Summary
Under HIPAA, no. Ambient documentation for your own record is a treatment activity and does not need a separate patient authorisation.5
Under state law, in sixteen states, yes, and getting it wrong is a criminal matter for you personally rather than a fine for your practice.23 These are two different bodies of law and your BAA only answers one of them. Get consent from every patient, everywhere, and write it in the chart.
Consent captured at intake and logged in the same record as the consultation.
Book a demoTwo laws, not one
HIPAA governs what happens to protected health information once you hold it. It does not govern whether you were allowed to capture the audio in the first place. That is state wiretapping and eavesdropping law, and HIPAA does not preempt it. Most AI scribe compliance programmes conflate the two, and it is the error worth avoiding before any other.
Federal wiretap law sets a one-party consent floor.1118 U.S.C. 2511. One party to a conversation has to consent, and in an exam room you are that party, so activating the tool is your consent. Federal law then expressly lets states go further, and sixteen of them have.22All-party consent states are commonly counted at 13 to 16 depending on the source and on how healthcare-specific statutes are treated. California, Florida, Pennsylvania, Illinois, Washington, Massachusetts and Maryland are among them. Confirm your own state with a healthcare attorney rather than a vendor. In an all-party state, every person in the room has to agree before the microphone opens. California, Florida, Pennsylvania, Illinois, Washington, Massachusetts and Maryland are on that list.
An ambient scribe in an exam room is a recording device. There is no clinical exemption that turns it into something else.
Who carries the risk
HIPAA penalties are assessed against the covered entity in capped tiers. State wiretapping penalties are different. California Penal Code 632 and Pennsylvania 5703 both reach the individual, and both carry criminal exposure. California's privacy act provides statutory damages reported up to $5,000 per recording.33California Penal Code 632 and Pennsylvania 18 Pa.C.S. 5703 both carry individual criminal exposure. California's Invasion of Privacy Act provides statutory damages reported up to $5,000 per recording. Your business associate agreement cannot move any of that. A BAA is a contract between your practice and a vendor about data handling. It has nothing to say about whether a clinician committed a wiretapping offence, and no indemnity clause changes that.
This stopped being theoretical in January 2026, when a California patient sued Sharp HealthCare alleging his appointment had been recorded by an ambient AI scribe without his consent. The filing seeks class-action status for affected California patients.44Sharp HealthCare, January 2026, seeking class-action status. Medical Daily, June 2026. A Medscape investigation in June 2026 found the consent gap is widespread.
What to do
Ask every patient, in every state, and do not try to run different workflows in different places. The all-party standard is not hard to meet and it removes the question entirely.
Say it in plain words before the microphone opens. Something close to this works. I use an AI tool that listens to our conversation and helps me write your notes. A clinician reviews everything before it goes in your record. You can say no now or at any point during the visit. Then wait for an actual yes.
Write the consent in the chart with the date, the time and the tool used. Verbal consent is fine and harder to prove, so document it. Put the disclosure in your Notice of Privacy Practices and your intake paperwork rather than leaving it to whoever is in the room. For minors, consent comes from the parent or guardian. For patients without capacity, from the substitute decision maker. On telehealth the same rules apply, and the patient's location may decide which state's law governs, so the safe route is the stricter one.
What to ask a vendor
Any vendor handling your audio, transcripts or draft notes is a business associate under 45 CFR 160.103 and has to sign a BAA before touching a single encounter.6645 CFR 160.103. If they will not sign one, or their BAA reserves the right to use your patients' data for their own purposes, stop there.
Then ask four things. How long is the audio kept, and can you set it. Is your data used to train their models, and can you refuse. Where is it stored. And does the product capture and log consent, or is that your problem.
Ask us these four, in writing
We are a business associate and we sign a BAA before any encounter. Consent capture runs in the intake flow through WA\ Admin and lands in the same record as the consultation, so the attestation sits where an auditor looks for it.
For everything else, take the questions rather than our assurance. How long is the audio retained and can you set it. Does the product capture and log consent, or is that your problem. Is your data used to train models, and can you refuse. Where is it stored. Ask us in writing and ask every vendor the same four.
A survey of 121 AI scribe products found 42 percent required direct vendor contact or a demonstration before you could find anything out at all.99Kaczmarek K, et al. Trust Me, I Might be a Medical Device, The Problem with AI Scribes. Research Square, preprint, March 2026. Survey of 121 AI scribe products. If a vendor will not answer those four over email, that is your answer.
What this looks like on a Tuesday
The consent is captured at intake, before anyone reaches a room, and it lands in the chart with the date, the time and the tool named. When a patient asks what the recording is for, the receptionist can answer, because she can see the consultation it belongs to.
If a patient declines, the flag travels with them. Nobody has to remember. An ambient scribe cannot hold that, because the consent question arrives before the microphone does and lives on the front desk.
What we are not claiming
None of this is legal advice and we are not lawyers. The count of all-party states is reported between 13 and 16 depending on the source and on how healthcare-specific statutes are counted, which is itself a reason to ask someone qualified about your own state rather than trusting a table on a vendor's website, including ours.
Consent is also not the only thing recording asks of you. You review and sign every note on every product in this category, ours included.
Availability
WA\ Clinician runs a 14-day free trial. WA\ Admin runs as a 90-day pilot. Pricing is on one page.
Frequently asked questions
Do you need patient consent to use an AI scribe?
It depends which law you mean, and this is where most practices go wrong. HIPAA permits use of protected health information for treatment, payment and healthcare operations without separate authorisation, and ambient documentation for your own record sits inside that, so HIPAA does not require a consent form. State recording law is a different body of law and HIPAA does not preempt it. Federal wiretap law sets a one-party consent floor and lets states require more, and sixteen states require consent from every person in the room. The practical answer is to ask every patient in every state and document it, because the all-party standard is not difficult to meet and it removes the question.
Which states require all-party consent for AI scribe recording?
Counts range from 13 to 16 depending on the source and on how healthcare-specific statutes are treated. California, Florida, Pennsylvania, Illinois, Washington, Massachusetts and Maryland are consistently among them. California adds Confidentiality of Medical Information Act protections on top of standard two-party consent. The variation in those counts is itself the reason to ask a healthcare attorney licensed in your state rather than trust a table on any vendor website, including this one. On telehealth the patient location may determine which state law applies, so the stricter workflow is the safe one.
Does a BAA cover me for recording without consent?
No, and this is worth being clear about. A business associate agreement is a contract between your practice and a vendor about how protected health information is handled. It says nothing about whether capturing the audio was lawful. HIPAA penalties are assessed against the covered entity in capped tiers. State wiretapping statutes including California Penal Code 632 and Pennsylvania 5703 reach the individual clinician and carry criminal exposure, and no vendor indemnity clause moves personal criminal liability. In January 2026 a California patient filed suit against Sharp HealthCare alleging an appointment was recorded by an ambient AI scribe without consent.
Consent in the chart, not in a separate system.
Start the trial, ask us the consent questions on this page, and make us answer them. If it works, the 90-day pilot reports revenue, hours saved and patients cared for from your clinic. If it does not, you have lost a fortnight.
About this article. Written and published by WA\, which sells an ambient documentation product and is therefore describing legal exposure that applies to its own customers as much as to anyone else's. This is general information and not legal advice, and we are not lawyers. Statutes, case law and state counts are cited in the margin and were current at the updated date above. Recording law is changing quickly and several state legislatures are actively passing AI-specific privacy legislation. Confirm your own position with a healthcare attorney licensed in your state before relying on anything here. The Sharp HealthCare litigation cited was unresolved at the time of writing and the allegations in it are untested. WA\ has no peer-reviewed clinical trials published to date and does not claim any. We have priced every competitor on this page from their own published material, including the tiers where they are a smaller subscription than us and the trial where Nabla beat us. We would rather you had the whole picture and chose someone else than had half of it and chose us.