Answer · Healthcare
Does a practice have to tell patients when a message was written by AI?
In some states, for clinical content, yes. The requirement disappears when a licensed provider reads the message before it goes.
Where the message carries clinical information and no licensed provider read it, several states now require a disclaimer and a way to reach a human. Provider review before sending removes the requirement entirely.
California legislated this first and its structure is the one worth understanding, because other states have followed the shape. AB 3030, in force since 2025, requires health facilities, clinics and physician practices to attach a disclaimer to patient communications about clinical information that were generated by a generative tool, together with clear instructions for how the patient can reach a human provider. The disclaimer's placement is specified by medium: at the start of a letter or email, throughout a continuous chat interaction, verbally at the beginning and end of an audio interaction, and displayed throughout a video one.
Two boundaries do most of the work. The requirement attaches to clinical information, so scheduling, reminders, billing and other administrative traffic falls outside it. And a communication read and reviewed by a licensed or certified provider before it goes is exempt, which is the provision that decides most practices' answer: the compliant workflow they already wanted — a draft a clinician approves — is also the one that carries no disclaimer obligation.
That exemption is doing something more interesting than it appears. It means the statute is not regulating the drafting tool at all. It is regulating whether a clinician stood behind the message, and using the disclaimer as the signal when nobody did. A practice deciding how to comply is therefore really deciding how much of its patient correspondence it is willing to send unread, and the disclosure is the price of that decision rather than a paperwork step alongside it.
Enforcement sits with the licensing boards rather than with a privacy regulator, which changes who the exposure lands on. A physician's non-compliance is a matter for the medical board, which makes this a professional licensing question for the individual as well as an operational one for the practice. Practices that placed the obligation with their compliance function alone tend to have missed that.
The obligation is separate from, and additional to, the privacy analysis. Whether the practice may put the patient's information into the tool is answered by the business associate arrangement and the underlying authorisation rules; whether the resulting message needs a disclaimer is answered by this. Both can be satisfied, both can be breached, and satisfying one says nothing about the other.
For practices operating in more than one state, the practical response is not to track the variation. Applying the disclaimer everywhere costs almost nothing, reads as candour rather than as legal hedging, and removes a class of question nobody wants to answer during an inspection. The route to a human matters more than the disclaimer in any case, because it is the part a patient can act on — and a disclaimer with no working escalation route is the version of compliance that annoys patients without helping them.
The rule is not that a practice may not use these tools; it is that an unreviewed clinical message has to say so, which prices review against disclosure.
Siddharth Sharma, Context Theory
Related questions
Does an appointment reminder need the disclaimer?
Not under the clinical-information trigger, because a reminder conveys logistics rather than clinical content. The line gets blurry when the reminder carries preparation instructions, a medication hold, or a result-related prompt, and a practice that automates both from the same template should assume the clinical trigger applies to the template rather than argue message by message.
Is a light skim by a provider enough to claim the exemption?
The exemption is written around the provider having read and reviewed the message, which is a statement about what the provider did rather than about how long it took. The practical test is whether the provider would be comfortable saying they had reviewed it if the message turned out to be wrong. A queue that a clinician clears at a rate no reading could support is not review, and the volume is visible in the system logs.
METHOD
Every figure below carries its source and the date it was verified. Nothing on this page is asserted.
The numbers on this page.
| What | Value | Specific to |
|---|---|---|
| Dentists & dental services CPC | $8.00 | Category-wide |
| Firms that never responded to a web enquiry at all | 23% | Category-wide |
LocaliQ / WordStream Search Advertising Benchmarks 2026 · Google + Microsoft Ads, 20 industries · Apr 2025–Mar 2026 · verified
Oldroyd, McElheran & Elkington, "The Short Life of Online Sales Leads", Harvard Business Review (March 2011) · 1.25M inbound leads across 2,241 US firms · verified
What is specific to this page.
| Kind | Claim | Check it against |
|---|---|---|
| Regulation | California requires a disclaimer on generative communications that concern patient clinical information, together with instructions for contacting a human provider, with placement specified separately for written, continuous chat, audio and video media. | California AB 3030 and the health and safety code provisions it added, in force since 2025. |
| Constraint | A communication read and reviewed by a licensed or certified provider before it is sent falls outside the disclaimer requirement, which makes clinician review an alternative to disclosure rather than an additional step alongside it. | The review exemption in the statutory text, compared against whether the practice's message queue records who approved each outbound message. |
| Licensing | Non-compliance by a physician is a matter for the state medical board rather than for a privacy regulator, which places part of the exposure on the individual clinician's licence in addition to the practice's operations. | The enforcement provision naming the Medical Board of California and the Osteopathic Medical Board of California. |
| Workflow | Administrative traffic such as scheduling, reminders and billing falls outside the clinical-information trigger, so a practice can automate the majority of its outbound message volume without engaging the requirement at all. | Classifying a month of outbound patient messages by whether they convey clinical information, using the practice's own message templates. |
Each row would be wrong on another industry's page. Where a sourced figure exists it is in the table above instead; these are the constraints that shape the work and do not happen to be numbers.
Start with the measurement.
Reading about a benchmark is not the same as knowing your own number. The audit produces yours, measured rather than estimated.
$497 · delivered in 5 business days · credited against month one