If you’ve adopted an ambient AI scribe, you’ve already felt the upside: notes that write themselves, eye contact restored, charts closed before you leave the room. What you may not have felt yet is the downside — because there may be legal exposure that’s a bit of a sleeper until you give it some thought.

When your software starts listening to your meeting with the patient, you are recording your patient. And recording a patient is governed by more than HIPAA. It can trigger a second body of law — related to state wiretapping and eavesdropping statutes — that most clinical workflows were never designed to satisfy. This is new territory.

Two laws are watching, not one

HIPAA governs how you handle protected health information. It generally lets you document a visit as a normal part of treatment. So far, so good. But HIPAA and typical consents don’t normally (and until recently didn’t need to) address whether you were allowed to make the “recording” in the first place. That question belongs to your state.

Roughly a dozen states are all-party (two-party) consent jurisdictions — California, Florida, Pennsylvania, Illinois, Washington, Massachusetts and others. In those states, every person in a conversation must agree before it can be recorded. An AI scribe running in the background of an exam room is, legally, a recording device. No consent, no legal recording.

And this is no longer theoretical. In 2026, patients have filed class-action suits against multiple health systems alleging their conversations were captured by AI scribes without consent. The plaintiffs aren’t claiming their data was breached. They’re claiming they were recorded without being asked. That’s a much easier case to make — and a much harder one to defend.

You’re probably already telling your patients this and they’re probably ok with it. But one of our clients asked us to help with a simple, sample form to resolve the issue. So we did.

“But we already have a consent-to-treat form”

This is the assumption that quietly puts practices at risk. A general consent to treatment — and even a standard Notice of Privacy Practices — was written for a world where a human scribe or the physician personally typed the note. It does not describe an always-on AI listening device, a third-party vendor processing the audio, or where that audio goes afterward. Regulators and plaintiffs’ attorneys have already noticed the difference.

A generic consent form for an AI-enabled exam room is like a seatbelt that isn’t bolted to the car. It looks like protection. It might not be.

The ethics are inseparable from the law

Set the statutes aside for a moment, because the ethical case is just as direct. The therapeutic relationship runs on trust, and trust runs on the patient knowing who — and now what — is in the room. Informed consent isn’t a hoop. It’s the difference between a partnership and surveillance. A patient who later learns they were recorded by an AI they were never told about doesn’t just have a legal claim. They have a reason never to be fully honest with a clinician again.

There’s a clinical-quality dimension too. AI scribes are powerful, but they can hallucinate, mishear, and invent plausible-sounding details. Documenting that a clinician reviews every note — and that the patient agreed to the process — is part of defending the integrity of the record itself.

What real consent actually requires

Proper consent for AI-assisted documentation is short, but it has to do specific work. If your current form doesn’t do all of this, you have a gap:

None of this is hard. It is simply specific — and “specific” is exactly what a downloaded one-size template, or a paragraph buried in your intake packet, won’t give you when a regulator or a plaintiff’s attorney comes asking.

The efficiency of AI scribing is real, and it’s not going away. But the practices that win with it will be the ones who treated consent as the foundation — not the afterthought. Get the form right, and the technology becomes pure upside. Skip it, and every visit is a small bet against your license.