Patient consent and HIPAA for an AI scribe, state by state
What a practice needs to know before recording exams: HIPAA, the BAA, where audio and charts live, and each state’s recording-consent rule.
This guide gives general information and is not legal advice. Ask your own counsel about your practice’s specific requirements.
HIPAA and the BAA
The federal side is settled with paperwork. The state side is where consent is decided.
Business associate
Doctora is a HIPAA business associate and signs a Business Associate Agreement with every practice. The form of the BAA is public at app.doctora.io/baa. The contracting entity is Voyista, Inc., doing business as Doctora.
Patient authorization
Under HIPAA, using Doctora to create documentation for treatment, payment and health care operations needs no separate patient authorization. You do not need a HIPAA authorization form from each patient to use an AI scribe.
Consent to audio
State recording laws, not HIPAA, govern consent to audio. All-party states need everyone in the conversation to consent. One-party states need one participant. Streaming exam-room audio to a remote service can count as interception in an all-party state even when no audio file is kept.
Training
Patient data is never used to train AI models for anyone but the practice it came from. That restriction is written into every subcontractor agreement.
Where audio and charts live
Plain answers to the questions a privacy officer asks first.
Where it is stored
Charts and audio are stored and processed in the United States.
Visit audio
The practice decides whether audio is kept after the chart is written. When a practice keeps it, it is held for thirty days so the doctor can play it back from the transcript, then deleted.
Charts in your EHR
The charts Doctora writes into your EHR live in the EHR. Cancelling Doctora changes nothing there.
Who can see a chart
Every chart view, edit, export and write to the EHR is recorded in an audit trail. Doctora support looks at a chart only when the practice asks for help with it.
Who processes patient data
Every company that touches patient data for Doctora, and what it does.
Google Cloud
Where Doctora runs and stores data, in the United States. Bound by a BAA and by the restriction on training AI models.
OpenAI
The AI that drafts the chart, and the live transcription. Bound by a BAA and by the restriction on training AI models.
Anthropic
AI drafting. Bound by a BAA and by the restriction on training AI models.
Deepgram
Speech recognition. Bound by a BAA and by the restriction on training AI models.
Telnyx
Telephone audio transport, for practices that use the telephone features. Bound by a BAA and by the restriction on training AI models.
Stripe
Payments. Receives no patient data and is kept apart from the systems that hold it.
Amazon Web Services
Limited storage. Bound by a BAA and by the restriction on training AI models.
Recording consent, state by state
Click a state for its rule and the citation.
Interactive Consent Map
Hover or tap a state to preview the strictest consent rule.
Tap any state to open detailed workflow recommendations and legal citations.
Legend & Quick Guidance
Colors show the strictest consent requirement for in-practice recording or live AI scribing.
All-Party Consent (12)
Get explicit patient consent before any recording or transmission.
Mixed Rules (2)
Rules change based on in-person vs. telehealth conversations.
One-Party Consent (37)
Doctor consent is sufficient, but clear patient notice builds trust.
Use all-party workflows everywhere when possible.
The modal templates include scripting for verbal consent, chart documentation, and signage so teams can standardize quickly.
All-Party Consent Required (12 states)
Must obtain explicit patient consent before any audio capture or transmission.
Mixed Rules (2 states)
Requirements vary for in-person visits versus telephone or telehealth.
One-Party Consent (37 states)
Doctor consent alone satisfies the statutes, but we still recommend announcing and documenting consent everywhere.
The workflow that satisfies every state
Follow these four steps everywhere and you meet the strictest rule in every state and DC, while telling patients plainly what you do.
Written notice at intake
A plain-English disclosure that your doctor may use a secure AI scribe (Doctora) to help chart visits. Say that it is HIPAA compliant, used only for the patient’s chart, never used to train AI models for anyone but the practice it came from, and that patients can opt out anytime. A posted sign alone is not enough in an all-party state.
Verbal consent at the start of each visit
Suggested wording: To help me finish your chart accurately, I use a secure AI scribe that records our conversation and turns it into your chart. It is HIPAA compliant and used only for your chart. Is it okay to proceed? Then note it in the chart: AI scribe used (Doctora). Patient gave verbal consent to audio capture at [time].
Signage
Post it at check-in and in the exam lane: We use secure audio transcription to help chart your visit. Tell us any time if you prefer no recording.
Telehealth and phone calls
Open every telehealth or phone visit with the verbal consent and record the yes. In Connecticut and Nevada, make sure the consent is on the recording at the start of the call, or use an audible beep where the law allows it.
Ready-to-use templates
Copy these into your intake packet, your lane script and your signage.
Intake form language
One-time written consent for new patients
We use secure audio capture and an AI scribe (Doctora) to help document your visit. Doctora is a HIPAA business associate under a Business Associate Agreement; your information is used only to create your chart and is not used to train AI models. Your visit may be audio recorded for this purpose. You may opt out at any time without affecting your care.
Add this to your new patient intake forms, paper or digital.
Verbal consent script
Say this at the start of each visit
"To help me document accurately, I use a secure AI scribe that records our conversation and turns it into your chart. It is HIPAA compliant and used only for your chart. Is it okay to proceed?"
Ask before any audio recording starts, and note the consent in the chart.
Chart documentation macro
Record the consent in the patient chart
AI scribe (Doctora) used. Verbal consent obtained from patient at [time] before recording. Patient reminded of the right to opt out.
Add this note to each chart where the scribe was used.
Office signage
Post in the waiting room and exam rooms
We use secure audio transcription to help document your care. If you prefer no recording, tell your care team at any time.
Print and display at the check-in desk and in the exam rooms.
Telephone and telehealth script
For Connecticut and Nevada calls, and a good habit everywhere
"This call is being recorded for documentation purposes. Do I have your consent to proceed?"
Say it at the start of every phone or telehealth visit so the consent is on the recording.
Special considerations
Cross-border telehealth
If participants are in different states, follow the stricter of the two states’ rules. California’s all-party rule, for example, applies to a call with any participant in California, wherever the other party is.
Substance use disorder programs
After the 2024 final rule on substance use disorder records, one patient consent covers treatment, payment and health care operations, and a business associate can receive those records under it. A practice that is itself such a program still needs the consent that rule requires, so build it into intake.
Minors and sensitive services
For minors, mental health and reproductive health visits, follow your state’s existing rules on minor and guardian consent to recording. Keep the opt-out easy and the visit confidential.
Relying only on signage in an all-party state
Signs alone are not sufficient. You need the patient’s actual verbal consent.
Starting the recording before consent
Get the verbal yes before you press record.
Forgetting telehealth and phone rules
Connecticut, Nevada and California have their own telephone consent requirements.
Assuming no saved audio means no consent needed
Live transmission can still be an interception that requires consent in an all-party state.
What practices ask about compliance.
Do you sign a BAA?
Yes. Doctora is a HIPAA business associate and signs a Business Associate Agreement with every practice. The form of the BAA is public at app.doctora.io/baa.
Where is data stored?
Charts and audio are stored and processed in the United States. The charts Doctora writes into your EHR live in the EHR.
Is audio kept?
That is the practice’s choice. When a practice keeps audio, it is held for thirty days so the doctor can play it back from the transcript, then deleted.
What certifications does Doctora have?
Doctora is HIPAA compliant and signs a BAA with every practice. It does not claim any other certification.
Is a line on the intake form enough?
Not by itself in an all-party state. You need the patient’s consent before recording each visit, and verbal consent is fine if you document it. Intake language is still useful to set expectations.
Can we rely on posted signs?
Not as the only measure in an all-party state. Use signs to build awareness, not to replace getting consent.
Is verbal consent okay, or do we need signatures?
Verbal consent is legally sufficient in most states if you document it. Some telephone statutes, Connecticut’s for one, specify exactly how to give notice. The simple routine is written notice at intake plus verbal consent at the start of every visit.
What about cross-state telehealth?
Apply the stricter law when participants are in different states. California’s all-party rule, for example, applies to a call with a patient in California, wherever the doctor is.
Do we need consent if we are not saving the audio?
Yes. Even live audio sent to an AI service can count as interception under a state wiretap law. Get consent before any audio is sent.
Questions about compliance?
Talk to us about your state, your intake packet or the BAA before you start. Try Doctora free for your first 10 charts.
Per doctor, month to month or annual. HIPAA compliant, with a signed BAA.