DSIR 2026 Deeper Dive: Ambient AI in the Exam Room

At the end of a doctor’s appointment earlier this year, I asked my physician to show me how the ambient artificial intelligence (AI) tool he was using actually worked. I knew the technology was on – there was signage in both the exam room and waiting room disclosing its use – but I wanted to understand how the tool functioned in practice. My doctor, excited to show me, turned the computer screen toward me, hit “stop” on the app on his phone, and almost immediately my medical record began to populate with a polished summary of our visit, written as if he had typed it himself. Notably, the summary left out the opening small talk (“How are you?” and “How are the kids?”), as well as our random mid-visit discussion about data breaches in healthcare. What remained was a concise, clinically focused account of care.

This brief moment captured both the promise and complexity of ambient AI. As discussed in the 2026 Data Security Incident Response (DSIR) Report, implementation of AI tools in healthcare has accelerated significantly in the past several years. For patients, adoption is most visible in the exam room, where ambient AI tools listen to, transcribe, and summarize clinical encounters in real time. For healthcare providers under relentless documentation pressure, the appeal is obvious. But as AI integrations increase, so do the legal, privacy, and security implications. Organizations deploying these tools must navigate state laws drafted long before this technology or use case existed, emerging AI regulations, and professional ethics obligations.

For the healthcare industry, ambient AI illustrates a broader DSIR Report theme. Emerging technologies do not eliminate traditional risk – they reshape and sometimes amplify it.

Key Takeaways

• Healthcare organizations should evaluate ambient AI through multiple lenses, including privacy, security, regulatory compliance, ethics, and patient trust.
• State recording laws may create encounter-specific notice and consent obligations that extend beyond traditional Health Insurance Portability and Accountability Act (HIPAA) requirements.
• Regulatory expectations increasingly emphasize transparency, accountability, and meaningful human review of AI-generated outputs.
• The organizations best positioned to leverage ambient AI are those that pair innovation with strong governance and patient-centered implementation.

What Is Ambient AI & Why Are Providers Adopting It?

Ambient AI tools are designed to reduce documentation burden by passively recording clinical encounters, transcribing conversations, and generating visit summaries that are incorporated into the electronic health record. Some tools go further, assisting with coding, billing, or surfacing diagnoses and treatment recommendations. Additionally, ambient AI tools can be manually turned on and off—like the one used by my doctor—while others are voice-activated such that they are always “on” but only record when they detect a conversation.

For clinicians, the value proposition is very compelling. Documentation fatigue remains a persistent operational and workforce challenge, and ambient tools offer more direct engagement with patients during visits, reduced after‑hours charting and burnout risk, and more standardized and complete clinical documentation.

Legal and Ethical Considerations

Many healthcare providers initially approach ambient AI as a HIPAA compliance exercise, focusing on business associate agreements, security controls, and permissible uses of protected health information. While those issues remain important, the risk landscape is broader than HIPAA.

State Recording Laws

State recording statutes (aka eavesdropping or electronic surveillance laws) present one of the most immediate compliance issues for ambient AI deployment. Because these tools record private, in‑person conversations, they trigger consent obligations that vary significantly from state to state.

States generally fall into three categories:

• One‑party consent states, where only one participant in the conversation must consent to recording (here, the doctor).
• All‑party consent states, where every individual in the room – the doctor, the patient and any other person such as a nurse or a patient’s family member – must consent.
• Hybrid states, where the consent rule depends on whether the communication is electronic or in person.

Depending on the state, implicit consent, such as when an individual receives clear notice of a recording and voluntarily continues the conversation, is sufficient. Other states may require a more express verbal or written agreement. In the healthcare setting, organizations frequently rely on a combination of signage, patient intake materials, and/or verbal disclosures. However, because state recording laws were enacted long before the advent of ambient AI, questions remain regarding the duration and scope of any consent obtained.

For healthcare providers, the primary challenge is frequency of consent: state recording laws generally require notice or consent before or at the start of a recording. Because these statutes often refer to each “communication” or “conversation” in the singular, the notice/consent obligation may attach to each individual encounter, and not to the broader patient-provider relationship. As ambient AI becomes more visible, plaintiffs and regulators are questioning whether healthcare organizations are relying too heavily on one-time, generalized disclosures.

Informed consent is also a concern: a patient agreeing today to the use of ambient AI at a dermatology appointment may not understand the extent of that consent or want the same tool to listen in on a gynecology exam, which could present consent issues if both providers are within the same health system. Thinking critically about the varying sensitivities of the patient’s care spectrum, and how to operationalize renewing consent discussions, are essential aspects of ambient AI use in the care setting.

State AI Laws

States are increasingly enacting AI‑focused laws that emphasize disclosure, human oversight, and accountability, particularly where AI influences consequential decisions such as healthcare treatment or access to services. Most of these laws only require disclosure of AI use (as opposed to disclosure and consent). Other common themes include requiring providers to review the output generated by AI tools or exempting those that do; prohibiting the use of AI tools for certain types of care like mental and behavioral health; requiring disclaimer language on patient/consumer-facing communications that include AI-generated outputs; and outlining special considerations for “high risk” AI systems and/or those that may cause bias.

Ethics

Healthcare settings are unique environments with a central focus on trust, transparency, and respect for patient autonomy. As a result, legal compliance alone may not be sufficient to satisfy stakeholder expectations surrounding AI use. Even where applicable law permits recording with minimal formality, healthcare organizations should consider whether additional disclosures or consent practices are necessary to preserve confidence in the patient-provider relationship. Guidance from professional organizations and accrediting bodies continues to reflect broader ethical principles. The American Medical Association, The Joint Commission, and state-level associations and medical boards have consistently emphasized that AI should support, not displace, clinical judgment – and patients should not be left guessing about the role AI plays in their care or medical record.

In practice, this dilemma has translated into various emerging best practices such as proactively disclosing ambient AI use even in one‑party consent states, addressing patient questions and allowing them to decline participation where feasible, and requiring licensed clinicians to review, edit, and approve AI‑generated notes.

Where To Start – Practical Takeaways for Healthcare Organizations

Ambient AI can deliver meaningful benefits, but only when accompanied by thoughtful governance, appropriate oversight, and patient-centered implementation. As state regulators, professional organizations, and even patients continue to focus on the responsible use of AI in healthcare, organizations should consider the following foundational steps:

• Develop an AI governance program that establishes clear accountability for evaluating, approving, deploying, and monitoring AI-enabled technologies. The program should be led by a multidisciplinary team, incorporating representatives from compliance, privacy, information security, legal, and clinical operations. The program should address risk assessments, vendor review, acceptable use standards, human oversight requirements, change management procedures, and ongoing monitoring of AI performance and regulatory developments.
• Inventory ambient AI tools alongside all other clinical, operational, and patient‑facing AI. As highlighted in the DSIR Report, organizations should not overlook so-called shadow AI – unapproved or inadequately governed AI tools that may already be in use by workforce members. A comprehensive inventory should identify where AI is deployed, what data it processes, applicable vendors and sub-processors, and the risks associated with each use case.
• Standardize encounter‑level disclosure and consent practices, accounting for state law variability and ethical expectations. Healthcare organizations should treat ambient AI as a patient-facing activity rather than a purely internal documentation tool and build encounter-level disclosures, such as through room signage, check-in workflows, or clinical scripts.
• Enforce human review requirements so that AI-generated outputs never substitute for licensed clinical judgment. Ambient AI should be viewed as a tool that assists clinicians, not as a mechanism for delegating clinical decision-making; clinicians remain responsible for reviewing, validating, and approving AI-generated outputs before they become part of the medical record or influence patient care decisions.
• Train workforce members on the appropriate use of ambient AI. Clinicians and staff should understand the capabilities and limitations of AI tools, applicable disclosure and consent requirements, documentation expectations, escalation procedures, and organizational policies governing AI use.

The exam room will remain a human space. Ambient AI can support that goal by reducing administrative drag and improving focus on care. Realizing those benefits, however, requires more than technical implementation; it also requires embedding the principles of trust, transparency, and accountability into the design and governance of these technologies from the outset.