Healthcare and AI: When Do Providers Need to Disclose Their Use of Artificial Intelligence?

2 days ago

5 min read

Executive Summary:

AI disclosure laws may require healthcare providers to notify patients when using artificial intelligence for certain clinical communications or healthcare services.
Patient consent for recording appointments may be required under applicable federal and state laws and must be evaluated separately from AI disclosure.
HIPAA generally permits protected health information (PHI) to be used for treatment, payment, and healthcare operations without patient authorization, subject to applicable conditions.
Healthcare organizations should evaluate AI disclosure obligations, privacy requirements, and vendor agreements before implementing new technology.

Your healthcare organization adopts an AI tool to document patient visits, draft medical messages, or support clinical decisions. The technology saves staff hours each week, and leadership sees an opportunity to improve operations without increasing headcount.

But what are you legally required to tell patients about its use?

For CEOs, CFOs, and in-house attorneys, the answer depends on the technology, its intended purpose, and applicable laws. Notifying patients about AI, obtaining consent to record an appointment, and securing HIPAA authorization are three distinct legal requirements. Healthcare organizations need to evaluate each one independently.

When Must Healthcare Providers Disclose AI Use?

Healthcare organizations use artificial intelligence in several ways, each presenting different legal considerations:

AI-assisted documentation: Software records or transcribes clinical visits and drafts medical records for physician review.
Patient communications: AI chatbots answer inquiries, schedule appointments, or generate messages about test results and treatment.
Clinical decision support: AI systems evaluate medical information to help clinicians identify potential diagnoses, risks, or treatment options.

Federal law doesn't require providers to disclose every AI application. However, AI disclosure requirements vary by state and by how organizations use the technology.

California, for example, has required specified healthcare facilities, clinics, and physician offices since January 1, 2025 to identify communications generated by generative AI pertaining to patient clinical information and explain how patients can reach a human provider, employee, or other appropriate person. Appointment scheduling, billing, and other administrative matters are excluded. Disclaimer placement and frequency depend on the communication medium. An exemption applies when the communication itself is read and reviewed by a human licensed or certified healthcare provider; general oversight of the AI system is not enough.

Texas also requires disclosure when an AI system is used in relation to healthcare services or treatment. Effective January 1, 2026, the provider must give the prescribed disclosure to the recipient or personal representative no later than the date the service or treatment is first provided. In an emergency, disclosure must be given as soon as reasonably possible. The disclosure must be clear and conspicuous, use plain language, and avoid manipulative design practices that undermine patients’ understanding. This provision does not contain California’s human-review exception.

These laws establish notification obligations, which are distinct from requirements to obtain patient permission.

When Does AI Use Require Patient Consent?

An AI documentation platform that records appointments introduces another consideration: consent to record.

Applicable federal and state recording and interception laws determine whose consent is required. Some jurisdictions require consent from all participants; others generally permit recording with one party’s consent, which may be the participating clinician’s consent rather than separate patient consent. Providers must evaluate the laws applicable to their practices, including interstate encounters.

For example, informing patients that AI assists with medical documentation doesn't necessarily satisfy a legal requirement to obtain consent before recording the appointment.

Organizations should assess recording and interception practices independently from AI disclosure obligations. Immediate deletion of audio does not, by itself, resolve whether its initial interception was lawful.

What Does HIPAA Require When Healthcare Providers Use AI?

The Health Insurance Portability and Accountability Act (HIPAA) governs how covered entities and their business associates handle protected health information (PHI).

HIPAA generally permits PHI use and disclosure for treatment, payment, and healthcare operations without patient authorization, subject to applicable requirements. Special authorization rules apply to certain information and purposes, including psychotherapy notes, certain marketing, and sales of PHI.

Other uses, such as certain disclosures for marketing purposes, may require a specific written HIPAA authorization.

Using AI doesn't automatically create a HIPAA authorization requirement. Organizations must examine how the technology processes PHI and whether HIPAA otherwise permits that activity.

Be Thorough in Reviewing AI Vendor Agreements

Healthcare organizations also need to evaluate how AI vendors handle sensitive information.

An AI vendor acting as a HIPAA business associate generally requires a Business Associate Agreement (BAA). Other data processing agreements may impose additional contractual obligations.

Before approving a vendor, leadership should evaluate:

Data ownership and permitted use: Can the vendor use patient information to train or improve its AI models? Contractual permission alone does not establish HIPAA compliance. A BAA generally cannot authorize uses of PHI that would violate the Privacy Rule if undertaken by the covered entity, subject to specified exceptions. Independent vendor model training requires a separate assessment of the purpose, information involved, and applicable legal permissions.
Third-party access: Which subcontractors or additional technology providers can process patient data?
Retention and deletion: What happens to recordings, transcripts, and patient information after processing or contract termination?
Security and liability: What safeguards, incident notification requirements, and contractual remedies apply?

Organizations should confirm the parties’ responsibilities under applicable privacy laws and whether their contracts adequately address AI-related risks. Required BAA subjects include permitted uses, safeguards, reporting obligations, subcontractor restrictions, and return or destruction of PHI at termination where feasible, with continuing protections where infeasible. Indemnities, liability caps, and particular contractual remedies are negotiated protections, not mandatory BAA terms. Contract review does not replace the organization’s own HIPAA Security Rule risk analysis and risk management for electronic PHI; new AI tools should be assessed within that process.

A BAA establishes required contractual safeguards. It doesn't replace separate patient notification, recording consent, or HIPAA authorization requirements.

Establish the Right Requirements Before Deploying AI

Healthcare organizations have compelling reasons to adopt AI. Responsible implementation requires identifying which legal requirements apply to each AI application and establishing appropriate procedures before implementation.

Temple Law, PLLC helps healthcare and health technology businesses across Connecticut, New Jersey, New York, and Pennsylvania evaluate technology agreements, privacy obligations, and commercial risks.

Contact our team to discuss your organization's AI policies and vendor agreements.

Frequently Asked Questions About AI Disclosure in Healthcare

Must healthcare providers notify patients whenever they use AI?

No. Federal law doesn't establish a universal AI notification requirement for healthcare providers. Certain states require disclosure for specified applications, such as AI-generated clinical communications or AI use in healthcare services. Providers must evaluate the applicable law and the technology's function.

Is notifying patients about AI the same as obtaining consent?

No. Notification informs patients that AI is being used. Consent involves obtaining permission for a particular activity when required by law. A required AI disclosure doesn't automatically satisfy recording consent requirements or other obligations.

Do healthcare providers need patient consent to record appointments using AI?

Applicable federal and state recording and interception laws determine whether consent is required and whose permission must be obtained. Federal law generally permits interception by a party or with one party’s prior consent, subject to a criminal-or-tortious-purpose exception. Some states impose stricter requirements, including prior consent from all participants. A participating clinician’s consent may suffice under a one-party-consent rule, so separate patient consent is not always required by recording law. Providers should evaluate the laws applicable to their practices, including interstate encounters.

Does HIPAA require patient authorization before healthcare providers use AI?

HIPAA generally permits covered entities to use and disclose protected health information for treatment, payment, and healthcare operations without patient authorization, subject to applicable requirements and special rules for certain information and purposes, including psychotherapy notes. Uses or disclosures not otherwise permitted or required by HIPAA generally require a valid written authorization. AI use does not itself create an authorization requirement, and contractual permission for vendor model training does not itself establish HIPAA compliance.

Does a Business Associate Agreement satisfy AI disclosure or patient consent requirements?

No. A Business Associate Agreement establishes required privacy and security obligations between a HIPAA-covered entity and a business associate. It doesn't replace applicable AI notification requirements, recording consent obligations, or HIPAA authorization requirements.