The Patient Records Act and the Patient Records Regulations

The Health Personnel Act regulates the processing of health data necessary to provide, administer, and quality assure healthcare. The Medical Records Regulation supplements the law with requirements for, among other things, the content, organization, signing, and access control of the record. The regulations apply regardless of whether the documentation is written manually, dictated with speech recognition, or prepared with support from artificial intelligence.

It is useful to distinguish between traditional speech recognition, where healthcare personnel dictate text, and «speech-to-draft,» where a patient conversation is recorded, converted to text, and processed by artificial intelligence into a draft medical record note. The latter workflow may include audio recording, raw transcription, AI-generated draft, and the final medical record note. All steps must be handled with proper information security and clear management of access, storage, and deletion.

The regulations neither require nor generally prohibit the use of artificial intelligence in medical record-keeping. The AI output must be treated as a draft. The healthcare professional providing the care remains responsible for ensuring that the approved medical record note is relevant, necessary, comprehensible, and linked to the correct patient. The draft must be checked against what was actually said, observed, and assessed. Particularly important check points are negations, medications and dosages, allergies, test results, appointments, and who said what.

The business must choose a tool that is suitable for healthcare and approved for the processing of health data. Patient data should not be entered into open, general AI services that the business has not evaluated and approved. If the tool has a medical purpose, the business must also assess whether it is covered by the regulations for medical devices.

Access must be justified by an operational need, and the entity must be able to control who has had access to the information. From July 1, 2026, central requirements for documentation and logging upon making health data available are governed by Section 22 a of the Patient Records Act.

The Norwegian Directorate of Health's guidance on speech-to-draft recommends that audio recordings, raw transcriptions, and AI drafts be deleted no later than when the verified medical record note is approved. If a recording is to be used or retained as independent documentation, the entity must specifically assess this in accordance with the regulations governing medical records.

According to the same guidance, separate consent is normally not required simply because speech-to-text is used as an aid in medical record-keeping. The patient should nevertheless be informed about the recording and the use of AI, and healthcare personnel should be able to document in the usual manner if the patient does not wish the solution to be used. Other purposes, reuse, or storage of the recording may require a different assessment.

The Patient Records Act regulates the processing of health data in connection with healthcare and sets requirements for, among other things, purposes, duty of confidentiality, access, and information security. The Patient Records Regulations supplement the requirements for the content, organization, signing, and access control of the record. These requirements also apply when speech recognition or AI is part of the workflow.

Speech recognition and AI can streamline medical record-keeping, but can also introduce errors, omit clinical context, or place information on the wrong patient. Healthcare personnel must therefore check and approve the result before it is included in the medical record. At the same time, the organization must manage the entire information flow, including recordings, transcriptions, drafts, vendor access, logging, and deletion.