Do I need patient consent to use an AI scribe?

HIPAA lets covered entities document treatment without separate patient authorization, so under federal law an AI scribe used to record a clinical encounter generally falls under permitted treatment use. HIPAA is the floor, not the ceiling: state recording-consent laws, state health privacy laws, and professional ethics can each add requirements. The safest approach is to get informed consent from every patient before activating the scribe, regardless of state.

What is the difference between one-party and two-party consent for AI recording?

One-party consent states require only one person in the conversation to agree to a recording, which the provider satisfies by choosing to use the scribe. Two-party (all-party) consent states require everyone in the conversation to agree, so you must obtain explicit patient consent before the AI scribe starts listening. California, Florida, Illinois, Massachusetts, Pennsylvania, and Washington are among the two-party states.

What should I tell patients about the AI scribe before recording?

Use plain language, not legal jargon. Tell the patient that an AI tool will record the conversation, that the recording is used to generate clinical documentation, how the audio and transcription are stored and protected, how long the data is retained, and that they can decline AI-assisted documentation without affecting their care. Offer it as an option and note what alternative documentation you will use if they say no.

Does the CPSO require patient consent for an AI scribe?

Yes in practice. The CPSO tells Ontario physicians to obtain the patient's consent before recording with an AI scribe, explain why it is used, review every note it drafts, and remember that the physician stays accountable for the record. CPSBC in British Columbia gives the same direction, CPSA in Alberta advises against relying on implied consent, and Alberta also requires a privacy impact assessment filed with the OIPC before use.

Do I need a special consent form for an AI scribe, or is a template enough?

A generic consent form that only mentions documentation likely falls short, especially in Canada, where PIPEDA requires meaningful consent and patients must understand that an AI is recording and transcribing the visit. Build an AI scribe consent section into your standard intake paperwork so every new patient meets the question before their first visit, and have a healthcare attorney review the wording annually as recording laws change.

How do I document AI scribe consent, and what if a patient declines?

Written consent signed by the patient is preferred; verbal consent recorded in the medical chart is acceptable in many jurisdictions, and office signage is supplementary but not sufficient on its own. If a patient declines, disable the scribe for that encounter before it begins, document the visit through traditional methods, record the preference in their chart so it carries forward, and never let declining affect their care.

Does Transcribe Health help manage patient consent?

Yes. Transcribe Health includes built-in consent management, from customizable patient consent forms to per-encounter toggle controls that let a provider disable AI documentation instantly when a patient declines. Every plan includes a Business Associate Agreement, patient data is never used to train AI models, and data residency defaults to Canada.

Back to Blog

HIPAA Compliance

February 9, 2026

6 min read

AI Scribe Consent Rules: US States, PHIPA and CPSO

Do you need patient consent for an AI scribe? One- and two-party US states, what PHIPA, CPSO, CPSBC and CPSA expect in Canada, and how to handle a refusal.

By Fatih Aktas, Founder & CEO

Published February 9, 2026

red padlock on black computer keyboard. Cover image for: AI Scribe Consent Rules: US States, PHIPA and CPSO. — red padlock on black computer keyboard. Photo by FlyD on Unsplash

HIPAA doesn't require consent for treatment documentation, but state laws might

Heres where it gets confusing. HIPAA itself allows covered entities to use and disclose PHI for treatment, payment, and healthcare operations without explicit patient authorization. So under federal law, using an AI scribe to document a clinical encounter generally falls under permitted treatment use.

But HIPAA sets the floor, not the ceiling. State recording consent laws, state health privacy laws, and professional ethics standards can all impose additional requirements. And those vary wildly depending on where you practice.

The safest approach? Get informed consent from every patient before activating an AI scribe. Even if your state doesn't technically require it, transparency builds trust - and a signed consent form is your best defense if a patient later objects.

One-party vs two-party consent states

Recording consent laws in the United States fall into two categories:

One-party consent states require only one person in the conversation to consent to the recording. Since you (the provider) consent by choosing to use the scribe, this is typically satisfied automatically.

Two-party (all-party) consent states require everyone in the conversation to agree to the recording. In these states, you must obtain explicit patient consent before the AI scribe begins listening.

Two-party consent states

These states require all parties to consent to recording:

California
Connecticut
Florida
Illinois
Maryland
Massachusetts
Michigan
Montana
Nevada
New Hampshire
Oregon (for in-person conversations)
Pennsylvania
Washington

One-party consent states

All other states follow one-party consent rules. But even in these states, best practice is to inform patients and document their consent.

Important caveat: Some states have specific healthcare recording laws that override or supplement their general wiretapping statutes. California, for instance, has additional protections under the Confidentiality of Medical Information Act (CMIA) that go beyond standard two-party consent.

Canadian consent requirements

Recording law in Canada is one-party: the Criminal Code lets a person record a conversation they take part in. So in Canada the consent question is not about wiretap law. It is about health privacy law and your regulatory college, and the colleges have answered it: get the patient's consent before the scribe listens.

Province	Privacy law	What regulators and associations expect
Ontario	PHIPA	CPSO: get consent before recording and tell the patient why, review every note, and you stay accountable for it. The IPC (January 2026) also expects a privacy impact assessment and a written vendor agreement. The OMA recommends express consent at first use, with an opt-out that does not affect the patient's care.
British Columbia	PIPA (private practice)	CPSBC: informed consent before use, and review before the note enters the record. Doctors of BC: get verbal or written consent before first use and document it in the EMR; patients can withdraw at any time.
Alberta	Health Information Act	CPSA: implied consent is not recommended; get informed consent and document it in the chart. The OIPC requires a privacy impact assessment filed with it before you start. The Act itself is not consent-based, but it requires written consent if the recording device is not visible to the patient.
Quebec	Health and social services information act (Loi 5); Law 25 for other personal information	Quebec requires each AI transcription tool to hold provincial certification and the clinic to complete its own privacy impact assessment. Patients must give at least verbal consent and be told AI is in use.

The common thread is meaningful consent: patients need to understand that an AI is recording and transcribing the visit, not just that documentation is happening. A generic consent form that never mentions AI falls short of what these regulators describe.

What your consent process should include

Regardless of your jurisdiction, an effective consent process for AI medical scribes covers these elements:

What to disclose to patients:

An AI tool will be recording the conversation
The recording will be used to generate clinical documentation
How the audio and transcription data will be stored and protected
How long the data will be retained
Their right to decline AI-assisted documentation
What alternative documentation methods are available if they decline

How to document consent:

Written consent form signed by the patient (preferred)
Verbal consent documented in the medical record (acceptable in many jurisdictions)
Signage in the office notifying patients of AI scribe use (supplementary, not sufficient alone)

When consent should be obtained:

During patient intake, before the first visit using the AI scribe
Renewed when there are material changes to how the AI tool works
Offered as an option - never forced

Handling patients who decline

Some patients will say no. You need a workflow for that.

Have a clear process for:

Disabling the AI scribe for that specific encounter before it begins
Documenting the encounter through traditional methods (manual notes, typing, dictation)
Recording the patient's preference in their chart so it carries forward to future visits
Not penalizing the patient - declining AI documentation cannot affect the quality of care they receive

Train your front desk and clinical staff on this process. It should be seamless. A patient who declines shouldn't feel like they're causing a disruption.

Practical implementation tips

Make it part of intake paperwork. Add an AI scribe consent section to your standard intake forms. This normalizes it and ensures every new patient encounters the question before their first visit.

Use plain language. Skip the legal jargon. Patients need to understand what's happening, not parse a contract. Something like: "We use an AI assistant that listens during your visit to help your doctor write accurate notes. The recording is encrypted and kept private. You can opt out at any time."

Post visible notices. Put a simple sign in exam rooms: "This practice uses AI-assisted documentation. Please let us know if you have questions or prefer traditional documentation."

Review annually. Recording laws evolve. State legislatures are actively passing new AI-specific privacy laws. Have your healthcare attorney review your consent forms at least once a year.

Transcribe Health includes built-in consent management features - from customizable patient consent forms to per-encounter toggle controls that let providers disable AI documentation instantly when a patient declines.

Set up consent before your first patient. Start on the Free plan: your consent wording, a printable consent form and per-visit consent capture are included, with no credit card.

This article is for informational purposes only and does not constitute legal or compliance advice. Recording consent laws vary by jurisdiction and are subject to change. The state and provincial information provided may not be current or complete. Consult with a qualified healthcare attorney in your jurisdiction for guidance on consent requirements specific to your practice.

Frequently asked questions

Do I need patient consent to use an AI scribe?: HIPAA lets covered entities document treatment without separate patient authorization, so under federal law an AI scribe used to record a clinical encounter generally falls under permitted treatment use. HIPAA is the floor, not the ceiling: state recording-consent laws, state health privacy laws, and professional ethics can each add requirements. The safest approach is to get informed consent from every patient before activating the scribe, regardless of state.
What is the difference between one-party and two-party consent for AI recording?: One-party consent states require only one person in the conversation to agree to a recording, which the provider satisfies by choosing to use the scribe. Two-party (all-party) consent states require everyone in the conversation to agree, so you must obtain explicit patient consent before the AI scribe starts listening. California, Florida, Illinois, Massachusetts, Pennsylvania, and Washington are among the two-party states.
What should I tell patients about the AI scribe before recording?: Use plain language, not legal jargon. Tell the patient that an AI tool will record the conversation, that the recording is used to generate clinical documentation, how the audio and transcription are stored and protected, how long the data is retained, and that they can decline AI-assisted documentation without affecting their care. Offer it as an option and note what alternative documentation you will use if they say no.
Does the CPSO require patient consent for an AI scribe?: Yes in practice. The CPSO tells Ontario physicians to obtain the patient's consent before recording with an AI scribe, explain why it is used, review every note it drafts, and remember that the physician stays accountable for the record. CPSBC in British Columbia gives the same direction, CPSA in Alberta advises against relying on implied consent, and Alberta also requires a privacy impact assessment filed with the OIPC before use.
Do I need a special consent form for an AI scribe, or is a template enough?: A generic consent form that only mentions documentation likely falls short, especially in Canada, where PIPEDA requires meaningful consent and patients must understand that an AI is recording and transcribing the visit. Build an AI scribe consent section into your standard intake paperwork so every new patient meets the question before their first visit, and have a healthcare attorney review the wording annually as recording laws change.
How do I document AI scribe consent, and what if a patient declines?: Written consent signed by the patient is preferred; verbal consent recorded in the medical chart is acceptable in many jurisdictions, and office signage is supplementary but not sufficient on its own. If a patient declines, disable the scribe for that encounter before it begins, document the visit through traditional methods, record the preference in their chart so it carries forward, and never let declining affect their care.
Does Transcribe Health help manage patient consent?: Yes. Transcribe Health includes built-in consent management, from customizable patient consent forms to per-encounter toggle controls that let a provider disable AI documentation instantly when a patient declines. Every plan includes a Business Associate Agreement, patient data is never used to train AI models, and data residency defaults to Canada.

patient-consentrecording-lawshipaaai-scribestate-regulations

HIPAA Compliance

Related Resources

Our Compliance Standards

Bring AI support to your clinic

Explore clinical notes, Dorvi and tools for the work around each visit. Start a 14-day free trial, with the first charge on day 15.

Start Free Trial