PointClickCare AI Charting: Is It HIPAA Compliant?

PointClickCare offers native AI-enabled products, including Ambient Scribe for its EHR for Practice Groups and Chart Advisor for skilled nursing documentation workflows (^[1]) (^[2]). PointClickCare also publishes a U.S. Business Associate Agreement and security-assurance information (^[3]). Those materials support vendor diligence, but they do not establish that every named AI feature, subprocessor, data flow, or audit report is automatically within the same scope. A facility should verify the order form, service description, BAA, subprocessor terms, security documentation, and configuration for the specific product before placing PHI in it. Certifications and attestations are evidence about controls within their defined scope; they are not by themselves a declaration that a deployment is HIPAA compliant.

The documentation burden driving this AI adoption is well quantified. Nursing staff in long-term care spend up to roughly 30% of their working time on documentation tasks, according to a 2026 peer-reviewed study in the Journal of Medical Internet Research (JMIR), and the American Association of Critical-Care Nurses (AACN) cites the U.S. Surgeon General's Advisory finding that nurses spend "about 40% of their shift performing documentation" (^[4]) (^[5]). Separately, 79% of acute care nurses report losing time to unproductive charting according to a KLAS Research Arch Collaborative report surveying 80,147 nurses between September 2022 and September 2025 (^[6]). A controlled pre-post time-motion study of 52 nurses across 14 German long-term care facilities found an AI speech assistant cut documentation time per shift by an adjusted 28% relative to baseline, and PointClickCare's own early adopters report saving about five minutes per note, which adds up to over two hours across a 25-patient day (^[7]). The AI clinical documentation market itself was valued at approximately $1.23 billion in 2025 and is projected to reach $12.78 billion by 2035, a compound annual growth rate (CAGR) of 26.41%, according to SNS Insider (^[8]).

A sound diligence review should examine three separate layers: the PointClickCare agreement and BAA applicable to the purchased service; the security reports and certifications made available for the relevant environment and scope; and any third-party integration’s independent contractual and technical controls. PointClickCare’s public BAA uses broad service language, but customers should confirm in writing that each selected native AI product and its data flows are included. Marketplace partners and custom applications may create separate business-associate or subcontractor relationships and require their own written assurances under HHS guidance (^[9]).

Regulatory context is shifting under operators' feet. The HIPAA Security Rule's first substantial update in 13 years has been delayed a year, with a final rule now expected around July 2027, while a companion Privacy Rule update is targeted for August 2026 (^[10]). Separately, the Office of the National Coordinator for Health Information Technology's (ONC) HTI-1 rule now requires algorithm transparency disclosures when a particular AI function qualifies as a predictive decision-support intervention and is supplied as part of the applicable certified Health IT Module (^[11]). For operators evaluating AI charting on PointClickCare, the practical answer is that the platform's own tools can be deployed in a HIPAA-compliant manner, but every layer added on top, from third-party scribes to custom FHIR integrations, requires its own diligence, its own BAA, and its own verification that consent, retention, and audit controls match a senior-care population's heightened vulnerability, a standard the Centers for Medicare & Medicaid Services (CMS) enforces through its nursing home survey process regardless of which vendor's software generates the chart entry (^[12]).

PointClickCare, founded in 1995 and headquartered in Toronto with major operations across the United States, is the largest and most widely used EHR platform for long-term and post-acute care, described in its own March 2026 materials as trusted by over 30,000 provider organizations (^[13]) (^[14]). The company's investor history includes a strategic minority investment from Hellman & Friedman alongside existing investor Dragoneer Investment Group, a deal reported to have valued PointClickCare at approximately $4 billion USD, with founders Mike and David Wessinger continuing to control and operate the company; sources indicated that JMI Equity, other individual investors, and employees sold between $600 million and $800 million USD of stock as part of the recapitalization (^[15]) (^[16]) (^[17]). As of July 2025, there were 14,742 nursing facilities certified by CMS in the United States, housing about 1.24 million residents and receiving, on average, 9.5 deficiencies over the course of a survey cycle, according to KFF (formerly the Kaiser Family Foundation) (^[18]) (^[19]); those same facilities receive, on average, about 3.85 hours of nursing care per resident per day, down from 4.13 hours in July 2015, a roughly 7% decline in nursing intensity over the decade that forms the staffing baseline against which any AI time-savings claim should be weighed (^[20]) (^[21]). A large share of these facilities run some or all of their clinical, financial, and regulatory workflows through PointClickCare, and the platform's developer documentation states it supports more than 15,000 providers across the care continuum, while the same developer portal separately cites over 21,000 long-term and post-acute care customers with no upfront integration fees and self-serve access, and describes its Amplify partner program as offering "immediate access to developer tools, sandboxes, sales and marketing support, and Cures Act and proprietary APIs," a discrepancy in customer counts that likely reflects different counting methodologies (facility versus organization versus customer account) rather than a factual error (^[22]) (^[23]) (^[24]) (^[25]).

Skilled nursing documentation is unusually demanding, and it sits inside a federal survey regime: CMS conducts nursing home surveys "in accordance with survey protocols and Federal requirements to determine whether a citation of non-compliance" is appropriate, under consolidated requirements for participation first published in 1989 and substantially revised effective November 28, 2016 (^[12]) (^[26]). Nurses must complete progress notes, incident reports, Minimum Data Set (MDS) assessments for the Patient-Driven Payment Model (PDPM), interdisciplinary care plans, and survey-ready records, often while managing a high resident census with persistent staffing shortages. Chart Advisor, one of PointClickCare's AI products, cites that 87% of facilities face moderate to high staffing shortages, a context that has made administrative automation a financial and operational priority rather than a convenience (^[27]). Against that backdrop, PointClickCare unveiled Chart Advisor in limited availability on October 20, 2025 at the AHCA/NCAL (American Health Care Association/National Center for Assisted Living) Convention & Expo, its first named AI-powered risk management product, an event PointClickCare also used to unveil a refreshed corporate brand identity, and followed with a native Ambient Scribe embedded in its next-generation EHR for Practice Groups launched March 19, 2026 (^[28]) (^[29]).

The question "is PointClickCare AI charting HIPAA compliant" is really three overlapping questions: whether PointClickCare itself, as a business associate, meets HIPAA's contractual and technical requirements; whether specific AI features (Ambient Scribe, Chart Advisor, and the rest of the Advisor suite) inherit that compliance; and whether third-party AI scribes and custom applications that connect through PointClickCare's marketplace or FHIR API carry their own, separate compliance obligations. This report addresses all three, drawing on PointClickCare's own BAA and Trust Center disclosures, HIPAA guidance from the U.S. Department of Health and Human Services (HHS), peer-reviewed and industry research on AI documentation in long-term care, and named vendor and case examples. This is an explainer for operators, IT and compliance leaders, and long-term care investors evaluating AI charting tools, not a marketing document for any single vendor.

As a life-sciences and AI advisory firm working adjacent to regulated healthcare technology, IntuitionLabs approaches this question from a governance and integration perspective rather than as a software provider: the firm notes that regulatory compliance and enterprise data security are baseline requirements for any AI deployment in a regulated care setting, not differentiators, a framing consistent with how PointClickCare, HHS, and ONC each treat AI transparency and safeguards as prerequisites rather than optional features (^[30]). IntuitionLabs describes its own work as requiring that it "understand the unique regulatory landscape, data complexities, and business drivers of the life sciences sector," a posture equally applicable to evaluating third-party AI tools layered onto a regulated EHR like PointClickCare, and one the firm pairs with its role as an official Veeva Vault CRM X-Pages partner based in San Jose, California, serving regulated life-sciences clients globally (^[31]) (^[32]) (^[33]).

"AI charting" on PointClickCare is not one product; it spans at least four distinct categories, each with a different HIPAA compliance posture.

• Native ambient documentation: PointClickCare describes Ambient Scribe as embedded in its next-generation EHR for Practice Groups. Native branding and technical integration can simplify procurement, but they do not prove the absence of subprocessors or eliminate the need to verify the applicable service terms, BAA scope, data flows, retention, and security controls (^[1]).
• Native risk and revenue AI (the Advisor suite): Chart Advisor surfaces undocumented risk events (such as unreported falls) for compliance and survey-readiness purposes, while Referral Advisor scores referrals, Billing Advisor maps billing codes and captures missed charges, and MDS Advisor supports PDPM accuracy; these are analytical layers over existing PointClickCare data rather than new PHI collection points (^[34]).
• Third-party ambient scribes distributed through the Marketplace: independent software vendors such as RevMaxx connect via PointClickCare's direct API and write structured notes, including International Classification of Diseases, 10th Revision (ICD-10), Current Procedural Terminology (CPT), Evaluation and Management (E/M), and Hierarchical Condition Category (HCC) codes, back into PointClickCare's progress notes, assessments, and care plans (^[35]). The required BAA path depends on the vendor's role: a vendor acting directly for the covered entity may need a BAA with that entity, while a vendor acting as PointClickCare's subcontractor must be bound through the business-associate chain. The facility should document the actual data flow and contract path rather than assume Marketplace listing alone establishes coverage.
• Custom applications built on the PointClickCare FHIR API: developers register SMART on FHIR (Substitutable Medical Applications and Reusable Technologies) applications through the USCDI (United States Core Data for Interoperability) Connector program, at a flat fee of $65 per app per facility per month, to build patient-facing, provider-facing, or bulk data applications, including custom AI tools not distributed through the Marketplace (^[36]).

For a native PointClickCare AI feature, PointClickCare may be the customer-facing business associate under the applicable agreement, but public product pages do not prove that it is the sole party processing PHI. Customers should review the product’s subprocessor and service documentation. A third-party scribe or custom application may be a separate business associate or a subcontractor, and HHS requires written assurances to flow down to subcontractors that handle PHI on a business associate’s behalf (^[9]).

PointClickCare's AI-powered risk management product, Chart Advisor, entered limited availability on October 20, 2025, alongside a company-wide brand refresh unveiled at the AHCA/NCAL Convention & Expo in Las Vegas. The product's stated purpose is compliance-adjacent: it surfaces potential risk events in real time, such as undocumented falls, so that clinical leaders can "maintain defensible documentation" and "stay survey-ready with confidence" (^[37]). PointClickCare Chief Executive Officer Dave Wessinger described it as "a game changer for skilled nursing facilities facing increasing scrutiny and risk from survey penalties and litigation," framing the tool explicitly around regulatory exposure rather than pure efficiency (^[38]). An early customer, Lisa Daniell, Vice President of Clinical Services at Paramount Healthcare Consultants, LLC, reported that "Chart Advisor has made tracking and documenting incidents so much easier," citing improved follow-up completeness and time savings (^[39]).

Roughly five months later, PointClickCare launched its next-generation EHR for Practice Groups on March 19, 2026, introducing a native Ambient Scribe through what the company describes as bi-directional data exchange between practice groups and facilities. PointClickCare's Chief Medical Officer of Senior Care, Dr. Steve Buslovich, said the company was "reducing documentation burden, improving clinical prioritization, and enabling faster" decision-making by "embedding AI capabilities like Ambient Scribe, AI-generated patient summaries, and clinical risk insights directly into practitioner workflows" (^[40]). A named early adopter, Dr. Wesam Moustafa Hussein, Chief Medical Officer at Alliance Medical Team, reported saving five minutes per note, and said "after-hours documentation has dropped significantly" since adoption, a claim discussed further in the Data Analysis section below.

Industry analysis of the native stack, published by AI scribe vendor Sully.ai in a competitive comparison, summarized the offering plainly: "PointClickCare now ships its own AI, a native Ambient Scribe plus an Advisor suite," noting the suite includes Chart Advisor for documentation gaps, Referral Advisor for referral scoring, Billing Advisor for charge capture and code mapping, and MDS Advisor for PDPM accuracy, as cited in the taxonomy above. Because this content is published by a competing scribe vendor with a commercial interest in differentiating its own product, its characterization of PointClickCare's scope (clinical and revenue-cycle tooling, without patient-facing reception or triage, and confined to PointClickCare's own EHR) should be read as a competitor's framing rather than an independent audit, even though the underlying factual description of the native features is corroborated by PointClickCare's own press materials.

Native integration may reduce workflow and integration complexity, but it does not answer the legal scope questions by itself. Before enabling Ambient Scribe or an Advisor product with PHI, a customer should confirm that the exact service is covered by its executed agreement and BAA, identify relevant subprocessors, and obtain assurance documents whose system boundaries include that service. PointClickCare’s published SOC and HITRUST materials should be read according to their stated scope rather than assumed to extend automatically to every AI feature.

PointClickCare publishes a Business Associate Agreement that applies to agreements for services involving PHI and describes safeguards and breach-reporting duties (^[41]). That broad language is relevant evidence, but the public document alone does not establish the technical boundaries, subprocessors, or assurance-report scope of every AI product. Customers should confirm that the executed BAA and service order cover the selected feature and should review the corresponding product-specific security documentation.

A clause with particular relevance to AI features is Section 6, which grants PointClickCare "a non-exclusive, perpetual, irrevocable, worldwide, royalty-free, fully paid-up, sublicensable... right and license to copy, distribute, display, create derivative works of, and otherwise use and commercialize the De-Identified Data" derived from a covered entity's PHI (^[42]). De-identified data, once properly stripped of identifiers under 45 C.F.R. §§ 164.502(d) and 164.514(a) through (c), falls outside HIPAA's PHI definition, so this clause is not itself a compliance gap, but it is directly relevant to AI charting because de-identified documentation data is a plausible training or benchmarking input for future PointClickCare AI features, and covered entities should understand that their aggregated, de-identified charting data can be commercialized under the BAA's current terms. Disputes under the BAA are also resolved through "mandatory binding arbitration under JAMS rules" in New York, rather than litigation, which affects how a facility would pursue a claim if an AI feature caused a documented HIPAA violation (^[43]).

Independent of the contractual BAA, PointClickCare publishes a Trust Center that lists its core Senior Care EHR Solution as handling "Protected Health Information, Personally Identifiable Information" and holding "Certifications: SOC 2 Type 2, SOC 1 Type 2," alongside badges for HITRUST, NIST Cybersecurity Framework (NIST CSF), a dedicated HIPAA and HITECH (Health Information Technology for Economic and Clinical Health Act) Security Overview document, Payment Card Industry (PCI) compliance, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Health Information Protection Act (PHIPA) (^[44]). The Trust Center's own compliance checklist additionally confirms that PointClickCare has a formal mobile device management (MDM) program, undergoes annual third-party penetration testing, maintains a disaster recovery plan, and uses a centralized identity and access management (IAM) solution for single sign-on across its workforce (^[45]). Table 1 below summarizes the third-party attestations relevant to a HIPAA compliance evaluation.

Table 1: PointClickCare's Third-Party Security Attestations Relevant to AI Charting Buyers

Attestation	What It Independently Verifies	Relevance to AI Charting Compliance
SOC 2 Type II	Ongoing operating effectiveness of security, availability, and confidentiality controls over a review period, audited by a third party.	Supports reliance only for products, systems, and AI-related data flows expressly included in the report’s scope; customers should inspect the current report and its boundaries ([46]).
SOC 1 Type II	Controls relevant to financial reporting, applicable given PointClickCare's billing and revenue-cycle functions, including Billing Advisor.	Relevant where AI charting outputs (for example, Billing Advisor's charge capture) feed into billing and reimbursement.
HITRUST	A healthcare-specific control framework that maps to HIPAA, NIST, and other standards; applied to PointClickCare's Collective Platform (Acute and Payer, or A&P).	Signals a healthcare-sector-specific control baseline beyond generic SOC frameworks ([47]).
NIST CSF	Alignment with the National Institute of Standards and Technology's Cybersecurity Framework for identifying, protecting against, detecting, responding to, and recovering from cyber risk.	Provides a recognized benchmark for evaluating whether AI features introduce new attack surface.
Dedicated HIPAA and HITECH Security Overview document	A PointClickCare-authored summary of its HIPAA and HITECH safeguards, available to prospective and current customers through the Trust Center.	Direct, first-party documentation buyers can request during procurement of any PointClickCare AI feature.
Annual third-party penetration testing and cyber insurance (per Trust Center Quick Summary)	Independent testing of exploitable vulnerabilities and financial coverage in the event of a breach.	Reduces, but does not eliminate, the residual risk that AI features expand the attack surface (see the November 2024 breach discussed in Case Studies).

The table shows that PointClickCare's compliance evidence is layered: contractual (the BAA), audited (SOC 1/2, HITRUST), and self-published (the Trust Center's HIPAA overview document). No single artifact is sufficient on its own; a facility's compliance and IT teams should request and review the BAA, the current SOC 2 report, and the HIPAA and HITECH Security Overview as part of any AI charting procurement, rather than relying on marketing claims alone. It is also worth noting that CMS's own nursing home survey guidance treats electronic documentation as a HIPAA-governed activity distinct from the underlying medical records rule: under Federal Tag F842, "facilities using electronic documentation formats are required to be compliant with HIPAA rules, as well as ensuring the data is backed up and kept secure," and surveyors are separately instructed "to observe if computer screens are left unattended and open, allowing unauthorized access to patient health information," a workflow risk that AI ambient listening tools do not eliminate (^[48]) (^[49]). The same interpretive guidance permits release of resident-identifiable information only under specific allowable circumstances, including "for payment purposes" and "for treatment or health care operations," categories that AI vendors processing PHI on a facility's behalf must fit within (^[50]).

PointClickCare's Marketplace lists more than 375 connected partners across more than 20 integration categories, reaching over 14,000 facilities with active integrations, promotes "fast, secure, validated API-based connections where you can easily connect your current solutions in two days or less," and states that "Marketplace empowers people to work with people," connecting caregivers, residents, and families through integrated partner solutions (^[51]) (^[52]) (^[53]) (^[54]). Several of these partners are AI charting vendors. RevMaxx, a company that frames itself around the premise that "Skilled Nursing Facilities (SNF) are the backbone of long-term and post-acute care in the U.S.," is a Marketplace-listed physician services solution that states its "ambient transcription capability carefully captures patient-provider conversations during visits and automatically generates accurate clinical notes, including ICD-10, CPT, E/M, and HCC codes in real time" and claims it "generates 95% accurate, structured clinical notes within seconds" (^[55]) (^[35]) (^[56]). RevMaxx's own blog, separate from its Marketplace listing, frames its integration as "a powerful solution to reduce documentation burden, improve accuracy, and transform workflows in SNFs," and states that skilled nursing facility staff "spend up to 55% of their workday on documentation and administrative tasks," a figure it uses to justify its integration, though this specific statistic should be treated as a vendor claim rather than an independently sourced statistic given RevMaxx is a commercial party marketing directly against the problem it quantifies (^[57]) (^[58]).

Flexbone, another PointClickCare-focused vendor, takes a different approach, deploying voice and browser agents that "work inside PointClickCare" for admissions intake, referral capture, and family communication rather than ambient clinical note drafting; it states that "the agents are HIPAA compliant and log into PointClickCare the way your team does," describes its rollout as "forward-deployed engineering" with "no multi-month IT projects," and advertises a four-week implementation timeline with referral capture marketed as running "24/7... so you never miss a hospital discharge window" (^[59]) (^[60]) (^[61]). Sully.ai, a cross-EHR "workforce platform," documents visits, submits claims through an AI coder, and adds patient-facing AI receptionist and triage agents across PointClickCare and more than 20 other EHR systems, positioning itself as broader in scope than either PointClickCare's native tools or single-purpose scribes like RevMaxx (^[62]). Twofold, marketed under the banner "HIPAA Compliant AI Scribe For SNFs," is a separate AI scribe vendor serving skilled nursing facilities that states "all PHI handled by Twofold is encrypted and protected under a signed BAA to support HIPAA compliant skilled nursing workflows," and that its notes can be pasted into "any EHR or facility system" without rebuilding workflows, a lighter-weight integration model than RevMaxx's direct API connection (^[63]) (^[64]) (^[65]). Other vendors serving the skilled nursing and long-term care segment, identified through independent search, include Suki and Freed (cross-EHR ambient scribes), River Records' Stream product, and Lime AI, each marketed with HIPAA-compliance and BAA claims of their own.

Developers who want to build custom applications rather than use a listed Marketplace partner register through PointClickCare's USCDI Connector program and the FHIR API, following the public SMART on FHIR (Substitutable Medical Applications, Reusable Technologies on Fast Healthcare Interoperability Resources) standard. PointClickCare's own documentation states that "customers under PCC's current pricing model will be charged a flat fee of $65 per App per Facility per Month," subject to annual revision, and that production application approval, as opposed to sandbox development access, requires PointClickCare review, with facility-level integration enablement taking "a minimum of 2 weeks" once an app is registered (^[36]). Development apps are auto-approved into a shared FHIR sandbox, while production apps require PointClickCare's approval before they can access live resident data (^[66]). Table 2 compares the primary routes for adding AI charting to a PointClickCare deployment.

Table 2: Routes to AI Charting on PointClickCare, Compared

Route	BAA or Written-Assurance Path (verify each party’s role)	Documents the Visit	Coding/Billing Assist	Patient-Facing Agents	EHR Reach
Native (Ambient Scribe + Advisor suite)	Confirm the executed PointClickCare order and BAA cover the exact feature; identify any subprocessors	Product-specific	Product-specific	Product-specific	PointClickCare-native workflow; verify actual product scope ([2])
Marketplace third-party scribe (for example, RevMaxx)	The vendor, separately from PointClickCare's own BAA	Yes, via API into progress notes and care plans	Limited to code recognition (ICD-10, CPT, E/M, HCC)	No	PointClickCare-focused, some cross-EHR ([35])
Cross-EHR workforce platform (for example, Sully.ai)	The vendor, separately, across every connected EHR	Yes	Yes, including claim submission	Yes, reception and triage	PointClickCare plus 20-plus other EHRs ([62])
Voice/browser automation agents (for example, Flexbone)	The vendor, separately	No (focused on intake, referrals, family calls)	Eligibility and denials automation only	Yes, phone and portal agents	PointClickCare-specific ([59])
Lightweight, EHR-agnostic scribe (for example, Twofold)	The vendor, separately	Yes, notes pasted into any EHR	Limited	No	Any EHR, manual paste ([64])
Custom FHIR/USCDI Connector application	The developing organization, separately, plus PointClickCare's platform-level protections	Depends on app design	Depends on app design	Depends on app design (Patient, Provider, or Bulk app types)	PointClickCare only, at $65 per app per facility per month ([36])

The correct HIPAA analysis is role-based. For every route, identify who receives PHI and whether that party contracts directly with the covered entity or acts as PointClickCare’s business-associate subcontractor. A direct vendor generally needs written assurances from the covered entity; a subcontractor’s assurances flow through the upstream business associate. Native branding does not prove that the executed BAA covers the exact feature or that no subprocessors handle PHI. Review the order, BAA, subprocessor chain, data flows, and assurance-report scope before deployment (^[9]).

Sully.ai's commercially motivated guide recommends a baseline that includes "HIPAA compliance, a signed BAA, encryption and de-identified PHI handling, MFA, SSO, role-based access, and clear retention controls," and also recommends "resident and family consent for recording, and heightened confidentiality for vulnerable populations." That is useful implementation guidance, but it is not a universal statement of law: authorization or consent requirements depend on the data flow, the applicable HIPAA permission, state recording and privacy law, facility policy, the resident's capacity, and any legally authorized representative (^[67]). Based on this guidance, HHS's business associate framework, and PointClickCare's own documented processes, a defensible implementation checklist for facilities evaluating AI charting on PointClickCare includes the following steps.

• Confirm which route applies. Determine whether the desired AI capability is native (Ambient Scribe, Chart Advisor, Referral Advisor, Billing Advisor, MDS Advisor), a Marketplace partner, or a custom FHIR application, since each carries a different BAA and vendor-diligence burden as shown in Table 2.
• Obtain and review the vendor's BAA before any resident audio or PHI flows. For any non-native tool, HHS requires "satisfactory assurances" in writing that the business associate will safeguard PHI and use it only for permitted purposes; a facility should not enable a third-party scribe pending BAA execution (^[68]).
• Request PointClickCare's current SOC 2 Type II report and HIPAA and HITECH Security Overview through the Trust Center as part of procurement, rather than relying on marketing badges alone.
• Verify the authorization, notice, and consent workflow for ambient listening. Determine what HIPAA permits, what applicable state recording and privacy law requires, what facility policy promises, and whether the resident has capacity or a legally authorized representative. Do not assume that both resident and family consent is universally required—or universally sufficient.
• Confirm de-identification and data-use terms in any vendor's BAA, since such terms can permit broad downstream commercialization of aggregated documentation data, as illustrated by the De-Identified Data clause in PointClickCare's own agreement discussed above.
• Validate technical safeguards directly, including multi-factor authentication (MFA), single sign-on (SSO), role-based access controls, encryption in transit and at rest, and automatic screen logoff, given CMS surveyor guidance that flags unattended, unlocked screens as a deficiency risk independent of any AI tool (^[49]).
• Confirm retention alignment with state law and the five-year federal floor. CMS's F842 interpretive guidance requires medical records be retained for the period required by state law, or "five years from the date of discharge" absent a controlling state statute, a standard AI-generated notes must also satisfy (^[69]).
• Pilot on a single high-census unit before facility-wide or portfolio-wide rollout, measuring both time savings and note accuracy against real assessment types, not vendor demonstrations, before scaling.
• Plan for regulatory change. Track the pending HIPAA Security Rule update (currently expected around July 2027) and the HIPAA Privacy Rule update (expected around August 2026), both of which are likely to tighten encryption, MFA, and risk-analysis requirements that apply to any AI vendor touching PHI (^[10]).

These steps reflect the general HIPAA business-associate framework applied to PointClickCare. A native feature may reduce integration complexity, but it does not eliminate contractual review, subprocessor diligence, risk analysis, configuration, or verification that the relevant assurance reports cover the actual data flow.

The quantitative case for AI charting in long-term care rests on a growing, though still uneven, evidence base. The most rigorous study identified for this report is a pre-post time-motion study published in the Journal of Medical Internet Research in 2026, examining the AI speech assistant voize across 14 German long-term care facilities. The study observed 52 registered nurses across 770 observed hours and found that "the observed total documentation time per morning shift decreased significantly by an adjusted mean of 15 (SE 3.36) minutes," which the authors describe as "corresponding to an approximately 28% reduction relative to the baseline mean," a finding statistically significant at P<.001 (^[70]) (^[71]). Secondary findings from the same study reported improved satisfaction with the documentation system alongside significant declines in self-reported interruptions, while overall workplace satisfaction showed no significant change over the roughly eight-week observation window (^[72]).

The broader documentation-burden literature, independent of any AI vendor, supports the scale of the underlying problem. AACN cites the U.S. Surgeon General's Advisory on health worker burnout for the finding that nurses spend, "on average, about 40% of their shift performing documentation," noting that "time spent in documentation has an inverse relationship to time available for direct patient care"; the same AACN case study reports that one health system's own documentation-reduction initiative reduced time spent on documentation "by 15% for ICU nurses and 22% for med-surg nurses," eliminating more than 748 flowsheet fields and netting "an annual increase of 30,000 hours available for direct patient care" (^[5]) (^[73]) (^[74]) (^[75]). A peer-reviewed cross-sectional survey published on PubMed Central found that "documentation burden is defined as the increased effort and time demand to document patient care in the EHR" and reported that "approximately 38% of nurses report experiencing at least one symptom of burnout," with the "average national turnover rate for bedside nurses" having "increased from 16.8% in 2019 to 18.7% in 2021," alongside a statistically significant, if weak-to-moderate, correlation between documentation burden and clinician burnout syndrome (^[76]) (^[77]) (^[78]).

Workforce retention data corroborates the stakes: NCSBN found in its 2024 National Nursing Workforce Study that "large proportions of the RN (40%) and LPN/LVN (41%) workforces still reported plans to leave the profession in the next 5 years," a survey drawing on responses from 744,714 registered nurses and 137,902 licensed practical or vocational nurses, and noted separately that "the median age of RNs was 50 in 2024," an aging workforce dynamic that compounds retention pressure (^[79]) (^[80]) (^[81]).

At larger scale but in acute rather than long-term care, KLAS Research's Arch Collaborative surveyed 80,147 acute care nurses (including inpatient and emergency department settings) between September 2022 and September 2025, corroborating the 79% figure cited above, with the report noting nurses "ask for streamlined or reduced charting twice as much as any other EHR enhancement" and identifying critical care and labor and delivery units as reporting the highest levels of unproductive charting, since "critical care nurses most frequently report losing excessive time to unproductive charting" (^[82]) (^[83]). The same report separately references NCSBN 2024 workforce data indicating that "40% of nurses intend to leave the profession by 2029," a figure consistent with the direct NCSBN survey findings above, framing documentation burden reduction as a retention issue as much as an efficiency one (^[84]). Vendor-reported figures specific to PointClickCare's own users are directionally consistent but smaller in scale: PointClickCare's named early adopter reported roughly five minutes saved per note, extrapolated to over two hours across a 25-patient day, while WellSky, a competing long-term care EHR vendor, reported that a customer using its SkySense AI-powered WellSky Extract tool for medication order entry achieved "an average time savings of more than 30 minutes per admission," with WellSky customer Ayisha Bradley, director of informatics and clinical reimbursement at Care Centers Management Consulting Inc., stating the tool is "giving my nurses valuable time back with their residents" (^[85]) (^[86]).

Market sizing corroborates the trend at the industry level. According to market research firm SNS Insider, "the AI Clinical Documentation Market Size was valued at USD 1.23 Billion in 2025 and is projected to reach USD 12.78 Billion by 2035," a 26.41% CAGR, with the United States segment alone valued at "USD 0.41 Billion in 2025" and projected to reach "USD 3.96 Billion by 2035" (^[8]) (^[87]). North America "held the largest revenue share of 33.12% in the global AI clinical documentation market" as of 2025, and within the market, "Software Solutions held the lion's share of the AI Clinical Documentation Market in 2025 with a share of approximately 57%," a segmentation the report attributes to established electronic health record infrastructure and early ambient AI adoption (^[88]). Table 3 below collects these figures for comparison.

Table 3: Documentation Burden and AI Charting Impact, by Source

Source	Setting and Sample	Key Finding
JMIR/voize study (2026)	52 nurses, 14 German long-term care facilities, 770 observed hours	28% reduction in per-shift documentation time after AI speech assistant adoption ([71])
KLAS Arch Collaborative (2025)	80,147 acute care nurses, September 2022 to September 2025	79% report time lost to unproductive charting ([6])
NCSBN National Nursing Workforce Study (2024)	744,714 RNs and 137,902 LPN/LVNs	40% of RNs report plans to leave the profession within 5 years ([79])
PointClickCare early adopter quote (2026)	Single named physician (Alliance Medical Team), 25-patient day	About 5 minutes saved per note, over 2 hours per day ([7])
WellSky customer report (2026)	Single named long-term care organization, medication order entry	Over 30 minutes saved per admission with AI extraction ([85])
SNS Insider market forecast (2026)	Global and U.S. AI clinical documentation market	USD 1.23 billion (2025) to USD 12.78 billion (2035), 26.41% CAGR ([8])

Reading across the table, the peer-reviewed JMIR figure (28%) and the KLAS survey figure (79% reporting some burden) measure different things (time reduction versus prevalence of the underlying problem) and should not be averaged or treated as interchangeable; the single-organization PointClickCare and WellSky figures are vendor-reported case examples, useful as illustrations but not statistically representative of typical outcomes across a facility's full census. The NCSBN retention figures underscore why the industry treats documentation-burden reduction as urgent regardless of which specific AI tool is used: even a modest, well-verified reduction in charting time is plausible leverage against a workforce in which roughly two in five nurses report considering leaving the profession. Readers should treat any single-customer time-savings claim, including PointClickCare's own, as an anecdote pending broader independent measurement, an important caveat given that no large-sample, peer-reviewed study of PointClickCare's own Ambient Scribe specifically was identified as of this writing.

Paramount Healthcare Consultants and Chart Advisor. Paramount Healthcare Consultants, LLC was among the earliest named users of PointClickCare's Chart Advisor following its October 2025 limited-availability launch. Vice President of Clinical Services Lisa Daniell reported that the tool "made tracking and documenting incidents so much easier," with "everything... in one place" and "follow-up... more complete than ever before," concluding that "every building should have Chart Advisor" (^[39]). This case illustrates the native AI stack's core value proposition: compliance and survey-readiness improvement rather than pure transcription speed. Native delivery does not by itself prove that every data flow is covered by an existing BAA; a facility should verify its executed PointClickCare agreement, applicable order terms, feature scope, and any relevant subprocessors before enabling Chart Advisor.

Alliance Medical Team and native Ambient Scribe. Alliance Medical Team, a physician practice group, adopted PointClickCare's Ambient Scribe as part of the March 2026 EHR for Practice Groups launch. Chief Medical Officer Dr. Wesam Moustafa Hussein's reported five-minute-per-note savings, extrapolated across a 25-patient day, is the most specific quantified outcome PointClickCare has published for its native AI, and it illustrates the physician-facing side of the product, distinct from Chart Advisor's nursing and risk-management focus, as detailed in the Native AI Stack section above.

The voize and Charite study: a peer-reviewed independent case. Unlike the two examples above, the JMIR-published study of the AI speech assistant voize, conducted by researchers at Charite, Universitatsmedizin Berlin, in cooperation with voize GmbH, represents an independently reviewed (rather than vendor-selected) case, spanning 14 German long-term care facilities rather than a single named organization. Though voize does not integrate with PointClickCare specifically, the study is the closest available proxy for what a rigorous, peer-reviewed evaluation of ambient AI charting in long-term care looks like, and its 28% documentation-time reduction, while from a different market, offers an external benchmark against which PointClickCare's own five-minutes-per-note claim can be roughly contextualized, as reported in the Data Analysis section above.

WellSky SkySense AI: a direct competitor's parallel deployment. WellSky, a competing long-term care EHR and community care technology vendor, expanded its SkySense AI capabilities, including WellSky Extract, to long-term care and skilled nursing facilities, announced February 11, 2026, describing the release as "extending artificial intelligence (AI) capabilities to support operational efficiency and clinician productivity across post-acute care settings" and delivering "proven AI capabilities embedded in the EHR" that "deliver measurable efficiency gains while supporting clinician-led care" (^[89]) (^[90]). Customer Ayisha Bradley of Care Centers Management Consulting Inc. is a named, on-the-record case reporting over 30 minutes saved per admission on medication order entry alone, a workflow adjacent to, but distinct from, PointClickCare's Ambient Scribe and Chart Advisor use cases. This case is included precisely because it is not a PointClickCare customer, illustrating that the underlying documentation-burden problem, and the AI response to it, is industry-wide rather than specific to any single EHR vendor.

The November 2024 PointClickCare data breach: a cautionary case. On July 20, 2024, PointClickCare "discovered unusual activity within its EHR platform," and its investigation confirmed that "an unauthorized actor used certain compromised credentials to access, view, and acquire patient information that was stored within the EHR platform." On November 25, 2024, two long-term care facilities, Citadel of Northbrook and Pavilion of Bridgeview (both owned by Omnia Healthcare Group), "filed data breach notices" affecting residents' names, dates of birth, Social Security numbers, Medicare and Medicaid identification numbers, medical information, and health insurance information (^[91]) (^[92]). At the time, legal commentary noted PointClickCare "employs more than 2,000 people and generates approximately $420 million in annual revenue" (^[93]). The cited report describes notices issued by the two facilities and says PointClickCare itself did not appear to have filed a separate official breach notice; distinguish those facility notices from any disclosure by PointClickCare, an information gap worth noting when evaluating vendor transparency during a security incident (^[94]). The breach involved credential compromise rather than any AI charting feature specifically, and it predates PointClickCare's Chart Advisor and Ambient Scribe launches, but it is directly relevant to a HIPAA compliance evaluation of AI charting because AI features increase the number of workflows and, potentially, credentialed accounts touching PHI within the same underlying platform, making the platform's credential- and access-management controls, not just its AI-specific safeguards, central to any risk assessment.

Three regulatory developments will shape how AI charting on PointClickCare is evaluated over the next 18 to 24 months. First, the HIPAA Security Rule, unchanged in substance for 13 years since the 2013 Omnibus Final Rule, is undergoing its first major update, but the Office for Civil Rights (OCR) has pushed the anticipated final rule back a year, "with the final action due in July 2027," after industry groups criticized the original implementation timeline as unworkable (^[95]). The original Notice of Proposed Rulemaking (NPRM) was issued by OCR in December 2024 and published in the Federal Register on January 6, 2025, meaning the rule has already been under active development for well over two years by the time any final version takes effect (^[96]). Proposed elements reported across compliance trade press include mandatory multi-factor authentication, encryption of electronic PHI (ePHI) at rest and in transit, and anti-malware requirements, any of which would raise the technical bar for AI vendors handling voice or text PHI on PointClickCare's platform. Second, and moving faster, a companion HIPAA Privacy Rule update is targeted for an August 2026 final rule release, aimed at strengthening individuals' rights to their PHI and improving care-coordination information sharing, a priority that currently appears to be crowding out the Security Rule timeline within OCR's limited rulemaking capacity (^[97]). Third, ONC's HTI-1 final rule, in effect since 2024, "establishes first of its kind transparency requirements for the artificial intelligence (AI) and other predictive algorithms that are part of certified health IT," and adopted USCDI Version 3 "as the new baseline standard within the ONC Health IT Certification Program... as of January 1, 2026"; because ONC-certified health IT "supports the care delivered by more than 96% of hospitals and 78% of office-based physicians," HTI-1 transparency requirements apply to qualifying predictive decision-support interventions supplied as part of an applicable certified Health IT Module; certification does not automatically place every AI function a vendor offers within that scope. Customers should verify separately whether Ambient Scribe, Chart Advisor, or another named product is part of the relevant certified module before expecting those disclosures (^[11]) (^[98]) (^[99]).

On the survey side, CMS itself is evolving how it enforces documentation and compliance requirements: the agency has been testing a "risk-based survey (RBS) approach that allows consistently higher-quality facilities to receive a more focused survey," which could eventually reward facilities whose AI-assisted documentation demonstrably reduces citations for noncompliance, though CMS notes this approach would apply to a limited subset, "up to 10 percent of nursing homes within a state," and that the survey and certification budget itself "has remained flatlined at $397 million since 2015" even as documentation and oversight demands have grown (^[100]) (^[101]).

Commercially, the pace of PointClickCare's own AI releases (Chart Advisor in October 2025, native Ambient Scribe in March 2026, and AI-informed discharge planning intelligence and other Advisor products since) suggests the company is racing to close the functional gap with cross-EHR workforce platforms like Sully.ai before those platforms establish a durable coverage advantage across LTPAC operators running multiple systems. For operators, the practical effect is a fast-moving vendor landscape in which today's "best fit" recommendation, native versus third-party versus workforce platform, may shift within a single budget cycle as PointClickCare's own Advisor suite matures. Given the projected growth of the AI clinical documentation market to $12.78 billion by 2035, consolidation among smaller point-solution scribes is a plausible medium-term outcome, and facilities that select a narrowly scoped vendor today should weigh integration and switching costs accordingly.

For advisory and integration firms operating adjacent to this market, including consultancies like IntuitionLabs that specialize in regulated life-sciences and healthcare AI deployments rather than selling competing EHR or scribe products, the throughline is that HIPAA compliance, algorithm transparency, and enterprise-grade security are now baseline procurement gates rather than differentiators; a facility's real diligence work lies in verifying that every layer added on top of a compliant core platform, from a third-party scribe's BAA to a custom FHIR application's access scopes, meets the same bar the core platform has already cleared.

Is PointClickCare’s AI charting HIPAA compliant? It can be part of a HIPAA-compliant workflow when the specific product is covered by appropriate agreements and is configured and operated with required safeguards. PointClickCare publishes a BAA and security information, but customers should verify that the purchased AI service, its subprocessors, data flows, retention, and relevant assurance-report scope are covered. The covered entity remains responsible for its own use, access controls, policies, risk analysis, and any applicable consent requirements.

What is a HIPAA-compliant AI scribe for nursing homes, specifically? The vendor’s obligations depend on its role and the applicable data flow. A direct business associate generally must provide written assurances to the facility, while a subcontractor provides them to the upstream business associate. Encryption in transit and at rest, MFA, role-based access, documented retention and deletion practices, and an appropriate ambient-recording workflow are strongly recommended safeguards and common procurement requirements. Under the current Security Rule, MFA is not an explicit universal requirement, and encryption is an addressable implementation specification; HHS has proposed making these controls more prescriptive, but those amendments are not final. Vendor claims about BAAs and encryption are procurement inputs, not proof that a particular deployment is compliant.

Does PointClickCare’s own BAA cover third-party AI scribes added through the Marketplace? Do not assume so. Determine whether the vendor contracts directly with the facility as its business associate or operates as PointClickCare’s subcontractor. In the first case, the facility obtains the vendor’s written assurances; in the second, PointClickCare must obtain equivalent downstream assurances. Verify the actual contract and data flow before the vendor receives PHI (^[9]).

How does PointClickCare's FHIR API relate to AI applications? Developers register SMART on FHIR applications through the USCDI Connector program at $65 per app per facility per month, with production access requiring PointClickCare review and a minimum two-week, per-facility enablement process; this is the pathway for custom AI applications not distributed as a Marketplace listing.

How much documentation burden can AI charting realistically reduce? Peer-reviewed evidence from a comparable long-term care setting (though not PointClickCare specifically) found a 28% reduction in per-shift documentation time, and independent survey data puts baseline nursing documentation time at roughly 30% to 40% of a shift; PointClickCare's own named customer reported roughly five minutes saved per note. Facilities should treat both figures as directional rather than guaranteed and pilot before committing to a facility-wide rollout.

Has PointClickCare had HIPAA-relevant security incidents? Yes. A July 2024 credential-compromise intrusion into PointClickCare's EHR platform led two long-term care facilities to send breach notifications in November 2024, affecting residents' Social Security numbers, Medicare and Medicaid identification numbers, and medical information. This does not mean PointClickCare's AI features are inherently unsafe, but it illustrates that certifications reduce, rather than eliminate, breach risk, and that credential hygiene remains foundational regardless of which AI features a facility enables.

Will new HIPAA rules change AI charting requirements? Likely yes, though the timeline has slipped. The Security Rule update, expected to formalize requirements such as mandatory MFA and encryption, is now targeted for around July 2027, while a Privacy Rule update is expected around August 2026, and ONC's algorithm transparency rules for certified health IT are already in effect.

PointClickCare’s native and partner-enabled AI tools can support compliant workflows, but “HIPAA compliant” is not a blanket product label. It depends on the selected service, executed contracts, actual data flows, subprocessors, security controls, customer configuration, and use. PointClickCare’s public BAA and security materials are starting points for diligence, not proof that every native AI feature lies within every assurance report. Each Marketplace partner or custom application also requires its own role and contractual obligations to be mapped before it receives PHI.

The evidence base for AI charting's benefits is real but still developing. A peer-reviewed, 52-nurse, 14-facility study found a 28% reduction in documentation time in long-term care, and PointClickCare's own early adopters report meaningful, if smaller-scale, time savings, but neither figure should be extrapolated uncritically to every facility, every workflow, or every AI vendor. The documentation burden driving this adoption is well established independently of any vendor's marketing: 79% of nurses in a survey of over 80,000 report losing time to unproductive charting, nurses in long-term care spend roughly 30% to 40% of working time on documentation, and roughly two in five registered nurses report considering leaving the profession within five years, a burden tied directly to workforce retention risk. Against that backdrop, and with regulatory attention on both HIPAA safeguards and AI algorithm transparency intensifying rather than easing, operators evaluating PointClickCare AI charting tools should treat compliance verification, not feature comparison alone, as the first step in any procurement decision, and should revisit that verification as new HIPAA rules and PointClickCare's own fast-moving product roadmap continue to evolve through 2027 and beyond.