AI Scribe Patient Consent: A State-by-State Map (2026)

In eleven states you need every person in the room to consent before an AI scribe records the visit. Everywhere else the federal floor is one-party consent, and you are a party. The catch: that duty comes from state wiretap law, not HIPAA, and a few states flip the rule depending on whether you're in the exam room or on a video call. Get consent everywhere and the map stops mattering.

That's the answer. The reason it's worth reading the rest is that a real lawsuit just made this concrete. In late 2025 a patient sued a San Diego health system over an ambient scribe that allegedly recorded him without asking. Below: the eleven states, the exam-room-versus-telehealth wrinkle, a consent script you can say out loud tomorrow, and where the no-stored-audio question fits in.

Key takeaways

• Eleven states require all-party consent to record: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Washington.
• The consent duty comes from state recording law, not HIPAA. HIPAA lets you use patient information for treatment without a signed authorization.
• A proposed class action alleges Sharp HealthCare recorded 100,000+ patients with an Abridge scribe without consent. Allegations, not findings, but the playbook is the lesson.
• Florida treats illegal recording as a third-degree felony. The stakes aren't theoretical in all-party states.
• A scribe that never stores audio still needs consent. Statutes regulate the act of recording, not the archive.

Why state law, not HIPAA, decides the consent question

This trips up careful people, so start here. HIPAA permits using protected health information for treatment without a signed authorization (45 CFR 164.506). So HIPAA is not where "ask before you record" comes from. The duty to ask lives in state wiretap and eavesdropping statutes, the same laws that govern recording any conversation.

Federal law sets the floor at one-party consent under 18 U.S.C. § 2511(2)(d): a recording is lawful if one party to the conversation agrees, and the clinician in the room is a party. Eleven states raise that floor and require everyone. An ambient scribe records the visit, so in those eleven states the patient's consent isn't optional courtesy. It's the statute.

One honest caveat before the table: this is reporting, not legal advice. Statutes get amended, case law moves, and your malpractice carrier may want more than the law's minimum. Verify your state's current rule with counsel before you write a policy.

Which states require all-party consent for an AI scribe?

Per the 50-state survey of recording statutes by the law firm Matthiesen, Wickert & Lehrer (chart dated February 2022; we fetched and read it in June 2026), eleven states require all-party consent: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington.

You'll see "12," "13," even "15" in other guides. Nobody's wrong, exactly. The spread comes from four states with split or unsettled rules, Connecticut, Oregon, Michigan, and Vermont, and from a wrinkle that matters specifically in medicine: several statutes treat an in-person conversation differently from a phone or video one. An ambient scribe in an exam room records an in-person conversation. The same scribe on a telehealth call records an electronic one. Same tool, different statute.

Count the exam-room column and you get eleven all-party-or-informed states. Count the telehealth column and you also get eleven, but not the same eleven. Nevada swaps out, Oregon swaps in. That's the trap in every "thirteen two-party states" listicle: the number depends on which conversation you're having.

For telehealth across state lines, assume the stricter state's law applies. That's what the California Supreme Court held in Kearney v. Salomon Smith Barney, when a Georgia firm recorded calls with California clients and California's all-party rule reached it anyway. If you're a Portland clinic seeing a patient who's in Sacramento that morning, California is the law you plan around.

If you want the broader compliance frame around all this, the BAA, the Security Rule safeguards, the twelve questions to ask a vendor, our HIPAA and AI scribes guide sits one level up from this consent map.

What the Sharp HealthCare lawsuit actually alleges

Here's why this stopped being abstract. In late 2025, a patient filed a proposed class action against Sharp HealthCare in San Diego. The complaint alleges that during a July 2025 physical exam at a Sharp Rees-Stealy clinic, an Abridge ambient AI scribe recorded the visit through a clinician's microphone-enabled device, sent the audio to a third-party cloud, and used it to draft the note, all without informing him or asking consent.

Two details make it a teaching case. First, the complaint alleges the patient later found documentation in his portal stating he had been "advised" the visit was recorded and had "consented," language the suit calls false, alleging the providers had no reliable workflow to actually obtain consent before recording. Second, it estimates more than 100,000 Sharp patients may have been recorded the same way. The suit cites California's Confidentiality of Medical Information Act and the state's wiretap statutes, and seeks class certification.

These are allegations, not proven facts, and Abridge is the named technology, not a defendant in the framing most outlets reported. But the lesson doesn't depend on the verdict. The risk wasn't the tool. It was the workflow: recording first, documenting a consent that may not have happened, at scale, in an all-party state. A scribe is only as compliant as the sentence the clinician says before pressing record.

A consent script you can use this week

The fix is almost embarrassingly small. The consent conversation is one breath:

"I use a tool that listens and drafts my note so I can focus on you instead of the keyboard. OK with you?"

Then one line in the chart: "Verbal consent to ambient documentation obtained." That's the whole workflow in a one-party state.

In an all-party state, layer documentation on top so the consent is provable, not just spoken:

1. Waiting-room and intake signage that names ambient documentation and your right to decline.
2. A line on the intake form the patient acknowledges, so consent is captured before the clinician even walks in.
3. The verbal ask at the start of the visit, every visit, no exceptions for the busy ones.
4. The chart line documenting that you asked and they agreed.

MGMA publishes a sample patient consent form for AI dictation and transcription as a member tool, if you'd rather adopt a template with a committee's fingerprints on it than draft your own. Whatever you use, the Sharp complaint is the argument for making it real: a portal note that says "consented" is worth nothing if the workflow behind it didn't ask.

Does "we never store the audio" remove the consent requirement?

No, and we'll say it plainly because no-stored-audio is our own architecture. Recording statutes regulate the act of capturing a conversation, not the archive you keep afterward. A scribe that processes audio in memory and discards it the moment the note drafts is still recording while it listens. Consent still applies. All eleven states, every visit.

What the architecture does change is your exposure after the fact. AI Scribe by Patient Square is an ambient AI medical scribe that listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft, ready to review and sign about two minutes after the visit. The visit audio is processed in memory and discarded once the note is drafted, so there's no recording to subpoena, breach, or leak later. In a case shaped like Sharp's, the thing plaintiffs reach for first, the retained audio sitting in a vendor's cloud, simply doesn't exist.

That's a smaller risk surface, not a smaller duty. You still ask. You still document. The difference shows up the day someone files. If you want to see how vendors actually differ on this, our audio-retention comparison across major scribes puts the retention windows side by side, because almost nobody else does. And if you want to see what "audio never stored" looks like in the workflow, book a demo and ask exactly what happens to the recording after the note is written.

What a small practice should do before turning on a scribe

For a three-clinician practice this is an afternoon, not a project:

1. Check your state. All-party? Build signage plus intake-form plus verbal ask. One-party? The verbal ask and a chart line are enough.
2. Check your telehealth footprint. See patients across state lines and the stricter state's law is your safe assumption. Confirm with counsel.
3. Write the consent into the workflow, not into the portal after the fact. The Sharp complaint is what "after the fact" looks like when it goes wrong.
4. Ask your vendor what happens to the audio, and get a one-sentence answer with a timeline. Vague retention language means indefinite retention.
5. Document that you asked. Producible-on-request is the standard every recording-consent dispute eventually turns on.

We think the vendors worth your time make consent easier and the audio question boring. Ours: audio never stored, a BAA for every customer including solo practices, TLS 1.2+ in transit and AES-256 at rest, SOC 2 Type II underway, notes owned by your practice and exportable or deletable anytime. The receipts are on our security page, written to be read skeptically.

The honest evaluation is a week of real visits with the consent script running on every one. Book a short demo and ask exactly what the audio does after the note is written, then run the 7-day trial on your own Tuesday clinic. Consent is your obligation in all fifty states; the right tool just makes asking the easy part.