What healthcare practices need to know about AI

Your AI scribe could be a crime in about a dozen states

AI medical scribes are everywhere now — they listen to the visit and draft the note. What most practices don't realize: recording a patient encounter without consent isn't just a privacy issue. In roughly a dozen states it can be a crime.

About a dozen states require all parties to consent before a conversation is recorded — including California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington (a few others vary by call type). Penalties range from civil damages to criminal charges. In Florida, recording a conversation without consent can be a third-degree felony — up to five years and a $5,000 fine (Fla. Stat. § 934.03). An ambient AI scribe records the encounter, so using one without specific patient consent can put the provider on the wrong side of that line.

This isn't theoretical. Patients have filed putative class actions against health systems over AI-scribe recording without consent — including Saucedo v. Sharp HealthCare (San Diego Superior Court, Nov. 2025) and, in 2026, suits against Sutter Health and MemorialCare over a widely used ambient scribe — alleging violations of state medical-confidentiality and invasion-of-privacy laws and the Federal Wiretap Act. These are filed complaints, not rulings; the claims have not been decided.

And the part that surprises practices most: the liability lands on you, not the vendor. A vendor's terms — and even FDA clearance for other AI tools — don't transfer the risk. Under malpractice law, HIPAA, and these recording statutes, the practice and the clinician carry it.

The law actually rewards governance. California, for example, exempts AI-generated patient communications from its AI-disclaimer mandate when a licensed provider reviews them (Cal. Health & Safety Code § 1339.75) — a statutory recognition that human review is what makes AI use defensible.

What actually protects you isn't avoiding AI — it's governing it. For an ambient scribe: (1) specific, documented patient consent to record (not buried in a general treatment consent), (2) a provider review-and-edit step before the note is signed, and (3) a BAA covering the audio and transcript. The practices that can show those three things — with an audit trail — are positioned to defend the tool.

An AI Governance Shield™ assessment produces exactly that: a documented, independently verified record of your AI governance — including consent capture and an audit trail — so if a patient, a regulator, or your malpractice carrier ever asks, you have the answer on file.

This article is general information, not legal advice; recording laws and AI regulation vary by state and change frequently. Confirm your state's rule with counsel.

AI can code your claims. You still sign them.

Practices are handing coding and documentation to AI — autonomous coders, ambient tools that suggest codes, risk-adjustment engines. The pitch is speed and revenue. The risk that comes with it is federal, and it doesn't transfer to the vendor.

The False Claims Act (31 U.S.C. § 3729) imposes liability on anyone who “knowingly presents, or causes to be presented, a false or fraudulent claim for payment.” When an AI tool produces a code the documentation doesn't support and that claim goes to Medicare or Medicaid, the practice that submits it owns the exposure — civil penalties (currently adjusted to roughly $14,308–$28,619 per claim) plus treble damages. “The AI did it” is not a defense; the statute turns on what you submitted.

This is an active enforcement priority. The Department of Justice reported a record $6.8 billion in False Claims Act recoveries in FY2025, stood up a dedicated fraud-enforcement division, and has flagged AI-driven EHR and coding manipulation as a focus. In January 2026, Kaiser Permanente paid $556 million to resolve Medicare Advantage risk-adjustment coding allegations — the kind of chart-mining that AI coding tools are built to automate.

And this one is federal, which matters right now: even as Washington moves to preempt some state AI laws, the False Claims Act is untouched by that fight. The exposure doesn't go away.

What defends you is the same thing across every regime — human review and an audit trail. Codes validated against the underlying documentation, a sign-off step before claims go out, and periodic audits comparing AI output to the record. An AI Governance Shield™ assessment documents exactly those controls for AI-assisted coding, so if a payer, an auditor, or the government ever asks, your oversight is already on the record.

This article is general information, not legal advice. Penalty amounts are inflation-adjusted and change; confirm current figures and your obligations with counsel.