AI Medical Scribe Consent: What Patients Must Be Told Before an AI Scribe Listens

An AI scribe, also called an ambient scribe, records the conversation between clinician and patient and drafts the visit note. That makes it two things at once in legal terms. It is a use of health information, and it is a recording of a private conversation.

Health privacy law and recording law answer differently. PYMNTS reports that HIPAA has no patient-notification requirement specific to AI scribes. State recording laws were written decades before these tools and apply to any device that records a confidential conversation.

The result is that a practice can meet its HIPAA duties and still face a claim under a state recording statute. The pending California cases plead exactly that combination. Which rules apply to a given practice is a question for its counsel.

The entries describe what each source says. The last column names where the description comes from, because several rest on law-firm summaries and on a news review.

Read the rows together. A practice in Louisiana has a disclosure statute to meet, and a practice in California has a recording statute that asks for consent. A telehealth practice may have patients in both.

The PYMNTS review explains the federal position this way. The Privacy Rule lets a hospital use patient information for treatment without the patient's authorization. The Department of Health and Human Services lists transcription vendors as business associates, which must sign agreements binding them to HIPAA's privacy rules.

So the federal questions are about the vendor contract, the security of the audio and the transcript, and whether the vendor may use the data for anything else. The law firm Feldesman, writing about the Sutter case, lists a HIPAA-compliant business associate agreement as the first step for any AI vendor that handles patient information.

None of that tells the patient a recording is running. PYMNTS, citing BakerHostetler, notes that state recording laws can add notice and consent duties for each visit. That is where the next two sections pick up.

Louisiana's Act 649, from House Bill 475, took effect on 1 August 2026. The Legislature's digest says it requires a licensed healthcare professional to disclose to the patient, before an appointment or treatment, the use of any recording device, software or service that uses AI to transcribe their communications. A licensing board may discipline a professional who does not. Law firms Arnall Golden Gregory and Phelps Dunbar describe the disclosure as verbal, and Arnall Golden Gregory notes the enacted version requires disclosure and not consent.

Rhode Island's law is the Use of Artificial Intelligence by Healthcare Providers Notification Act. The Senate bill text says providers and facilities that use AI to document in-person or telehealth visits must notify patients, and must review the AI-generated documentation for accuracy. It took effect on passage. Nixon Peabody gives the date as 22 June 2026.

Two cautions on Rhode Island. The text we read names no penalty and no enforcing agency. It also contains no patient opt-out, although one law-firm headline describes an opt-out process. We could not open that article, so check the enacted chapter before relying on either reading.

California Penal Code 632 applies to anyone who uses a recording device to record a confidential communication without the consent of all parties. A communication is confidential when the circumstances reasonably indicate that a party wants it confined to the people present. A conversation with a doctor is a ready example.

Section 637.2 allows an injured person to sue for the greater of $5,000 per violation or three times actual damages, and it says actual damages are not required. Multiplied across the visits a health system records in a year, that figure explains why class action lawyers are interested.

Other states have all-party rules of their own, which our article on two-party consent states lists. Telehealth adds the problem of location, since the patient may be in a different state from the clinician. Holland & Knight expects future filings to cluster in states with wiretap statutes like California's.

Holland & Knight describes two California Superior Court cases, Saucedo v. Sharp HealthCare and Stewart v. Kurien. The complaints allege that confidential conversations during medical visits were recorded with ambient AI tools without consent. They plead the California Invasion of Privacy Act, the Confidentiality of Medical Information Act, intrusion and emotional distress. The research notes behind this article record two different filing dates for the Sharp case in late 2025.

A separate proposed class action was filed on 8 April 2026 in federal court in the Northern District of California against Sutter Health and MemorialCare, as reported by TechTarget. The patients allege they did not receive clear notice that conversations would be recorded by AI, sent outside the clinical setting, or processed by a third party. The scribe named is Abridge. A Sutter spokesperson said the organization was aware of the case and reviewing it.

These are allegations. No court has ruled on them in the sources reviewed, and the defendants have not been found to have done anything unlawful.

Many scribe products insert a line into the visit note saying the patient agreed to the recording. Holland & Knight reports that the Sharp complaints allege notes generated by the tool state that patients were advised of and consented to the recordings. If a template writes that sentence into every note, the sentence proves nothing about any one visit.

Holland & Knight's recommendation follows from that. It tells providers to check that AI-generated documentation does not record consent that was never obtained. The firm also warns that generic recording notices may fall short where a third party's AI analysis is undisclosed.

A record of consent is stronger when it is made by a person or a separate system at the time, shows what the patient was told, and cannot be produced by the scribe on its own.

Feldesman's list after the Sutter filing is a reasonable outline. It covers the vendor agreement, written consent procedures and privacy notices that describe AI recording and third-party processing, staff training, an opt-out, and documentation of consent or refusal.

State law sets the minimum for timing and form. Louisiana's rule is disclosure before the appointment or treatment. Texas's treatment notice is due no later than the date of service, per Phelps Dunbar.

• Describe the AI scribe, the recording and the vendor in intake forms and the notice of privacy practices.
• Have the clinician tell the patient before the scribe starts, in plain words, and ask whether they agree.
• Offer a visit without the scribe to anyone who declines, and record the refusal.
• Log the date, the visit, who gave the notice and the patient's answer in a record the scribe does not write.
• Review the AI-written note for accuracy, which Rhode Island requires.
• Check the vendor contract for retention and for use of patient audio in model training.

No ruling was found in the Sharp, Sutter or MemorialCare cases, so there is no court decision on whether an AI scribe vendor counts as an outside listener in an exam room or what disclosure is enough.

The new statutes leave gaps too. Rhode Island's sets no form of notice. Arnall Golden Gregory says it is unclear whether Louisiana's will be enforced through complaints or audits. Adoption is moving faster than the rules: a Doximity survey of 3,151 physicians, cited by PYMNTS, found use of ambient scribes rose from 20 percent to 29 percent between two survey waves.