Your AI scribe is recording your sessions. Your consent form never said so.
“HIPAA-compliant” covers what happens to the notes. It says nothing about whether you were allowed to record the conversation in the first place. In all-party-consent states, that’s a separate law — and it’s the one your intake form quietly skips.
This isn’t about lawsuits scaring a practice your size. The headlines are all big hospital systems. The reason I’m writing to you is simpler: the same recording-consent law applies to a six-clinician group exactly the same way — and nobody packaged a fix at your scale.
You felt the snag before anyone named it.
Anything other than HIPAA compliance that I should check for?
Do you get consent at all?
My office does not yet have a policy.
I’ve read dozens of these — clinicians who switched on an ambient scribe, were told it was HIPAA-compliant, and then felt a small thing they couldn’t quite name. The snag is real. It has a name, and once you see it you can’t un-see it.
“HIPAA-compliant” is not the same as legal to record.
Your scribe vendor solved one problem and handed you the other one without saying so. They’re governed by two separate bodies of law.
What happens to the notes.
Storage, encryption, who can see the PHI, how the transcript is handled once it exists. This is what your vendor’s “HIPAA-compliant” badge and Business Associate Agreement actually cover. They genuinely handle this part.
Covered.
Whether you were allowed to record at all.
In all-party-consent states, every person in the room has to agree to being recorded — before it starts. Your AI scribe is the recording. A BAA doesn’t cure it, and your intake form probably never names it. This is the half no one handed you.
This is the gap.
One sentence is doing the damage: “Don’t assume the consent language in your existing intake covers AI-mediated documentation; it almost certainly doesn’t.” That’s not me — that’s a clinician’s own guide, written for people in your exact spot.
The rule is different in every state — and it’s changing under you.
A consent form that’s right today can be quietly wrong in six months, and no one sends you the memo. Illinois now requires written consent specifically naming AI transcription, before the session. Texas’s new AI law took effect in 2026. Eleven-plus all-party-consent states each word it differently.
“If you use an ambient recording tool in Illinois and don’t have signed client consent specifically covering AI transcription, you are out of compliance.” — an Illinois therapist-compliance guide
A consent fix scoped to your state — that stays right as the rules move.
I haven’t built this yet. I want to build the right version, and that comes from talking to people who run these practices every day. Here’s the shape I have in mind.
Close the gap that exists today.
- Intake & consent language that actually names the AI recording — scoped to your state, not a 50-state hedge.
- A short verbal script your clinicians can say at the top of a session in one breath.
- Exam-room and telehealth signage that does the disclosing for you.
- A plain read of what your scribe vendor’s BAA does — and doesn’t — actually cover.
Stay right after the rules change.
- When a state moves — the way Illinois just did — your pack updates.
- You hear about it from me, not from a board notice or a patient who walked out.
- You stop tracking fourteen statutes yourself. That’s not your job; it can be mine.
- This is the part I think actually matters. A one-time PDF goes stale. The watch doesn’t.
Plain about the limits: I’m an engineer, not your lawyer. The templates would be reviewed by a health-law attorney before anything is yours to use, and they’re not legal advice. The monitoring and the document work are things software does well — the legal sign-off stays with someone credentialed to give it.
I’m Christo, a software and automation engineer based in Berlin.
What pulled me into this wasn’t a legal filing. It was a thread where a therapy client realized, mid-session, that a laptop half-hidden on the floor had been quietly recording her. “I felt completely violated,” she wrote. “The trust was gone.” An AI scribe nobody had told her about. The clinician wasn’t reckless — she just never got a consent process that covered the recording. That gap is fixable, and almost no one is fixing it for small practices.
So I’ve read the forums, studied the state-by-state requirements, and looked at what every major scribe vendor does and doesn’t put back on the practice. I’d like to build something that actually closes this — and the right version comes from talking to the people who live it. That’s what the call is for.
— Christo
Tell me your setup. I’ll map where the gap is — free.
Your state, your scribe, what your current form says. I’ll come back with where the consent gap actually is for you and what closing it involves — specific to your practice, not a generic checklist. If it’s useful, we keep going.
Got it — thank you.
I’ll read what you sent and come back with where the gap is for your practice. Want to skip ahead and just grab a time?
Book a 20-minute call →