From solo providers to large health systems, nearly every healthcare practice is using artificial intelligence to make running a practice easier –– from documenting visits and communicating with patients to managing administrative work.
State lawmakers across the country are responding by establishing rules for how some of these tools can be used.
In the first half of 2026 alone, 84 new AI-related laws were passed or enacted across 27 states, according to the Transparency Coalition’s Mid-Year State AI Legislation Report. In most of these states, healthcare is attracting particular attention. For example, seven states limited health insurers’ use of AI in medical authorization decisions, while five states prohibited certain AI chatbot-based therapy services.
Some requirements are specific to the clinical encounter. In Louisiana, for example, a law that took effect Aug. 1, 2026, requires licensed healthcare professionals to verbally disclose the use of recording technology before recording any part of an appointment for AI transcription.
While requirements vary significantly by state and use case, together they signal to independent practice owners that AI governance should be part of your overall healthcare risk management.
Even if your state hasn’t enacted a law specifically addressing the AI tools you use, existing privacy and security obligations apply, as long as an AI scribe, transcription service or other third-party vendor has access to protected health information (PHI).
Below are recommendations for staying on top of whether AI software and vendors are protecting PHI.
How States Are Regulating AI in Healthcare: What Practice Owners Need to Know
No single state has a unified approach to regulating AI in healthcare, but they all focus on protecting consumers. Some lawmakers are focused on keeping humans involved in important healthcare decisions. Others are addressing AI-powered mental health services, patient disclosures, privacy or professional scope of practice.
For example, states are already taking several distinct approaches to healthcare AI regulation:
Colorado — HB 26-1139: Beginning Jan. 1, 2027, an insurance denial based in whole or in part on medical necessity cannot be issued solely on AI output without human review by an appropriately qualified healthcare professional. The law also prohibits payment for psychotherapy delivered directly by AI.
Nevada — AB 406: The law generally prevents mental and behavioral healthcare providers from using AI to directly provide professional mental health treatment, while allowing certain administrative uses such as scheduling, record management and organizing notes.
Illinois — HB 1806: Illinois prohibits AI from independently providing therapy or psychotherapy. When AI records or transcribes a session, the law requires written disclosure and patient consent.
California — AB 3030: California requires certain healthcare facilities, clinics and provider offices using generative AI to create patient communications about clinical information to identify those communications as AI-generated and provide instructions for contacting a human.
Together, these laws illustrate how lawmakers are paying closer attention to transparency, human oversight and how AI affects patients. No matter which state you practice in, providers should have similar goals for setting up guardrails around AI use.
How to Use AI in Your Practice Responsibly: Oversight, Disclosure, and Risk Management
With new AI legislation being proposed and enacted regularly, waiting for a specific law to tell you what to do isn’t the best risk-management strategy. Instead, establish responsible AI practices now to help prepare your business as regulations evolve.
AI Scribes and PHI: What Your Note Taking Tool Does With Patient Data
An AI scribe is one of the most common healthcare AI use cases. The software simplifies appointments and clinical notes by listening to and transcribing the patient-provider conversation, but the underlying data is anything but simple.
Patient names, symptoms, diagnoses, medications, treatment discussions and other sensitive information may pass through technology operated outside your practice. Depending on how the product is designed, information may be transmitted, stored or processed by the vendor or additional technology companies supporting the service.
Under HIPAA, when a vendor creates, receives, maintains or transmits PHI on behalf of a covered entity as a business associate, the appropriate business associate requirements generally apply. HHS guidance states that covered entities and business associates must enter into appropriate business associate contracts with vendors acting in that capacity.
As long as the technology creates, receives, maintains or transmits PHI on behalf of your practice, you must carefully review the vendor relationship before the technology becomes part of patient care.
Why “HIPAA Compliant” Is Not an Official Label — and What to Ask Instead
Many healthcare vendors describe their platform as “HIPAA compliant.” That can sound reassuring, but practice owners shouldn’t assume compliance without investigating.
No federal government certification gives an AI product a blanket seal of “HIPAA compliant.” Even security certifications, encryption, and a willingness to sign a business associate agreement do not, by themselves, establish whether a specific deployment meets all applicable HIPAA requirements.
Of course, a BAA matters when required, but you should still do your due diligence to understand what the technology actually does.
For example, if you use cloud services, conduct your own risk analysis by asking how data is retained, returned, protected and disclosed.
Key Questions to Ask Before Letting an AI Vendor Access Patient Data
Before allowing an AI vendor to handle PHI, practice owners should consider questions such as:
If the vendor retains audio recordings, transcripts, prompts or generated notes, how long is that information retained?
- Where is patient information stored?
- Is PHI used to train, fine-tune or improve an AI model?
- Does the company rely on subcontractors, cloud providers or outside AI models?
- What security safeguards protect the information?
- What happens to the data when the practice terminates the service?
Patient Disclosure for AI Tools: Why Transparency Is Good Risk Management
Many states have enacted laws requiring providers to disclose their use of AI in patient care, including in note-taking apps.
However, even if your state hasn’t addressed this question, it’s a good idea to verbally disclose the use of recording technology before recording a patient appointment. Patients will appreciate a simple notification, such as: “I’m using AI to transcribe our conversation so I can pay more attention to you instead of typing notes”
This allows patients to ask questions and opt out before a sensitive clinical conversation begins.
AI Governance for Independent Practices: A Starting Point for Any Practice Size
Large health systems have legal, procurement, privacy, cybersecurity, and IT teams evaluating new technology.
Independent practices may rely on one person to make all the decisions.
Start by identifying which tools are already being used. AI features increasingly appear inside software your practices already use, meaning you might not even be aware of every AI-enabled feature available to you.
Then establish rules for introducing new tools. For example, a practice AI policy might address:
- Which AI products are approved for use
- Whether employees may enter PHI into AI systems
- Who reviews vendors and BAAs
- How patients are notified
- Who reviews AI-generated documentation
- How suspected privacy or security incidents are reported
- How you monitor changes in state laws
AI regulation will keep changing, but responsible AI use does not have to begin with a new statute. Understand any new risks as your practice use of AI evolves.
CM&F leaders and our network of partners can help you navigate AI, privacy and compliance so you can mitigate risk. Learn how CM&F can help protect your growing healthcare practice and explore more resources for managing emerging practice risks.
