Recording Consent: The Law Beside HIPAA

If your agent records patient conversations — as AI scribes do — HIPAA is not your only legal obligation.

In all-party consent states (including California, Florida, Illinois, Pennsylvania, Washington, and others), recording a conversation without the consent of all parties can create civil and criminal liability independent of HIPAA. In January 2026, a California class action was filed against Sharp HealthCare over its use of Abridge's ambient AI documentation, alleging patient visits were recorded without proper consent in violation of California's Confidentiality of Medical Information Act and wiretapping statutes (with penalties up to $5,000 per violation).

What this means for dental practices:

• Obtain clear patient consent to record before using any AI scribe or ambient documentation tool

• Consent to record is separate from HIPAA authorization — you need both where both apply

• Post visible notices in addition to obtaining individual consent

• Understand that consent requirements vary by state — a workflow compliant in Texas may not be compliant in California

The Expanding Privacy Landscape

HIPAA is the federal floor, not the ceiling. Dental practices deploying AI agents should be aware of additional legal frameworks:

State privacy laws. The California Consumer Privacy Act (CCPA) as amended by CPRA, Washington's My Health My Data Act (which covers health-adjacent data beyond HIPAA's scope and provides a private right of action), and similar laws in Colorado, Connecticut, Virginia, and other states may impose requirements beyond HIPAA — including data minimization, purpose limitation, and consumer rights to access and delete.

FTC enforcement. The Federal Trade Commission has pursued health data misuse under its Section 5 authority. On July 29, 2026, the FTC — joined by California and Utah — filed suit against the telehealth company Hims & Hers, alleging it shared consumers' sensitive health information with advertising platforms including Meta and Snap despite promising privacy (N.D. Cal., Case No. 3:26-cv-07871).

The HIPAA Security Rule update. HHS proposed a major strengthening in January 2025: mandatory encryption of electronic PHI, multi-factor authentication, annual security risk analyses, asset inventories, and incident response plans. The rule has not been finalized as of late 2026, but the direction is unmistakable. Build your AI workflows as though these requirements are coming.