California AB 3030 Generative AI Disclosure Requirements for Ambient Scribe Patient Messages: The 2026 Operations Playbook

California now regulates AI-drafted patient messages. Since January 1, 2025, Assembly Bill 3030 (Health and Safety Code §1339.75) has required California health facilities, clinics, physician offices, and group practices to label generative AI patient communications that contain clinical information. This playbook from Scribing.io explains which ambient scribe outputs trigger the law, how to document the human-review exemption, and how to build the disclosure step into daily clinical operations.

This guide is for administrators. It is written for Practice Administrators and CMOs who need to know where the compliance boundary sits, what evidence a surveyor or medical board investigator will ask for, and how Clinical-Grade Scribing tools should behave at the point of send. Throughout, we reference how Scribing.io and the Merry AI Clinical Interface apply these controls in behavioral health and outpatient specialty workflows.

• What AB 3030 Actually Requires

• Which Ambient Scribe Outputs Trigger AB 3030

• Disclosure Placement Rules by Communication Channel

• The Human Review Exemption: Audit-Grade Attestation

• Behavioral Health: The 10-Attendee IOP Group Workflow

• Outpatient Specialist: Modifier 25 and the Clinical Logic Bridge

• 90-Day Implementation Playbook for Administrators

• Governance, Enforcement, and Adjacent California Law

• Frequently Asked Questions

• Next Steps for Your Practice

What AB 3030 Actually Requires

The statute has two mandates. When a covered entity uses generative AI to produce written or verbal patient communications pertaining to patient clinical information, each communication must include a disclaimer that it was generated by generative AI. It must also include clear instructions describing how the patient can reach a human health care provider, employee, or other appropriate person.

One exemption carries most workflows. The requirements do not apply when the communication is read and reviewed by a human licensed or certified health care provider before it reaches the patient. For ambient scribe deployments, the operational question is therefore never "did AI draft this?" but "can we prove a licensed human reviewed this exact version before send?"

Core Statutory Elements at a Glance

Our full statutory breakdown lives in the California AB 3030 Compliance Guide, which tracks citations, enforcement pathways, and regulator commentary as they evolve.

Which Ambient Scribe Outputs Trigger AB 3030

The clinical note is not the target. A visit note drafted by Ambient Clinical Intelligence and signed by the treating clinician is internal documentation, not a patient communication. The risk surface is everything downstream of the note that travels to the patient.

Output Classification Matrix for Ambient Scribe Deployments

Watch the open-notes gap closely. Many EHRs release notes to the patient portal on a timer to satisfy 21st Century Cures Act information-blocking rules. If an AI-drafted note is released before the clinician signs it, you have sent an unreviewed generative AI clinical communication without a disclaimer.

Hybrid messages are not exempt. A message that mixes scheduling with clinical content, such as "Your A1c was 8.2; please book a follow-up," contains patient clinical information. Treat the whole message as covered.

Disclosure Placement Rules by Communication Channel

Placement rules vary by medium. AB 3030 does not accept a single universal footer. The statute specifies where the disclaimer must appear depending on how the communication is delivered.

Recommended Written Disclaimer Language

Template for written patient messages: "This message was generated using generative artificial intelligence. To speak with a member of your care team, call (XXX) XXX-XXXX, Monday through Friday, 8:00 a.m. to 5:00 p.m., or reply HUMAN in this portal thread. If this is an emergency, call 911. For a mental health crisis, call or text 988."

Avoid soft or hedged phrasing. Language such as "may have been assisted by technology" does not clearly indicate generative AI production. Investigators will read the disclaimer as a patient would, so write it at a sixth-grade reading level.

Localize the human contact path. A multi-site group should inject the site-specific phone number and hours, not a corporate switchboard. Behavioral health programs should always include 988 because a patient reading a group summary at midnight may be in crisis.

The Human Review Exemption: Audit-Grade Attestation

The exemption requires provable review. If a licensed or certified provider reads and reviews the message before sending, no disclaimer is required. In an investigation, an unsupported claim of review is functionally the same as no review.

What a Defensible Attestation Record Contains

• Reviewer identity and license type. Record the NPI or state license number and credential (MD, DO, NP, PA, LCSW, LMFT, PsyD) of the person attesting.

• Timestamp tied to send. The attestation timestamp must precede the transmission timestamp in the audit log.

• Version hash of content. Store a cryptographic hash of the exact text reviewed so any post-review regeneration is detectable.

• Edit delta from draft. Log what the clinician changed, which demonstrates substantive engagement rather than rubber-stamping.

• Explicit toggle, not default. The review attestation must be an affirmative clinician action, never pre-checked.

Regeneration voids prior attestation. If a clinician reviews a draft, then clicks "rephrase" or "shorten," the new text has not been reviewed. Merry AI resets the human-review toggle on any AI modification and re-applies the disclaimer until the clinician attests again.

Staff review does not qualify. The exemption applies to licensed or certified human health care providers. A medical assistant or front-desk coordinator who approves a portal reply does not trigger the exemption for clinical content.

Behavioral Health: The 10-Attendee IOP Group Workflow

Consider a common IOP scenario. A therapist runs a 3-hour Intensive Outpatient Program group with 10 attendees. Payers and accreditors expect an individualized note for each participant, and the program wants to send each patient a summary of the session's skills and homework.

Step One: Consent Before Capture

California requires all-party recording consent. Penal Code §632 prohibits recording confidential communications without the consent of every party. Every IOP attendee must consent before ambient capture begins, and the consent should be documented in each chart.

Substance use programs face Part 2. If the IOP is a federally assisted SUD program, 42 CFR Part 2 governs disclosures of the resulting records. Confirm that your ambient vendor operates under a Qualified Service Organization Agreement in addition to a BAA.

Step Two: One Recording, Ten Notes

Merry AI segments by speaker. The single 3-hour audio stream is diarized and attributed to each attendee, then split into 10 individualized notes. Each note captures that participant's own statements, affect, engagement, and progress toward treatment-plan goals.

• Participant-specific clinical content only. A patient with F41.1 (ICD-10-CM) generalized anxiety disorder receives a note documenting their own worry-exposure practice, not a peer's relapse disclosure.

• Cross-participant identifiers are redacted. Other attendees' names and disclosures are stripped from each individual note to preserve group confidentiality.

• Group-level context stays generic. Session topic and modality (for example, DBT distress tolerance) are recorded without attributing statements to other members.

• Kipu injection in one click. All 10 notes post to the correct Kipu patient records through the Scribing.io Kipu integration, mapped to the program's group note template.

Step Three: Cloned-Phrase Risk Flagging

Group notes invite cloning findings. When 10 notes are drafted from one session, identical sentences repeated across charts can resemble cloned documentation, which CMS contractors and auditors treat as a medical-necessity red flag. The Joint Commission's guidance on responsible AI use and its longstanding position on copy-forward documentation both point to the same control: individualized, verifiable entries.

Merry AI flags repeated narrative. Before injection, the system compares all 10 drafts and highlights sentences that appear verbatim across multiple charts. The therapist sees each flagged phrase in context and either individualizes it or confirms it is appropriately shared group content.

Step Four: The Group Summary Message

The summary is a patient communication. A post-session message describing coping skills practiced and homework assigned pertains to clinical information. Under AB 3030, it requires the AI disclaimer and human contact instructions unless the therapist reviews it first.

1. Merry AI drafts the summary. The draft is generated once and personalized per attendee, never sent as a single group thread exposing other recipients.

2. Extension inserts disclosure by default. The AB 3030 disclaimer and the program's human contact path, including 988, appear at the top of each message.

3. Therapist reviews or sends. If the licensed therapist reads, edits, and records the human-review attestation, the disclaimer is removed and the attestation is logged.

4. Audit trail is retained. Reviewer credential, timestamp, and version hash are stored with each of the 10 sent messages.

Manual Process vs. Merry AI Workflow

More behavioral health configurations are documented in the Specialty Clinical Playbook Library and on our behavioral health specialty page.

Outpatient Specialist: Modifier 25 and the Clinical Logic Bridge

Same-day E/M draws scrutiny. When an outpatient specialist performs a procedure and a separately identifiable E/M service on the same day, Modifier 25 must be supported by documentation showing work beyond the procedure's inherent pre-service evaluation. Weak documentation is one of the most frequent findings in post-payment review.

The Clinical Scenario

A cardiology patient presents twice-over. The patient is scheduled for elective cardioversion of persistent atrial fibrillation, a procedure with a 0-day global period. During the visit, the cardiologist also manages I50.22 (ICD-10-CM) chronic systolic heart failure, with a recent echocardiogram showing LVEF 35% and a documented failed trial of guideline-directed medication titration due to symptomatic hypotension.

How the Clinical Logic Bridge Works

Merry AI separates the two services. The Clinical Logic Bridge structures the note so the procedural assessment and the heart failure management are documented as distinct problems with distinct medical decision-making. It cites the objective anchors that justify separate E/M work.

• Objective severity anchor cited. LVEF 35% from the dated echocardiogram is linked directly to the heart failure assessment.

• Failed medication trial documented. The drug, dose reached, duration, and reason for failure (symptomatic hypotension) are recorded explicitly.

• New management decision captured. The revised GDMT plan, monitoring, and follow-up interval are documented as heart failure work, separate from cardioversion consent.

• Diagnosis linkage kept distinct. I50.22 is attached to the E/M line; the atrial fibrillation diagnosis is attached to the procedure line.

• Pre-procedure work kept separate. The routine pre-cardioversion history and consent discussion stay within the procedure, where they belong.

Why This Prevents a $15,600 Clawback

Extrapolation multiplies small errors. If an auditor samples claims and finds Modifier 25 unsupported, the error rate can be extrapolated across the practice's claim universe. At roughly $130 per denied E/M across 120 claims, a single cardiologist faces a $15,600 recoupment before appeals.

Documentation is the only defense. A note that cites LVEF 35%, a failed medication trial, and a separate plan gives the reviewer the evidence that the E/M was significant and separately identifiable. Our cardiology specialty page and the I50.22 coding reference detail the documentation elements reviewers look for.

The Portal Follow-Up Message

The follow-up is AB 3030-covered. After the visit, Merry AI drafts a portal message explaining the new heart failure medication plan and post-cardioversion instructions. Because it pertains to clinical information, the AB 3030 disclaimer and human contact path are inserted by default.

Physician review removes the disclaimer. If the cardiologist reads the message and records the human-review toggle, the disclaimer is removed and the attestation is logged. If the toggle is not recorded, the message sends with the full disclosure, so no unreviewed AI clinical communication leaves the practice unlabeled.

90-Day Implementation Playbook for Administrators

Treat this as a project. AB 3030 compliance spans IT, clinical leadership, compliance, and front-line staff. The sequence below reflects what we see work in California groups of 5 to 500 clinicians.

Days 1 to 30: Inventory and Classify

1. Inventory every generative AI touchpoint. Include ambient scribes, portal reply assistants, AI voice agents, patient education generators, and EHR-native drafting tools.

2. Classify outputs by AB 3030 status. Use the output matrix above to label each as internal, administrative, or covered clinical communication.

3. Audit open-notes release timers. Confirm AI-drafted notes cannot reach the portal before clinician signature.

4. Collect vendor attestation capabilities. Ask each vendor whether review attestations are logged with credential, timestamp, and version hash.

Days 31 to 60: Configure and Draft Policy

1. Standardize disclaimer language by site. Approve one template per channel, with site-specific phone numbers and hours.

2. Configure default-on disclosure everywhere. The disclaimer should be present unless a licensed reviewer removes it through attestation.

3. Write a review attestation policy. Define who qualifies as a licensed or certified reviewer and what "read and reviewed" means operationally.

4. Update recording consent forms. Address Penal Code §632 all-party consent and, where relevant, 42 CFR Part 2.

Days 61 to 90: Train, Monitor, and Audit

1. Train clinicians on regeneration risk. Make clear that any AI edit after review requires re-attestation.

2. Run weekly attestation sampling audits. Pull 20 sent messages per site and verify disclaimer presence or valid attestation.

3. Track override and edit rates. Clinicians who attest with zero edits on every message warrant coaching.

4. Report metrics to compliance committee. Present disclosure rates, attestation rates, and exceptions monthly.

Compliance KPIs to Track

Integration specifics for your EHR are available through the Scribing.io integration directory.

Governance, Enforcement, and Adjacent California Law

Enforcement follows the licensee. Physicians who violate AB 3030 are subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California. Licensed health facilities and clinics face enforcement through California Department of Public Health licensing provisions.

Licensure exposure ex