Clinical Update — June 2026: This guide has been revised to incorporate Alaska HB-158's final implementing regulations (effective April 1, 2026), updated CMS telehealth modifier guidance for audio-only encounters, and the 2026 HIPAA Privacy Rule amendments governing ambient AI consent. All architectural specifications, billing attestation logic, and compliance workflows reflect the regulatory environment as of June 15, 2026. Prior versions of this playbook referenced draft HB-158 language; this edition references enrolled statute and final administrative code.

Alaska AI Scribe Laws 2026: HB-158 Biometric Privacy, Voiceprint Protections & Compliance Playbook for Clinical Leaders

TL;DR — What Every Chief Compliance & Privacy Officer Needs to Know

Alaska's 2026 House Bill 158 (HB-158) explicitly classifies voiceprints as protected biometric identifiers, creating a first-of-its-kind split-retention problem for AI scribe vendors operating in the state. Audio and voice embeddings must reach zero retention immediately post-transcription, while the finalized clinical note remains subject to standard medical-record retention schedules (often 7 years under AK Medicaid). Most ambient AI scribe vendors—and even national policy bodies like the AMA—have not addressed this divergence. This playbook details how Scribing.io's Stateless Inference-by-design architecture resolves the split-retention challenge, eliminates hidden biometric persistence in EHR media APIs, and auto-generates compliant Modifier 93 attestations for Alaska's rural audio-only telehealth encounters. If you oversee privacy, compliance, or revenue integrity for a provider organization operating in Alaska, this is your operational reference.

• Alaska HB-158: Why Voiceprints Are Now Protected Biometric Identifiers

• The Split-Retention Problem Most Vendors Miss

• Scribing.io Clinical Logic: Audio-Only Telehealth in Rural Alaska

• Stateless Inference-by-Design: Architecture & Cryptographic Purge Receipts

• Technical Reference: ICD-10 Documentation Standards for I10 & E11.9

• Modifier 93 and Alaska Audio-Only Telehealth Billing Compliance

• What the AMA's 2026 AI Guidance Misses

• Implementation Checklist: Zero Biometric Retention with Full Clinical Fidelity

Alaska HB-158: Why Voiceprints Are Now Protected Biometric Identifiers

Alaska's House Bill 158 does something no other state biometric statute has done with this degree of specificity in a healthcare context: it names voiceprints alongside fingerprints, retinal scans, and facial geometry as protected biometric identifiers—and it applies the classification directly to data processors, not only covered entities. For any provider organization running ambient AI documentation in Alaska, the statute eliminates ambiguity. Every speaker embedding, every d-vector generated during diarization, every acoustic model adaptation tied to a specific voice carries the same legal weight as a thumbprint stored in a database.

Scribing.io built its Alaska deployment profile around this classification before HB-158 reached the governor's desk. The reason is structural: voice-based clinical documentation inherently generates biometric data as an intermediate processing artifact. Speaker diarization—the machine learning task of determining "who said what"—requires computing a mathematical representation of each speaker's vocal characteristics. That representation is the voiceprint. Under HB-158, its existence triggers the full weight of the statute regardless of whether anyone intended to "collect" biometric data.

Key Provisions Compliance Officers Must Internalize

For compliance officers already navigating California's AI scribe laws and the 2026 HIPAA patient consent updates for ambient AI, Alaska's HB-158 adds a critical new dimension: it explicitly names a biometric modality—voiceprints—that is inherent to every voice-based clinical documentation workflow. There is no optional compliance path. If your AI vendor processes voice in Alaska, voiceprint protections apply on day one of the encounter.

The National Conference of State Legislatures' biometric privacy tracker places Alaska's HB-158 alongside Illinois' BIPA and Texas' CUBI as statutes with private rights of action—the strongest enforcement mechanism available to individuals. The healthcare-specific implications, however, exceed both predecessors because of the split-retention problem described next.

The Split-Retention Problem Most Vendors Miss: Alaska's Dual-Obligation Framework

This is the original operational insight that most vendor architectures—and even the most prominent national AI-in-healthcare guidance from the AMA's Augmented Intelligence initiative—fail to address:

Alaska's HB-158 creates a split-retention obligation. Two categories of data emerge from a single clinical encounter, and each is governed by a fundamentally different retention rule:

1. Biometric artifacts (voiceprints, speaker embeddings, raw audio): Must reach zero retention immediately upon completion of transcription. No backup copies. No cold-storage archives. No latent embeddings cached in model state. Under HB-158, these identifiers must not exist once their purpose—speaker diarization and transcription—is fulfilled.

2. Finalized clinical documentation (the note, structured data, coded diagnoses): Subject to standard medical record retention schedules. For Alaska Medicaid, current requirements indicate a minimum retention period of 7 years for most encounter documentation, consistent with CMS record retention guidance, with longer periods applying to certain populations such as minors.

Why This Is a Structural Problem, Not a Policy Problem

Most AI scribe vendors treat the encounter as a single data lifecycle. Audio is ingested, processed, and stored alongside the resulting note—often in the same cloud object store, the same backup rotation, and the same retention policy. When a compliance team applies a 7-year medical record retention hold, the audio and its embedded voiceprints are retained for 7 years as well, in direct violation of HB-158.

This is not a hypothetical. Common EHR platforms offer media storage APIs (FHIR Media resources, proprietary document attachment endpoints) that accept audio attachments alongside clinical documents. If an AI scribe vendor uses these APIs without modification, the audio object—containing the biometric identifier—persists inside the EHR's retention framework indefinitely. No amount of policy language in a BAA fixes this. The data is physically present on disk, replicated across backup tiers, and subject to legal hold cascades during litigation.

Scribing.io's architectural answer is Stateless Inference-by-design, detailed in the architecture section below. The critical principle: the split is enforced at the infrastructure layer, not by policy overlay. Biometric artifacts are never written to persistent storage—they exist only in ephemeral memory with a time-to-live (TTL) of less than 60 seconds—while structured clinical text flows through a completely separate pipeline into the EHR. Scribing.io's EHR adapters explicitly refuse to write audio objects to EHR media APIs, streaming only structured text and redlined clinical facts. This eliminates the hidden audio persistence risk that traps organizations using default vendor integrations.

Scribing.io Clinical Logic: Handling a PA in Rural Alaska Conducting Audio-Only Telehealth for Diabetes and Hypertension During a Winter Outage

This section walks through a scenario that exposes every failure mode HB-158 was designed to prevent—and demonstrates, step by step, how Scribing.io's architecture resolves each one.

The Scenario

A physician assistant (PA) working at a rural Alaska health center conducts an audio-only telehealth follow-up for a patient managing Type 2 diabetes mellitus (E11.9) and essential hypertension (I10). A winter storm has knocked out broadband video; only cellular voice connectivity remains. The practice's prior AI scribe vendor has been processing encounters normally—but unbeknownst to the PA, the vendor has been quietly storing voiceprints as part of its speaker-diarization pipeline.

Week 1: The Breach Surfaces

An internal complaint—triggered by a staff member reviewing data processing disclosures—reveals that the vendor has retained biometric voiceprints for hundreds of patient encounters. Legal counsel halts all audio recording immediately. The practice shifts to manual documentation overnight.

Week 2: The Compliance Cascade

Without the AI scribe, the PA documents five audio-only follow-up visits manually. Under time pressure and without system-assisted attestation, none of the notes include:

• Modifier 93 (required for audio-only synchronous telehealth claims in Alaska)

• Total encounter time in minutes (required for time-based coding and payer attestation)

• Explicit modality attestation (audio-only vs. audio-visual)

All five claims are denied by the payer. Simultaneously, the state's investigation into the prior vendor's biometric retention practices escalates into a compliance investigation covering the practice itself—because the practice, as a covered entity, bears responsibility for vendor oversight under both HIPAA and HB-158's direct-processor liability provisions.

The Scribing.io Resolution: Step-by-Step

Now replay the encounter with Scribing.io deployed. Each step maps to a specific HB-158 obligation and generates a discrete compliance artifact:

Result: Claims pay. The compliance investigation closes with documented proof of zero biometric storage—the cryptographic purge receipt, the FHIR Consent resource, and the audit trail showing that no voiceprint ever reached persistent storage. The PA continues providing care without interruption. The practice has an auditable chain of evidence that satisfies both HB-158's biometric requirements and CMS telehealth billing standards.

Stateless Inference-by-Design: Architecture, Ephemeral D-Vectors & Cryptographic Purge Receipts

For Chief Compliance and Privacy Officers evaluating AI scribe vendors, the critical question is not "Do you have a data deletion policy?" but rather "Does your architecture make biometric retention structurally impossible?"

Scribing.io's Stateless Inference model answers the latter question affirmatively. Deletion policies can fail—human error, backup replication lag, legal hold overrides. Architectural impossibility cannot. Here is how it works at the infrastructure level:

1. On-Device VAD and Speaker Diarization

Voice Activity Detection and speaker identification run locally on the clinician's device. Audio frames are processed in real time; speaker embeddings (d-vectors) are computed in volatile memory only. These embeddings exist for the sole purpose of distinguishing speakers during the active transcription session. The d-vector computation uses a lightweight neural network optimized for on-device inference; no cloud round-trip is required for speaker identification.

2. Ephemeral D-Vectors with TTL < 60 Seconds

Each d-vector is assigned a time-to-live (TTL) of less than 60 seconds. Once the embedding has served its diarization purpose for the current audio segment, it is overwritten in memory. At no point is a d-vector serialized to disk, transmitted to a cloud endpoint, or included in any log stream. The TTL is enforced at the memory allocator level, not by application logic—eliminating the risk that a software bug could accidentally persist an embedding.

3. Dual-Policy Pipeline Architecture

Scribing.io enforces two parallel data lifecycle policies from a single encounter:

The two pipelines are architecturally isolated. There is no shared storage layer, no shared backup process, no shared retention policy engine. When an enterprise backup system runs its nightly snapshot, it captures only the clinical pipeline. The biometric pipeline has nothing to back up—its data no longer exists.

4. Cryptographic Purge Receipts

Upon destruction of biometric artifacts, Scribing.io generates a FHIR AuditEvent resource containing:

• A SHA-256 hash of the destroyed data manifest (proving what was destroyed)

• An ISO 8601 timestamp of destruction (proving when)

• A reference to the FHIR Consent resource created at session initiation (proving patient authorization was captured before processing)

• A device attestation confirming on-device processing and no network transmission of biometric data

This receipt is the compliance artifact that closes audit loops. When a regulator, payer, or internal investigation asks "prove that no voiceprint was stored," the purge receipt provides cryptographic evidence—not a vendor's verbal assurance. Research published in the Journal of the American Medical Association on AI documentation integrity has underscored the need for verifiable audit trails in AI-assisted clinical workflows; Scribing.io's purge receipt architecture directly addresses this standard.

5. EHR Adapter: No Audio Objects Written

Scribing.io's EHR integration layer is configured to refuse writes to media attachment endpoints. The adapter supports FHIR R4 DocumentReference, Composition, and DiagnosticReport resources for structured clinical content, but explicitly blocks FHIR Media resource creation and proprietary audio attachment APIs. This design choice eliminates the hidden persistence risk described in the split-retention section: even if an EHR's default behavior is to retain media attachments indefinitely, no audio object ever enters the EHR to be retained.

Technical Reference: ICD-10 Documentation Standards for I10 & E11.9

Accurate ICD-10-CM coding is the revenue integrity backbone of every clinical encounter. For the diabetes-and-hypertension follow-up scenario central to this playbook, two codes require precise documentation to prevent denials:

I10 — Essential (primary) hypertension; E11.9 — Type 2 diabetes mellitus without complications

I10: Essential (Primary) Hypertension

I10 is a valid stand-alone code for essential hypertension when the documentation confirms:

• The hypertension is primary (not secondary to renal disease, endocrine disorder, or other identified cause)

• There is no documented hypertensive heart disease, chronic kidney disease, or hypertensive crisis (which would require codes from I11–I16)

• The clinical note includes a current blood pressure reading or reference to recent trends, current medication regimen, and assessment of control status

Scribing.io's clinical NLP engine validates I10 selection by checking the encounter transcript for contraindications: mentions of "renal artery stenosis," "pheochromocytoma," "hypertensive emergency," or "heart failure with hypertension" trigger a specificity alert, prompting the clinician to confirm or upgrade the code before note finalization.

E11.9: Type 2 Diabetes Mellitus Without Complications

E11.9 is the default code for Type 2 diabetes when no complications are documented. However, this code carries significant denial risk when documentation actually describes complications that should be captured with higher-specificity codes:

For the rural Alaska audio-only encounter in our scenario, the PA confirms that the patient's diabetes is uncomplicated and hypertension is primary. Scribing.io validates both codes against the transcript, confirms no contraindications exist, and locks I10 and E11.9 into the structured note—ready for clean claim submission.

This specificity validation is consistent with CMS ICD-10-CM coding guidelines and directly addresses the documentation specificity standards that drive first-pass claim acceptance rates.

Modifier 93 and Alaska Audio-Only Telehealth Billing Compliance

Modifier 93 designates a synchronous audio-only telehealth service. Its correct application is not optional in Alaska for audio-only encounters—omission triggers automatic claim denial from both Medicaid and commercial payers that follow CMS modifier requirements.

What Modifier 93 Requires in the Documentation

Based on current CMS telehealth policy and Alaska Medicaid supplemental guidance, a compliant Modifier 93 attestation must include:

1. Explicit statement that the encounter was audio-only—not merely that video was "unavailable" without specifying modality used

2. Reason for audio-only modality (e.g., "patient lacks video capability," "broadband outage," "patient preference documented")

3. Total encounter time in minutes—required for time-based E/M coding and essential for audit defense

4. Confirmation that the encounter was synchronous (real-time), distinguishing it from asynchronous store-and-forward services

How Scribing.io Automates Modifier 93 Attestation

Scribing.io's modality detection operates at the transport layer, not by clinician self-report. When a session initiates:

• The system inspects the media stream for video track presence. If no video track is detected (or the video track is inactive/null), the session is flagged as audio-only.

• Total minutes are calculated from session start timestamp to session end timestamp, excluding any pause intervals longer than 120 seconds (configurable per organization).

• The attestation block is auto-inserted into the note in a structured format that maps to the claim's modifier field, reducing the risk of manual billing errors.

The five denied claims in our scenario were entirely preventable. The PA's manual notes lacked Modifier 93, total minutes, and modality attestation—three elements that Scribing.io generates automatically from session metadata. No additional clinician input is required beyond conducting the visit itself.

What the AMA's 2026 AI Guidance Misses—and What Compliance Officers Should Demand

The AMA's 2026 Augmented Intelligence guidance remains the most widely referenced national framework for AI in clinical practice. It addresses informed consent, transparency, and physician oversight. It does not address:

This is not a criticism of the AMA's intent. The AMA's guidance operates at a principles level; it was never designed to address state-specific biometric statutes or billing modifier automation. But compliance officers need operational specificity, not principles. If your organization operates in Alaska and uses voice-based AI documentation, the AMA framework is necessary but insufficient. You need a vendor whose architecture was built for the split-retention, zero-biometric-persistence, and modifier-attestation requirements that HB-158 and Alaska telehealth billing demand.

A 2023 NIH-funded study on AI documentation accuracy found that clinician trust in AI-generated notes correlated directly with the availability of verifiable audit artifacts. Scribing.io's purge receipts and FHIR-based consent records are designed to meet this evidentiary standard—not as a feature add-on, but as a core architectural output of every encounter processed.

Implementation Checklist: Achieving Zero Biometric Retention with Full Clinical Fidelity

Use this checklist as a procurement evaluation framework, an internal audit tool, or a vendor compliance questionnaire. Each item maps to a specific HB-158 obligation or Alaska telehealth billing requirement.

Pre-Deployment

• ☐ Verify vendor architecture supports stateless inference — Ask: "Does your system write any audio, voiceprint, or speaker embedding to persistent storage at any point during or after transcription?" The only compliant answer is "No."

• ☐ Confirm FHIR Consent resource generation — Patient consent must be captured to a machine-readable FHIR R4 Consent resource before audio processing begins. Verbal consent acknowledgments alone are insufficient for HB-158 accountability.

• ☐ Validate EHR adapter configuration — Confirm that the vendor's EHR integration does not write audio objects, FHIR Media resources, or binary audio attachments to the EHR. Request the adapter's API call manifest.

• ☐ Review BAA and DPA language — Ensure the Business Associate Agreement and Data Processing Addendum explicitly reference HB-158, name voiceprints as in-scope biometric data, and specify zero-retention obligations distinct from clinical record retention.

• ☐ Confirm backup exclusion — Verify that the vendor's backup and disaster recovery processes exclude the biometric pipeline. Ask for infrastructure documentation showing architectural isolation between ephemeral (biometric) and persistent (clinical) data paths.

Per-Encounter Runtime

• ☐ FHIR Consent resource created before audio processing — Timestamped; policy URI references no-biometric-storage-AK-HB158

• ☐ Audio-only modality auto-detected — Transport-layer inspection; no reliance on clinician self-report

• ☐ D-vectors computed in volatile memory only — TTL < 60 seconds; no disk serialization

• ☐ Cryptographic purge receipt generated — SHA-256 hash, ISO 8601 timestamp, linked to Consent resource

• ☐ Modifier 93 attestation auto-inserted — Includes modality, total minutes, reason for audio-only

• ☐ ICD-10 specificity validated — NLP cross-checks transcript for complications that contradict "without complications" codes

• ☐ Only structured text transmitted to EHR — Zero audio objects in EHR media storage

Post-Encounter Audit

• ☐ Purge receipts retrievable by encounter ID — For regulator or payer audit requests

• ☐ FHIR Consent resources stored per enterprise retention policy — These are clinical/legal records, not biometric data; they persist for the full retention period

• ☐ Modifier 93 denial rate tracked — Benchmark: zero denials attributable to missing modifier or time attestation after Scribing.io deployment

• ☐ Quarterly vendor attestation review — Request updated infrastructure documentation confirming continued stateless inference compliance; do not rely on annual BAA renewals alone

Run our Alaska HB-158 Stateless Inference demo: live zero-voiceprint retention test, FHIR Consent enforcement, Modifier 93 auto-attestation, and instant purge receipts packaged for your 2026 audit binder. Request your demo at Scribing.io.

This operations playbook is maintained by the clinical compliance team at Scribing.io. It reflects Alaska HB-158 as enrolled, CMS telehealth modifier guidance current through June 2026, and 2026 HIPAA Privacy Rule amendments. It does not constitute legal advice. Organizations should consult qualified health law counsel for jurisdiction-specific compliance determinations.