Do patients have to consent to AI scribes?

Not under HIPAA, but often under state recording law. The federal privacy rule lets a clinic use patient information to document care, so it does not by itself require a patient's permission before an AI scribe drafts a note. Recording the conversation is different. Whether the patient must agree depends on the state where the visit happens. The safe practice is to ask every patient, in every state, because a patient who finds out later is the one who complains.

This answer is part of our guide to HIPAA and dictation, in our voice privacy overview.

HIPAA permits the note, but state recording law decides the consent

The note itself is on firm ground. HIPAA permits a covered entity to use or disclose protected health information "for its own treatment" ¹, and writing up a visit is part of that care. A clinic does not need a HIPAA authorization from each patient to create the note.

That permission does not settle the recording. Recording a conversation is governed by wiretap and recording statutes. The federal Wiretap Act says it is not unlawful to intercept a communication when the interceptor is a party to it, or when one party to the communication has given prior consent ². That is the one-party consent rule, and it is the federal floor, not the whole answer.

Some states go further. About 11 states primarily require every party's consent before a conversation is recorded ³. These are the all-party consent states. In those states a clinician cannot agree for the patient, so the patient has to agree.

Statute text shows why one rule does not fit every clinic

The statutes differ in their wording, so read the one that applies to your visit. The table lists three we read directly.

California courts look at whether a party reasonably expected privacy, so whether a particular visit is covered is a legal question ⁴. A short table cannot settle which state's law applies to a visit by video, or to a patient who lives in a different state from the clinic. Those are questions for counsel.

Patients are willing to consent, but they want to know where the audio goes

In a 2025 Australian study of allied health practices, patients were comfortable consenting to an AI scribe in their own appointments, and some said other patients might need more information about data storage and security before deciding ⁶. That study covered patients who agreed to take part, in one country, and it does not show how patients in mental health services would respond. Treat it as evidence that a clear explanation helps, not as proof of how every patient will respond.

Therapy is a stricter case. In a 2026 NPR report, a client later realized that her therapist had recorded a session with an AI note-taking tool without her consent. She stopped seeing that therapist ⁷. That is one reported case, so it does not show how often this happens. It does show why a therapist should not assume the medical-visit approach carries over. Our question on whether therapists can use AI scribes covers the stricter bar.

It depends on the state, the visit and the patient's answer

• All-party state. Get the patient's agreement before the recording starts, and keep a record of it.
• One-party state. The clinician is a party to the visit, so the federal rule may let the clinician authorize the recording. Ask the patient anyway. Local rules and professional standards can be stricter than the federal floor, and a patient who learns afterward that a recording was made without asking will not trust the note.
• Therapy and other sensitive visits. Expect a higher bar than for a routine medical visit, and get written consent.
• The patient refuses. Decide before the visit what you will do instead, such as dictating the note or writing it yourself. A refusal should end the recording, not start a debate.

What to do before the first recorded visit

1. Find the rule for each place. Check the statute where the patient is and where the clinician works. The recording consent laws guide lists the state rules. This is general information, not legal advice, so ask your compliance office or counsel for the rule that governs your clinic.
2. Ask every patient, in every state. Say what is recorded, which company processes the audio, where the transcript is stored, how long it is kept, and whether people review it. Ask for a clear yes or no.
3. Write the answer in the chart. A signed form or a dated note is your record. Keep the refusals as well as the agreements.
4. Check the vendor contract. Patient consent does not replace a signed business associate agreement with any vendor that receives the audio. Our HIPAA guide for dictation lists the terms to check.
5. Review every draft before you sign it. Consent covers the recording, not the accuracy of the note. Check the draft against the visit, as our question on how accurate AI medical scribes are explains.

For the wider choice between an ambient scribe and dictation, see AI scribe or dictation for doctors?.