Back to top
Healthcare Innovation

AI Scribe and Healthcare AI Consent Forms: Free Templates

Written By:
Robert Henehan
•
August 16, 2026
AI Scribe and Healthcare AI Consent Forms: Free Templates

Last reviewed August 16, 2026. This page is general information, not legal advice; confirm your own situation with counsel or your compliance lead.

If you use BastionGPT to draft notes, record and transcribe visits, or prepare letters and summaries, you may need to tell patients about it, and in a growing number of jurisdictions you need their written consent before AI records a session. This page gives you free consent form templates for the United States, Canada and Australia in mental health and medical versions, a plain-language summary of when consent or disclosure is required, and a workflow for documenting it.

When patient consent is required for AI: the short answer

It depends on where you practise and on how you use AI, and the rules tightened in 2025 and 2026:

  • United States. HIPAA does not require patient consent to use an AI vendor that operates under a Business Associate Agreement for treatment or operations, so drafting and summarizing with BastionGPT sits in the same category as your EHR or a transcription service. Two other layers do apply: recording-consent statutes in the all-party-consent states, which are triggered the moment an AI scribe records a conversation, and a new set of state laws (listed below) that require written, revocable consent before AI records or transcribes a therapy session, or require you to disclose AI use to patients.
  • Canada. PIPEDA and provincial health-privacy statutes such as Ontario’s PHIPA rest on knowledgeable consent, and regulators have said an AI scribe needs it. The CMPA advises obtaining consent before recording any clinical encounter and documenting the discussion, the CPSO’s 2025 advice says physicians must obtain consent before recording conversations with AI, and Ontario’s Information and Privacy Commissioner (January 2026) calls express consent recorded in the chart best practice.
  • Australia. Ahpra’s guidance expects practitioners to tell patients when AI is used and to obtain informed consent before patient information goes into an AI tool or a consultation is recorded, and state and territory surveillance-devices laws can make recording a private conversation without consent an offence. Medical defence organisations recommend a brief verbal confirmation at each consultation, noted in the record.

The practical rule: if you only type or dictate your own notes into BastionGPT, notice (a sentence in your privacy notice or intake paperwork) is usually enough outside the disclosure states. If BastionGPT will record or transcribe the visit, get express consent first, in writing where your state or regulator requires it, and document it in the record.

Download the consent form templates (DOCX and PDF)

Each one is two pages, written in plain language for patients, and covers: what BastionGPT does and does not do; audio recording and transcription as a separate tick-box choice; how information is protected (encryption, no model training, in-country hosting, clinician review of every draft); benefits and limits; the right to decline or withdraw without affecting care; the access, correction and complaint routes for the region; a signature block with a parent, guardian or substitute decision-maker line and a verbal-consent option; and a shaded box of practice notes (which state, provincial and regulator rules apply) to delete before use. Edit the DOCX; use the PDF to preview or print.

Mental health consent forms

Medical consent forms

Free to use and adapt, no signup. Fill in every bracketed item, delete the uses you do not offer, and have your counsel or compliance lead review the final version. The mental health versions say “client” and “session”; the medical versions say “patient” and “visit”.

US state laws that require consent or disclosure for AI documentation

These are the laws that bind a clinician who uses AI to record, transcribe or draft documentation, current to August 16, 2026. Our 50-state guide to healthcare AI laws covers the whole landscape; the entries below are the ones that change a consent workflow.

  • Colorado (HB 26-1195, effective August 12, 2026). Psychotherapy licensees need clear, written, revocable consent before AI records or transcribes a session, must review AI-generated recommendations, and may not deny care to a client who refuses.
  • Illinois (WOPR Act, effective August 1, 2025). AI may record or transcribe a therapy session only after the client is informed in writing and gives explicit, revocable written consent.
  • Maine (LD 2082, effective July 29, 2026). Written notice and written, revocable consent before AI is used in a recorded or transcribed therapy session; AI is limited to administrative and supplementary support under the licensee’s responsibility.
  • Rhode Island (two laws signed June 22, 2026). Any provider who uses AI to document visits must notify patients and review the AI documentation for accuracy (R.I. Gen. Laws ch. 23-106); mental health providers need written consent before AI is used in recorded or transcribed sessions (H 7349/S 2197).
  • Louisiana (Act 649, effective August 1, 2026). Tell patients before the appointment or treatment begins if AI recording or transcription software will be used.
  • Texas (SB 1188, effective September 1, 2025, and TRAIGA, effective January 1, 2026). Practitioners must disclose AI use to patients and review AI-created records; TRAIGA adds a general duty to disclose AI use in health care services no later than the first date of service.
  • Utah (SB 226, effective May 7, 2025). Anyone in a licensed occupation must prominently disclose, verbally at the start of a spoken interaction or in writing before a written one, when a patient is interacting with generative AI in a high-risk interaction, which includes collecting health data or giving medical or mental health advice.
  • Nevada (AB 406, effective July 1, 2025). Mental and behavioral health providers may use AI for notes and billing only if they independently review the AI output; AI may not deliver care directly.
  • Arizona (Board of Behavioral Health Examiners rule, effective January 1, 2027). Documented informed consent before any service that uses AI to provide, record or document clinical services.
  • California (AB 3030, effective January 1, 2025). AI-generated patient communications about clinical information need a disclaimer unless a licensed provider reviews them. California is also an all-party recording-consent state, and class actions filed in 2026 against health systems allege that ambient AI scribes recorded patients without meaningful notice or consent under the state’s privacy and medical-confidentiality laws.

Recording consent applies everywhere. Independently of AI-specific law, an AI scribe that records audio is subject to state recording statutes. All-party consent (or notice) states include California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania and Washington, with mixed rules in a few others. The safe habit in every state is to say what the scribe does before it starts and to record the patient’s answer in the chart.

Canada and Australia: what regulators expect

Canada

PIPEDA and provincial health-privacy statutes are built on knowledgeable consent, and there is no provision that lets an AI scribe collect, use or disclose personal health information without it. Ontario’s IPC (AI Scribes: Key Considerations for the Health Sector, January 2026) says express consent recorded in the health record is best practice, that consent must be knowledgeable (the patient knows a scribe is in use and why, and can withhold consent), that patients who decline must receive the same care, and that companions in the room are being recorded too. The CMPA’s AI Scribes FAQ (revised December 2025) advises obtaining consent before any recording, explaining the purpose and the privacy and accuracy risks, and documenting the discussion; the CPSO’s 2025 Advice to the Profession on AI says to obtain consent before recording conversations and to review every AI-generated note. Federal reform is pending: Bill C-36 (introduced June 15, 2026) would replace PIPEDA and is scheduled for second reading in the fall. Our Canada templates reflect all of this and leave a marked space for your provincial law. See also our guide to PIPEDA compliance for Canadian users.

Australia

The Privacy Act 1988 and the Australian Privacy Principles govern the collection of health information, and Ahpra’s guidance (Meeting your professional obligations when using Artificial Intelligence in healthcare) expects practitioners to understand the tool, tell patients when AI is used, obtain informed consent before patient data is entered or a consultation recorded, and apply their own judgement to every output. State and territory surveillance-devices laws are why recording consent matters most: in several jurisdictions recording a private conversation without consent is an offence. The practical routine recommended by medical defence organisations is a short explanation at the first visit, a verbal confirmation at each consultation, and a note in the record; if the patient declines, the consultation proceeds without the scribe. Our Australia templates include the OAIC’s contact details and a space for your state or territory health-records act. See also our guide to the Australian Privacy Principles.

Two ways to handle consent: general notice or a product-specific form

Practices take one of two approaches, and many use both.

1. Notice in your privacy documents. Where the law requires only disclosure, or nothing at all for typed and dictated use, a sentence in your Notice of Privacy Practices, privacy policy or intake pack that names AI-assisted documentation and your vendors’ obligations may be enough. Sample wording you can adapt:

  • United States: “Business associates and AI-assisted documentation. We use contracted service providers, including secure AI documentation software, to help prepare clinical notes and correspondence. These business associates are required by federal law (HIPAA) to safeguard your health information, may use it only to perform the work we have asked them to do, and do not use it to train AI models.”
  • Canada: “Third-party service providers. We use contracted service providers, including secure AI documentation software hosted in Canada, to help prepare clinical notes and correspondence. These providers are bound by written agreements and by law to protect your personal health information and to use it only for the purposes for which we engaged them.”
  • Australia: “Contracted service providers. We engage contracted service providers, including secure AI documentation software hosted in Australia, to help prepare clinical notes and correspondence. These providers must protect your personal information under the Privacy Act 1988 and the Australian Privacy Principles and may use it only to carry out the services they are contracted to provide.”

2. A signed, product-specific consent form. Where AI will record or transcribe, where your state or regulator requires written consent, or where you simply want the conversation on the record, use the templates above. They name BastionGPT, separate recording from drafting, and give patients a clear way to say no.

How to obtain and document consent: a workflow that holds up

  1. Before the first use. Give or read the form (or the notice) before BastionGPT touches the patient’s information. Texas requires disclosure no later than the first date of service; Louisiana requires it before the appointment when recording is involved.
  2. Say it out loud, briefly. A one-sentence script is enough: “I use a secure AI tool called BastionGPT to help me write up your visit. If you agree, it will record our conversation, produce a draft note that I review and correct, and delete the recording after 30 days. You can say no or ask me to stop at any time and it will not change your care.”
  3. Record the answer. Scan the signed form to the chart, or add a dated line noting verbal consent and who obtained it. Utah requires the disclosure to be prominent; Rhode Island, Nevada and Texas require you to review the AI note, so note that step in your workflow too.
  4. Handle the room. If a family member, carer or interpreter is present, tell them the visit is being recorded.
  5. Offer the alternative. If the patient declines, document by hand or by dictation without recording, and note the refusal.
  6. Re-consent when something changes. A new use (for example you start recording), a minor turning 18, a change of substitute decision-maker, or a yearly review at minimum. In Australia, confirm verbally at each consultation.

What the templates say about BastionGPT

Patients tend to ask the same four things, and the forms answer them in plain language:

  • A Business Associate Agreement is included on every BastionGPT plan; Canadian and Australian customers are covered by written data-protection terms that name PIPEDA, PHIPA and the Privacy Act.
  • Data is encrypted in transit and at rest and hosted in the United States, Canada or Australia to match the practice’s billing region.
  • Patient information is never used to train AI models, is never sold, and is never used for advertising or marketing.
  • Recordings and transcripts follow a retention window the practice sets (30 days by default), and the clinician reviews and approves every draft before it becomes part of the record.

The detail behind those statements is on our security and trust page and in our guide to what makes an AI HIPAA compliant.

Customizing the forms

The templates are a starting point. Add your practice name and contacts, keep only the uses you offer, set the retention period you have chosen in BastionGPT, translate the form where your patients need it, and have counsel or your compliance lead review the result against your state, provincial or territorial rules. If you would like us to look at your organization’s existing consent forms or contracts and suggest updates, contact us; we offer that as an hourly engagement. Quick questions are always free, and our support article on consent form templates stays current with the templates on this page.

Related templates and guides

Frequently asked questions

Do I need patient consent to use an AI scribe?

In most cases, yes, and it should be obtained before recording starts. In the United States, recording-consent laws in the all-party-consent states and AI-specific laws in Colorado, Illinois, Maine, Rhode Island, Louisiana, Texas and Utah require consent or disclosure; in Canada, the CMPA, the CPSO and Ontario’s IPC expect express consent documented in the record; in Australia, Ahpra expects informed consent before a consultation is recorded. Even where no statute applies, consent is the standard of practice for ambient recording.

Does HIPAA require patient consent to use AI for documentation?

No. HIPAA permits a covered entity to use a business associate for treatment and health care operations without patient authorization, and BastionGPT signs a Business Associate Agreement on every plan. Consent requirements come from state recording statutes, state AI laws, professional ethics codes and, outside the US, from privacy laws such as PIPEDA and the Australian Privacy Act.

Which US states require written consent or disclosure for AI documentation?

As of August 2026: Colorado, Illinois, Maine and Rhode Island require written, revocable consent before AI records or transcribes a psychotherapy session; Rhode Island also requires patient notification whenever AI documents a visit; Texas and Louisiana require disclosure of AI use, and Utah requires prominent disclosure when a patient interacts with generative AI; Nevada, Rhode Island and Texas require the clinician to review AI-generated notes; Arizona behavioral-health licensees must document informed consent from January 1, 2027. Recording-consent statutes apply on top of these in the all-party-consent states.

Is verbal consent enough, or do I need a signed form?

Verbal consent noted in the chart is acceptable in many settings and is the routine recommended by Australian and Canadian medical defence organisations, but written consent is required by law in Colorado, Illinois, Maine and Rhode Island for AI recording or transcription of therapy sessions, and a signed form is the easiest way to prove consent later. Our templates support both: a signature block and a verbal-consent line.

Do I need consent if I only type or dictate my own notes into BastionGPT?

Usually not as a separate signed form. Typed and dictated use is processing by a contracted vendor under a BAA or equivalent data-protection terms, which health-privacy laws generally permit with appropriate notice and safeguards. Disclosure states such as Texas and Louisiana, Utah’s rule for patient-facing generative AI, and any organizational or payer contract that requires you to name processors still apply, so a sentence in your privacy notice is the minimum.

What should an AI consent form include?

What the tool is and what it will do; whether the visit is recorded and transcribed, as a separate choice; how information is protected (encryption, no model training, hosting location, clinician review); benefits and limits; the right to decline or withdraw without affecting care; access, correction and complaint routes; retention of recordings; and a signature block that covers guardians or substitute decision-makers and verbal consent.

What happens if a patient declines or withdraws consent?

You document the visit another way, by hand or by dictation without recording, and note the refusal or withdrawal in the record. Care must not change; Colorado’s law and Ontario’s IPC guidance say so expressly, and every template on this page tells the patient the same thing.

Do I need to get consent at every visit?

A signed form covers ongoing use until it is withdrawn or your use changes, but you should confirm briefly whenever recording starts and re-consent when you add a new use, when a minor becomes an adult, when a substitute decision-maker changes, and at least yearly. In Australia, medical defence organisations recommend a verbal confirmation at each consultation.

Is patient information used to train BastionGPT’s AI models?

No. BastionGPT never uses customer inputs, documents, recordings or transcripts to train AI models, and does not sell or use them for marketing. Data is encrypted in transit and at rest and hosted in the United States, Canada or Australia to match the practice’s billing region.

Try BastionGPT free for 7 days

Draft progress notes, letters, and treatment plans in a HIPAA-compliant AI assistant. A signed BAA is included on every plan, and pricing starts at $20 a month.

Start your free trial