There is no general US legal requirement to get patient consent for every use of AI in clinical care. Informed consent law covers risks a reasonable patient would want to know. A growing set of state laws, such as those in California and Texas, now require disclosure for specific uses. Most patients say they want to be told.
A patient reads a message from her doctor in the portal. It is warm, clear and answers her question about a medication change. What she does not know is that a large language model drafted it and her doctor edited two words before sending. That same week, an algorithm flagged her as a high-risk patient and moved her up a care management list, and a radiology AI looked at her chest X-ray before a radiologist did.
Did she need to know any of this? Did anyone need to ask her?
Most patients never learn that AI touched their care. Whether they should is genuinely contested, and the honest answer is that it depends on what the AI did. My argument is that the debate has been framed around the wrong unit. The question is not “was AI involved?” It is “did AI change something a reasonable patient would care about, in a way she could not have assumed?” Blanket disclosure is easy to mandate and nearly meaningless. Targeted consent is harder to design and actually protects people.
This article is general information, not legal advice. It reflects laws and guidance as of May 2026.
Do patients want to know when AI is used in their care?
Yes, overwhelmingly. A national survey of 2,021 US adults, fielded in mid-2023 by Jodyn Platt, Paige Nong and colleagues at the University of Michigan and published in JAMA Network Open in December 2024, found that 62.7 percent said it was “very true” that they wanted to be notified about AI use in their health care. Almost everyone, 95.2 percent, rated notification as important to some degree. Older adults and people with more education wanted it most.
That wish sits alongside low trust. A companion study by Nong and Platt, published in JAMA Network Open in February 2025, found that about two thirds of respondents had low trust that their health system would use AI responsibly, and a majority had low trust that it would make sure an AI tool would not harm them.
Put together, the finding is not that patients oppose AI. It is that they do not trust institutions to tell them what is happening, and want a way to find out.
Is informed consent legally required for AI in clinical care?
Not as a general rule. Informed consent doctrine in most US states asks whether a clinician disclosed the risks, benefits and alternatives that a reasonable patient would consider material to a decision, a standard shaped by cases such as Canterbury v. Spence in 1972. The UK Supreme Court adopted a similar patient-centered test in Montgomery v Lanarkshire Health Board in 2015.
Courts have not settled when AI use is itself a material fact. Nobody gets consent for the software in a blood analyzer or the dose calculator in a pharmacy system. The argument for treating AI differently rests on its opacity, its variable performance across patient groups, and the possibility that it shifts a decision in a way the patient would want to weigh.
Specific laws are filling the gap one use at a time:
- California AB 3030, effective January 1, 2025, requires health facilities, clinics and physician offices that use generative AI to create patient communications about clinical information to include a disclaimer and instructions for reaching a human. The requirement falls away if a licensed provider reads and reviews the message before it is sent.
- Texas SB 1188, effective September 1, 2025, lets practitioners use AI for diagnostic and treatment purposes if they act within their license, review AI-generated records and disclose the use of AI to patients.
- In Europe, the AI Act will require from August 2026 that people be told when they are interacting directly with an AI system, such as a chatbot, unless it is obvious.
Professional guidance is moving the same way. The Joint Commission and the Coalition for Health AI, in guidance released in September 2025, recommended that patients be notified when AI directly affects their care and that consent be obtained when appropriate. The guidance is voluntary, but it comes from the body that accredits most US hospitals.
What kinds of AI use should require consent?
This is where the framing matters. “AI in healthcare” covers everything from a scheduling optimizer to an autonomous diagnostic system. Treating them the same produces either consent forms nobody reads or no disclosure at all.
A more useful approach sorts AI by what it does to the patient’s position:
Background operations. Scheduling, coding, supply forecasting and bed management. These affect patients indirectly and resemble other administrative tools. General transparency, such as a public list of AI systems the organization uses, is appropriate. Individual consent is not.
Clinician support with human review. A sepsis alert, an imaging second reader, an AI-drafted note the clinician checks. The clinician remains the decision-maker. Here, notification is reasonable, especially through general notices and on request. Individual consent for each use would be unworkable and would add little, provided the clinician is actually exercising judgment.
AI that speaks for the clinician. Generated messages, summaries or instructions sent to patients. Patients reasonably assume a human wrote a message signed by their doctor. If a machine did, and nobody meaningfully reviewed it, that assumption is false. Disclosure should be specific and in the moment, as California now requires.
AI that decides. Autonomous diagnosis, automatic triage or coverage decisions without meaningful human review. This is where consent, or at least a clear right to know and to request human review, matters most.
AI trained on the patient’s data. Using identifiable records to build or improve a model is a data use question. It is governed by privacy law, not clinical consent, but patients care about it and are rarely told.
A worked example: one clinic, three disclosures
Here is a hypothetical primary care practice that uses three AI tools.
The first is an ambient scribe that listens to visits and drafts notes. The practice asks each patient at check-in whether the visit can be recorded for documentation, explains that software creates a draft the clinician reviews, and records the answer. A patient who declines gets a visit without the scribe. This is the right level: recording a private conversation is something any reasonable patient would care about. Our earlier piece on ambient AI scribes discussed why these tools spread so quickly.
The second is an AI inbox assistant that drafts replies to portal messages. Clinicians review each draft. The practice adds a line to its general notice of practices and portal help pages explaining the tool. It does not label each message, because a clinician reviewed it. But the practice audits a sample monthly to check whether “review” means reading or just clicking send. As we argued in the real risk of AI-drafted patient messages, the risk sits in the clinician who agrees without thinking.
The third is a risk model that ranks patients for outreach by a care manager. Nobody is denied care by it, but people who score low get less attention. The practice publishes what the model does, what data it uses and how it was checked for bias, and lets any patient ask how their own ranking was produced.
None of this required a new consent form for every encounter. It required the practice to decide, tool by tool, what a reasonable patient would want to know.
What is the strongest argument against AI consent requirements?
The strongest argument is that disclosure without choice is theater, and choice is often impractical.
If a hospital’s radiology workflow runs every scan through an AI triage tool, a patient who objects cannot easily opt out without disrupting a system built around it. Telling her about a choice she cannot really exercise may increase anxiety without increasing autonomy. Worse, blanket notices can become a liability shield. A line buried in an admissions packet can be cited later as proof the patient “knew.”
There is also a fairness worry. If AI tools do improve accuracy, patients who opt out may get worse care. Consent regimes that make AI easy to refuse could entrench disparities if the patients most likely to refuse are those who already distrust the system for good reasons.
These are strong points. But they argue against consent for every use, not against meaningful disclosure where it counts. The survey data suggest the bigger risk runs the other way. When patients discover after the fact that AI was used without their knowledge, the damage is not to one decision but to trust in the institution. The fix is disclosure that is honest about what can and cannot be refused, and real choice where choice is possible.
What this means for hospitals, clinicians and policymakers
For hospitals, build an inventory of AI tools and classify each by what it does to the patient: background, support, speaking or deciding. Publish a plain-language list of AI tools in use. Set disclosure rules by category. Check whether your state has specific requirements, since California and Texas now do and others are considering similar laws.
For clinicians, the simplest practice is to say it aloud when AI shaped a recommendation in a way that matters: “The software flagged this and I agree, here is why.” Patients generally accept AI as a tool in a clinician’s hands. What erodes trust is finding out later.
For policymakers, write rules by function, not by technology. A requirement to disclose “any use of AI” will be diluted into boilerplate. A requirement to disclose AI-generated communications that no clinician reviewed, or decisions made without human review, is enforceable and meaningful. Our earlier piece arguing that who owns patient data is the wrong question makes the parallel case for data use.
Frequently asked questions
Do doctors have to tell patients they are using AI?
It depends on where they practice and what the AI does. There is no general federal requirement. Texas requires practitioners to disclose AI used for diagnostic or treatment purposes. California requires disclaimers on generative AI clinical communications not reviewed by a licensed provider. Elsewhere, general informed consent rules apply, which require disclosure of information a reasonable patient would consider material.
Can I refuse to have AI used in my care?
Sometimes. You can usually decline ambient recording of a visit, and you can ask whether a human reviewed a message or result. Declining AI embedded in systems, such as imaging triage, may not be practical. It is reasonable to ask your clinician which tools were used, what they did and whether a person reviewed the output before any decision.
Is AI use covered by HIPAA patient consent?
HIPAA generally lets providers use health information for treatment, payment and operations without separate authorization, and many AI tools fall under those uses when a vendor has signed a business associate agreement. HIPAA is about data privacy, not clinical consent. It does not require telling patients that AI influenced a clinical decision.
What does the Joint Commission say about AI and patient consent?
In September 2025, the Joint Commission and the Coalition for Health AI released voluntary guidance on responsible AI use. It recommends that organizations disclose AI use and educate patients, notify patients when AI directly affects their care, and obtain consent when appropriate. It does not change accreditation requirements, but it sets an expectation hospitals are likely to be measured against.
The takeaway
Asking whether patients should consent to AI treats a hundred different tools as one. The better question is which uses change something a patient would reasonably want to weigh. For background tools, publish what you use. For AI that speaks in a clinician’s voice or decides without one, tell the patient plainly and offer a real alternative. Patients are not asking for a veto over software. They are asking not to be surprised.
Have you ever found out after the fact that AI was used in your care, or a family member’s? How did it change your trust?
