AI Scribes: Four States Now Require Patient Opt-Out

You ran your first AI scribe demo six months ago. The vendor said HIPAA-compliant. You signed the contract, dropped a line into your intake form (something like ‘may use AI tools for documentation’), and started saving an hour a day on notes. You haven't thought about that paperwork since.

This week, Rhode Island became the fourth state to require providers to disclose AI scribe use and give every patient the right to opt out. Sponsored by Sen. Pamela Lauria and Rep. Teresa Tanzi, backed by the state ACLU. It passed.

Illinois, Maine, and Colorado already did the same. Four states in about a year, and the pace is picking up.

The question for Tuesday morning: does your current consent paperwork cover this?

What just happened in Rhode Island

The bill requires providers to disclose when they use ‘ambient artificial intelligence’ to record appointments, and to let patients decline. The term is deliberate. It covers any scribe that listens to the exam-room conversation, transcribes it, and drafts the note. It covers the ones that integrate with your EHR. It covers the ones your vendor calls HIPAA-compliant.

Rep. Tanzi put it plainly: ‘As with any rapidly expanding new technology, particularly in a sensitive field like healthcare, it is important to protect patients and transparently disclose when AI scribes are being used.’

A University of Michigan and Verasight survey of 3,000 adults found 54 percent want to decide for themselves when clinical AI is used in their care. More than half your patients are now asking a question your paperwork probably doesn't answer.

The pattern this fits into

Rhode Island is the fourth state to formalize opt-out. Illinois, Maine, and Colorado already bar AI recording or transcription of a therapy session without consent. Illinois is the strictest. Maine scoped to mental health. Colorado folded it into its broader AI Act. California has a class action running: Washington et al. v. Sutter Health, filed April 8, 2026, alleging Abridge's ambient scribe at Sutter and MemorialCare violated the California Invasion of Privacy Act, the California Confidentiality of Medical Information Act, and the federal Wiretap Act. Sutter's Abridge contract follows the HIPAA model. Plaintiffs say that contract didn't cure the consent gap under California's all-party-consent recording statute.

Thirteen states require all parties to consent before any recording begins: California, Illinois, Pennsylvania, Maryland, Massachusetts, Connecticut, Florida, Montana, Nevada, New Hampshire, Washington, Oregon, and Delaware. There, a scribe deployed without explicit patient authorization isn't a HIPAA problem. It's a wiretap problem, and wiretap statutes carry per-encounter statutory damages that compound with your patient volume.

What the Kaiser reporting is showing

This month, three outlets (The Markup, CalMatters, and Proof News) reported between June 16 and 24 on how Kaiser Permanente's Abridge deployment in mental health appointments actually works at the consent level.

Kaiser's policy requires consent before the scribe runs. Its spokesperson: ‘No one is recorded without their knowledge and consent.’ Recordings kept no more than 14 days. Processing meets HIPAA.

The clinicians running those appointments told reporters the consent script they're trained to deliver never explains where the recording is stored, who can access it, or how the transcript flows downstream into the EHR and the vendor's systems. One called it ‘feeling manipulative and coercive,’ selling the tool as a win for everyone while offering no real way to decline.

That's the gap the new laws are built to close. Consent that doesn't explain what happens to the recording isn't meaningful consent under Illinois, Maine, Colorado, or now Rhode Island. Consent with no clear way to decline isn't meaningful consent. And consent buried in intake paperwork is exactly what these laws are written to invalidate.

Why this lands on your desk

None of this stays theoretical for long. It shows up on your intake forms and on your malpractice carrier's underwriting questionnaire.

If you practice in Illinois, Maine, Colorado, or Rhode Island, this is current. If your consent paperwork doesn't name the scribe, name the vendor, state how long recordings are kept and who can access them, and offer a clear opt-out, it doesn't match your state's law.

If you're not in those four, the question is when your state joins them. The American Psychological Association already recommends storing scribe data for the minimum time necessary and making consent explicit and informed. The Federal Trade Commission has signaled that overstated compliance claims can violate Section 5 of the FTC Act, including a vendor's ‘HIPAA compliant’ label that misleads you about what state law actually requires.

The downside for a small practice is concrete. Wiretap and consumer health privacy statutes generally allow per-encounter statutory damages. Run the scribe across 1,000 encounters with a consent process that doesn't match your state's law, and the math compounds fast. Defense costs for a single class action against a small practice reach six figures before discovery is done.

Four steps this week

One. Pull your current intake and consent paperwork and read it for the AI scribe specifically. If ‘ambient AI,’ ‘AI scribe,’ ‘automated documentation,’ or your vendor's name don't appear, that's your gap. The Vault includes the Ambient AI Scribe Consent as a standalone module for exactly this: it names the vendor, the retention window, who has access, and the patient's opt-out path on a single page.

Two. Confirm what your vendor's contract says about retention, deletion, and what happens to the audio after the encounter. Kaiser said 14 days. Your vendor might say longer, might use the audio to train future models, might share it with a parent company. Read that clause. If you can't find it, ask in writing and keep the answer.

Three. Decide whether you need an opt-out workflow this month or after your state passes the law that's coming. If you're in one of the 13 all-party-consent states and your scribe has no explicit opt-out path today, the exposure is already current.

Four. Write the internal policy that pairs with the consent form. The form is what the patient signs. The policy is what your practice does. It names the workflow trigger (does the medical assistant get consent at check-in, or the clinician run the script in the room), where the opt-out gets documented so the next clinician honors it, how long you retain audio against what the contract actually allows, and what happens when you switch vendors, pause the scribe for one encounter, or drop it entirely. Write it once, sign it as a practice, train your staff against it, and revisit it whenever the vendor or the law changes.

The practices that quietly added scribes over the last two years did the math on saved documentation time. The math was real. What it left out was the consent infrastructure those scribes require: the patient-facing form, the internal policy behind it, the state laws now expanding, and the documentation discipline about to become non-optional in your jurisdiction. The practices that handle 2026 well will be the ones that catch up to their own paperwork before the law catches up to them.