Informed Consent for AI Scribes: Language, Practice, and State Notes

Why explicit consent matters here

Even when your BAA and Notice of Privacy Practices technically cover AI processing, therapy sits on a relational foundation. Clients who feel surprised by AI in the room often experience a rupture that shows up in the alliance long before it shows up in your intake paperwork. Explicit, plainly-worded consent is both an ethical baseline and a therapeutic move.

What a good consent disclosure covers

• What is captured (audio, transcript, generated note).
• Who processes it (the scribe vendor and any named subprocessors — 'a HIPAA-eligible AI provider' is acceptable if you can name it on request).
• How long each artifact is retained (audio, transcript, note).
• Whether any data is used to train or improve models.
• The client's right to decline AI scribing without any change to their care.
• The client's right to request that a specific session not be recorded.
• How to withdraw consent, and what happens to prior recordings if they do.

Sample consent language (adaptable)

This is a starting point, not legal advice. Adapt to your state, your vendor, and your practice model. Have your attorney review before use.

• During our sessions, I use an AI ambient documentation tool ([vendor name]) to help me draft progress notes.
• The tool records audio of our session, generates a transcript, and produces a draft note that I review and finalize before it enters your record.
• The vendor is a HIPAA Business Associate under a signed agreement with my practice. They encrypt your data in transit and at rest, do not use it to train AI models, and delete raw audio within [X hours] of transcription.
• You may decline AI documentation at any time. This will not affect your care in any way — I will simply take notes by hand for that session.
• You may ask that a specific session not be recorded, or that a recording be deleted.
• If you have questions about how this tool works or want the full vendor policy, ask me and I will provide it.

How to document consent in the chart

Consent is only durable if it is documented. The chart entry should include the date, the version of the consent form, whether the client consented or declined, and any specific limits (e.g. 'client consents to AI scribing for individual sessions only, not for couples work').

State-level considerations

This is not legal advice — check with counsel in your state. High-level notes for common practice states:

• Two-party consent states (CA, FL, IL, MD, MA, MT, NH, PA, WA, and others): both clinician and client must consent to recording. Written consent is the safe bar.
• Illinois (BIPA): voice recordings can trigger biometric-identifier obligations. Confirm your vendor does not extract voiceprints.
• California (CMIA): stricter than HIPAA on some disclosures; the consent language should reference California-specific rights.
• Washington (My Health My Data Act): expansive definition of 'consumer health data'; consent language should be explicit and separately obtainable.
• New York (SHIELD Act): breach-notification tightening; the vendor's incident SLA becomes practically relevant to your consent posture.

Special populations

Some client populations warrant additional care in how consent is obtained and how the AI scribe is used.

• Minors — obtain parental/guardian consent for AI scribing in addition to whatever assent you obtain from the minor.
• Clients in SUD treatment under 42 CFR Part 2 — consent for AI processing is separate from the Part 2 consent for disclosure; both are required.
• Court-ordered clients — clarify in writing whether the AI scribe's output is discoverable in the client's legal matter.
• Clients with cognitive impairment — consider capacity for informed consent and involve a designated representative where appropriate.
• Clients with paranoia or trauma histories involving surveillance — an AI scribe may be clinically contraindicated regardless of legal permissibility.

Refreshing consent

Consent is not a one-time event. Refresh annually as part of your normal intake update, and any time the vendor materially changes their data handling, subprocessors, or training policy. Document the refresh in the chart.

If a client declines

The client's decision must not affect their care. Practically, this means you need a workable fallback — hand-written or dictated notes for that session — that does not visibly degrade the clinical experience. If your workflow only functions with AI scribing, you have created an implicit coercion; fix the workflow before you fix the consent form.