be thorough, and thoroughness can drift into documenting more than was done. That has a billing dimension. Since January 2021, office visit coding has been based on medical decision making or total time, so a note that elaborates decision making can support a higher visit level. Compliance teams should watch coding distributions before and after rollout. A sudden shift upward needs an explanation an auditor would accept.

Differences by setting

The workflow that suits a primary care office does not transfer intact. In an emergency department, a clinician sees a patient in several short bursts over hours, with nurses, consultants and family members talking in between. Capture has to start and stop many times, and the draft has to stitch the fragments together.

Inpatient rounds raise a different problem. In a shared room, the microphone hears the patient in the next bed. Behavioral health raises another. HIPAA gives psychotherapy notes, kept separate from the medical record, extra protection, and many therapists keep their record notes deliberately sparse. A tool that produces a detailed narrative of a therapy session may be documenting more than the clinician would choose to put in the chart.

The sensible sequence is to start where ambient tools fit best, in conversation-heavy outpatient visits, and to treat each new setting as a separate decision with its own rules.

Auditing the loop

Some organizations add a periodic audit, comparing a sample of signed notes against their source audio, to see whether review is catching errors. The audit does not inspect everything, only enough to show whether the system is working. Note the dependency here: the audit requires keeping at least some audio for some time, which loops back to the retention decision.

A workable audit is modest. Each month, a clinical documentation specialist or physician reviewer takes a small random sample of notes per specialty. They listen to the source audio and classify discrepancies by severity: cosmetic, clinically minor, or clinically significant. The trend matters more than any single month. A rising rate of significant discrepancies in one clinic suggests review there has become a click-through, and the response is coaching, not blame.

The edit trail is a second signal that needs no audio at all. If clinicians in one department almost never change a draft, either the tool is excellent there or nobody is reading. The audit tells you which.

Measuring value honestly

Ambient tools are sold on time saved and burnout reduced. Those benefits are plausible, and clinicians who used early versions often reported relief, but vendor case studies are not neutral evidence. A vendor will naturally showcase its happiest customers.

Health systems that evaluated well defined their measures before the pilot:

• After-hours documentation time, taken from EHR audit logs, the system’s own record of who did what and when.
• Note completion times, and the share of notes closed the same day.
• Clinician-reported burden, measured with the same survey before and after.
• The frequency and type of edits clinicians made to drafts.
• Patient experience scores for the clinics involved.

They compared like with like by specialty and visit type, since a primary care visit differs from a procedure-heavy clinic. A tool that shines in a conversation-heavy appointment may add little in a clinic where the important work happens with the patient’s hands, not words.

Quality as well as speed

Speed is easy to measure and can mislead. A faster note that is less accurate, or longer and harder to read, is not a gain. Some evaluations score a sample of notes from before and after the pilot against a structured rubric covering accuracy, completeness, organization and concision. Reviewers who do not know which notes were drafted by software give the fairest scores. The same sample can feed the discrepancy audit described above, so the two efforts share their labor.

Who volunteers, and what the time buys

Pilots attract enthusiasts. Clinicians who volunteer are often the ones most frustrated by documentation and most comfortable with new tools. Their results overstate what the median clinician will see. Where possible, compare pilot users with a matched group who did not get the tool over the same months. That keeps seasonal swings and other changes from being credited to the software.

There is also a decision hiding in the measurement. Time saved can go back to clinicians as shorter evenings, or it can be converted into more visits per session. Both are legitimate. They are not the same program. A health system that adds visits to every schedule as soon as notes get faster may erase the burnout benefit that justified the purchase. Leaders should decide in advance how saved time will be used and say so to clinicians.

The full cost

Price the scaled version. Per-clinician subscription fees that look modest in a pilot become a major line item across a large medical staff. The governance work carries its own cost: privacy review, training hours, the monthly audit, device management and help desk support. A board should see the full-scale cost next to the measured benefit, not the pilot cost next to the vendor’s brochure.

The agreement: what the vendor may do with the data

A business associate agreement, the contract HIPAA requires when a vendor handles protected health information on a provider’s behalf, sets HIPAA obligations. It limits the vendor’s uses to those the agreement permits, requires safeguards, flows obligations down to subcontractors, requires breach reporting and provides for return or destruction of data at the end. It does not settle every question that matters for AI.

Training rights and de-identification

Health systems need clarity on whether audio and transcripts may be used to train or improve models. Training is how these systems get better: they learn from examples, and real clinical conversations are valuable examples. If such use is allowed, the contract should say whether it is limited to de-identified data, and how a voice recording could be de-identified at all.

HIPAA’s safe harbor method of de-identification lists eighteen identifiers to remove, and one of them is biometric identifiers, including voice prints. Raw audio therefore cannot meet the safe harbor test. A vendor claiming to train on de-identified recordings would need another route, such as an expert determination, and the health system should see what that determination covers. Removing a name from a transcript is one thing; a voice is recognizable in itself.

People, places and subcontractors

The contract should also say where data is stored and processed, which subcontractors touch it, and what happens to it at contract end. Where the vendor uses human reviewers, it should say who they are, where they work, what training and background checks they receive, and whether they are employees or a contracted firm. A health system that would never let an offshore contractor browse its charts should know whether one is listening to its exam rooms.

Buying direct or through the EHR

Some health systems contract directly with the ambient vendor. Others buy through their EHR vendor’s marketplace or as an EHR module. The second route can simplify integration and support. It can also put a third party between the health system and the company that actually processes the audio. The health system should know which company holds its recordings, which agreement governs them and which party it calls when something goes wrong.

Service, liability and evidence

Beyond data, the agreement should cover availability and remedies. Service levels should name an uptime target and the credits that follow a miss. Security incident notification should come faster than the outer limits HIPAA allows for breach notice. Audit rights should include recent independent assessments, such as SOC 2 reports, and a right to ask follow-up questions. Liability caps deserve attention, because standard caps tied to annual fees may be small next to the cost of a breach of recorded visits.

The data schedule

These questions are best answered as a short schedule attached to the contract rather than scattered through boilerplate. It lists each type of data the service creates: audio, transcript, draft, edits, final note, usage logs and voice profiles. For each, it says where it is held, how long it is kept, who may use it and for what, and how it is returned or destroyed at the end. If the vendor cannot fill in that table, the health system has learned something important before signing, not after.

Consolidation and the platform question

Consolidation raises the stakes. When a specialist vendor becomes part of a large platform company, its data practices may change to fit the parent’s architecture and product plans. A contract written for a standalone dictation vendor may not anticipate that. Health systems with existing Nuance agreements had good reason to review them once the deal was announced. The key clauses covered data use and assignment, meaning whether the contract can be transferred to a new owner. Change of control clauses mattered too: they set the customer’s rights when the vendor is bought.

From negotiated contract to standard terms

Large cloud providers tend to sell on standardized online terms, with a business associate agreement incorporated by reference rather than negotiated line by line. That brings consistency and, often, strong security programs. It also brings less room to negotiate. A health system used to marking up a specialist vendor’s paper may find that the platform’s terms are offered largely as is, and that changes apply to every customer at once. Knowing which provisions are negotiable, and pinning down the ones that matter most before the transition, is worth the effort.

Integration and lock-in

The deal also signaled that ambient documentation would be sold as part of large cloud and EHR platforms, not as a niche tool. That brings integration and investment: a large parent can fund development and connect the product to other services. It also ties a clinical AI choice to a platform relationship, which affects pricing power at renewal and the cost of switching. Once a tool is woven into how hundreds of clinicians work every day, leaving it is expensive and disruptive, and the vendor knows that.

Bundling sharpens this. A discount on ambient documentation folded into a broad enterprise agreement can be attractive. It also makes the true price of each component hard to see, and it raises the cost of leaving any one of them.

An exit plan for an ambient tool is short but specific. It names the data to be returned or destroyed, in what format and by when. It lists the templates and configurations to export. It sets out how clinicians would document during a transition, and how long the old service would run alongside a new one.

The case against worrying

The strongest counter-argument is that ambient lock-in is shallower than it looks. The product’s output is text inside the EHR, which stays with the health system whatever happens to the vendor. Switching ambient vendors is far easier than switching EHRs, and a competitive market keeps prices honest.

That is partly right. The note does stay. What does not transfer easily is everything around it: clinician habits and preferences, specialty templates, the audit history, any retained audio, and the integration work. The size of a health system matters too. A large integrated system can negotiate and switch. A small physician group buying through its EHR vendor’s marketplace takes the terms it is given. A health system should know, before signing, how prices may change at renewal and how it would export its configurations and stop the service if it needed to.

Three owners, three artifacts

The programs that worked shared a pattern: governance decisions made before the pilot, not during it; patients told clearly and given a real choice; drafts that land inside the record and are visibly marked until accepted; clinicians trained on the specific failure patterns; a sample audit that proves review is working; measures set in advance and compared fairly; and a contract that answers the AI questions a standard business associate agreement leaves open.

The failures are just as predictable. Accepting the vendor’s default settings for retention and notice. Treating review as a click-through. Judging success on enthusiasm from a handful of early adopters. Pricing the pilot rather than the program. And failing to reopen contracts when the vendor changes hands.

The whole program comes down to three owners and three artifacts:

• Privacy and compliance own the recording. Their artifact is a written policy on notice, consent, carve-outs, retention, legal holds and access requests.
• Clinical leadership owns the review. Its artifact is a documentation standard plus the monthly audit report, by specialty, with trends.
• Procurement and legal own the agreement. Their artifact is the data schedule, with exit and change-of-control terms attached.

Information security supports all three rather than owning one. It runs the risk analysis, manages devices and checks the vendor’s evidence. A small steering group that meets monthly during rollout, then quarterly, is usually enough to keep the three in step.

A reasonable objection is that this slows adoption while clinicians keep burning out. The answer is proportion. A two-clinic pilot needs a retention rule, a consent script, a review standard and a signed data schedule. Those can be settled in weeks. What should not happen is a rollout that outruns its own rules. If any of the three owners is missing, that is the gap where problems will appear first.

What to settle before the first pilot clinic

These five questions make a short pre-launch checklist. Each should have a named owner and a written answer before audio is captured from the first patient.

1. How are patients told a visit is being recorded, and what happens if they say no?
2. How long do we keep the audio and transcripts, who decided that, and why?
3. How do we know clinicians are catching errors, and when did we last audit a sample against the audio?
4. Can the vendor use our patients’ conversations to train its models, and if so, on what terms?
5. What changes in our contract if the vendor is bought, and how would we leave?

With hindsight

The deal anticipated a rapid shift. What was a promising but specialized product in 2021 became one of the most visible uses of AI in health care.

The transaction itself was uneventful. Regulators in Europe and the United Kingdom cleared it without conditions, and Nuance became part of Microsoft in March 2022. The consequential changes came from the technology.

The turning point was the arrival of large language models, the kind of AI that can read and write fluent text and powers today’s chat assistants. The summarization step, turning a messy conversation into a tidy note, is exactly what those models are good at. In March 2023 Nuance and Microsoft announced DAX Express, built on OpenAI’s GPT-4. Press coverage at the time noted that it dropped the vendor’s human reviewers from the loop. The draft went straight to the clinician.

That change matters for this article’s argument. In 2021, a layer of vendor staff checked drafts before clinicians saw them. After 2023, for the products that followed this model, the clinician was the only check. Everything said above about review, training and audits became more important, not less.

Ambient documentation then moved from pilots toward broad deployment at many health systems between 2023 and 2025. The best-known example came in August 2024, when Kaiser Permanente made Abridge’s ambient tool available across its 40 hospitals and more than 600 medical offices. Kaiser said the tool required patient consent and that clinicians reviewed notes before they entered the record. Those were the governance choices this article describes, made at scale.

The market reshaped itself around that shift. In March 2025 Microsoft folded Dragon Medical One and DAX into a single product it markets as Dragon Copilot, which became available in the United States that spring. Many other ambient scribe vendors entered the market. Epic, the dominant maker of hospital record systems, previewed an AI charting feature in August 2025 and made it broadly available in February 2026. Epic said the feature draws on Microsoft’s ambient technology, running through Azure.

That last detail is an irony the 2021 commentary did not foresee. Microsoft ended up both selling its own ambient product and supplying technology inside the EHR that many of its customers use. A capability that once required a separate specialist vendor is increasingly a feature of the platforms health systems already run.

The evidence on benefits matured, and it was more modest than the marketing. Clinicians generally value the reduced documentation burden. A randomized trial at UCLA Health, published in NEJM AI in late 2025, compared two ambient tools with usual care. It found a modest reduction in note-writing time for one tool, no significant change for the other, and signs of lower burnout with both. Other published studies vary by setting and design. Local measurement still matters. A tool can be good on average and still be a poor fit for a particular specialty, clinic or workflow.

Lawmakers began to touch the edges of the workflow. California’s AB 3030, in force from January 2025, requires a disclaimer when generative AI writes certain patient communications about clinical information. It exempts communications that a licensed provider has read and reviewed. The clinician’s review step, a governance detail in 2021, had become a legal hinge in at least one state.

Consent became a litigation question too. In late 2025 a patient filed a proposed class action against Sharp HealthCare in San Diego County. He alleged that an ambient tool recorded his visit without his consent, contrary to California’s all-party consent law, and that his note stated he had consented when he had not. Those are allegations, not findings, and the case was unresolved when we last checked. The complaint still shows where an unaudited consent process is exposed: in a template that records consent nobody gave.

The governance questions above remain the right ones. Patient notice, audio retention, training rights and clinician review are now routine topics in ambient deployments, and settling them before rollout is cheaper than retrofitting them. An organization that already has a clear retention rule and a review audit can switch or add vendors with confidence; one that does not is renegotiating its basic principles every time.

Concentration remains a live concern as ambient tools become features of a small number of platforms. The practical stance is to enjoy the integration while protecting the exit: know what your data is used for, know what renewal will cost, and know how you would leave. The recording, not the software, is the asset that outlasts any vendor choice, and it deserves to be governed that way.