Posted on
Mar 5, 2026
Is AI Scribing Legal in Indiana? (2026 Compliance Guide for Healthcare Providers)
Quick Answer
Yes, AI scribing is legal in Indiana when implemented in compliance with state recording laws and federal privacy regulations. Indiana is a one-party consent state for recording conversations, which means that only one party to the conversation needs to consent to the recording. In a clinical encounter, the healthcare provider participating in the conversation can serve as the consenting party. However, legal permissibility under recording law is only one component — HIPAA compliance, professional ethics obligations, and patient trust considerations all apply and are addressed in detail below.
Practice in Indiana? Scribing.io is fully compliant with Indiana recording laws. Try it free.
Recording Consent Laws in Indiana
Indiana's wiretapping and eavesdropping law is codified under Indiana Code § 35-33.5-5-5 (Interception of Communications). Under this statute, it is a crime to intercept or record a telephonic or electronic communication without the consent of at least one party to the communication. Indiana also addresses eavesdropping under Indiana Code § 35-45-2-5, which prohibits eavesdropping — defined as the unauthorized interception of communications by someone who is not a party to the conversation.
The key legal distinction is this: if you are a party to the conversation (e.g., the treating physician or clinician), you may lawfully record or capture the conversation without obtaining consent from the other party under Indiana law. A third party who is not participating in the conversation, however, may not secretly intercept or record it.
For AI scribing purposes, the AI tool is functioning as an instrument of the healthcare provider — the consenting party — to document the clinical encounter. This places it squarely within the scope of one-party consent, provided the provider is a participant in the recorded conversation.
One-Party vs Two-Party Consent: What It Means for Your Practice
Understanding the distinction between one-party and two-party consent states is critical for compliance:
One-party consent (Indiana's standard): Only one participant in the conversation needs to consent. The physician or clinician who is part of the encounter can authorize the AI scribe to capture the conversation.
Two-party (all-party) consent: Every participant must agree to the recording. This is the standard in states like California, Florida, and Illinois, but it is not the standard in Indiana.
While Indiana's one-party consent law means you are not legally required to obtain the patient's permission to record, there are important reasons to consider doing so anyway:
Professional ethics: The American Medical Association (AMA) encourages transparency with patients about how their information is captured and used.
Patient trust: Informing patients about AI-assisted documentation fosters transparency and strengthens the therapeutic relationship.
Risk mitigation: Obtaining explicit consent reduces the likelihood of complaints, disputes, or allegations of privacy violations.
Interstate telehealth: If you provide telehealth services to patients in two-party consent states, the stricter standard may apply. Always verify the patient's location at the time of the encounter.
HIPAA Requirements on Top of State Law
Compliance with Indiana recording law does not eliminate federal obligations. Any AI scribing solution used in a clinical setting involves the capture, processing, and potentially the storage of protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160 and 164.
Key HIPAA Requirements for AI Scribing
Business Associate Agreement (BAA): Under 45 C.F.R. § 164.502(e) and § 164.504(e), any AI scribing vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity must execute a BAA. Do not use any AI scribing tool unless the vendor will sign a BAA.
Minimum Necessary Standard: Under 45 C.F.R. § 164.502(b), only the minimum necessary PHI should be used or disclosed. Ensure the AI scribe captures only clinically relevant information and that recordings are not retained longer than necessary.
Security Safeguards: Under the HIPAA Security Rule (45 C.F.R. §§ 164.302–164.318), appropriate administrative, physical, and technical safeguards must be in place. This includes encryption of audio data in transit and at rest, access controls, and audit logging.
Patient Rights: Under 45 C.F.R. § 164.524, patients retain the right to access their medical records, including AI-generated clinical notes that become part of the designated record set.
Notice of Privacy Practices: Under 45 C.F.R. § 164.520, covered entities must provide patients with a notice describing how PHI is used and disclosed. If AI scribing represents a material change in how PHI is handled, your Notice of Privacy Practices should be updated accordingly.
Patient Consent Best Practices for Indiana
Even though Indiana's one-party consent law does not require patient permission for a participating provider to record, implementing a clear consent process is strongly recommended. Below are best practices for Indiana healthcare providers:
Update your intake forms: Add a clear, plain-language disclosure that AI-assisted technology may be used during clinical encounters to assist with documentation. Include a signature line or checkbox for patient acknowledgment.
Provide verbal notification: At the start of the visit, inform the patient that an AI scribe is being used. Example: "I use an AI-powered tool to help document our conversation so I can focus more on your care. The recording is used only for your medical notes and is handled in compliance with privacy laws."
Offer an opt-out option: While not legally required in Indiana, giving patients the ability to decline AI scribing demonstrates respect for patient autonomy. Have a workflow for manual documentation if a patient opts out.
Document consent in the chart: Note in the patient's record that they were informed about and consented to (or declined) AI-assisted documentation.
Post signage in the office: Consider posting notices in waiting areas and exam rooms alerting patients that AI-assisted documentation tools may be in use.
Train all staff: Ensure that every clinical and administrative team member understands the consent process, how the AI scribe works, and how to respond to patient questions or concerns.
What Happens if You Don't Comply?
Non-compliance can carry significant consequences at both the state and federal level:
State-Level Consequences
Criminal liability: Violating Indiana Code § 35-33.5-5-5 by intercepting a communication without any party's consent is a criminal offense. Classification and penalties depend on the specific circumstances and may include fines and imprisonment.
Civil liability: Individuals whose communications are unlawfully intercepted may bring civil actions for damages under Indiana law.
Medical board complaints: Patients who feel their privacy was violated may file complaints with the Indiana Medical Licensing Board, potentially triggering investigations into professional conduct.
Federal-Level Consequences (HIPAA)
Civil monetary penalties: The HHS Office for Civil Rights (OCR) may impose penalties ranging from $141 to over $2,134,831 per violation category per calendar year (as adjusted for inflation under 45 C.F.R. § 160.404).
Criminal penalties: Knowing violations of HIPAA can result in criminal prosecution under 42 U.S.C. § 1320d-6, with penalties up to $250,000 in fines and up to 10 years imprisonment for offenses involving intent to sell or use PHI for commercial advantage or malicious harm.
Reputational damage: HIPAA breach notifications, OCR investigations, and publicized enforcement actions can significantly harm a practice's reputation and patient confidence.
Implementation Checklist
Use the following checklist to ensure your Indiana practice implements AI scribing in a compliant manner:
Step | Action Item | Status |
|---|---|---|
1 | Confirm your AI scribe vendor will execute a HIPAA-compliant Business Associate Agreement (BAA) | ☐ |
2 | Verify that audio and text data are encrypted in transit and at rest | ☐ |
3 | Confirm data retention and deletion policies — ensure recordings are not stored longer than necessary | ☐ |
4 | Update your Notice of Privacy Practices to reflect the use of AI-assisted documentation | ☐ |
5 | Add an AI scribing disclosure and acknowledgment section to your patient intake forms | ☐ |
6 | Develop a verbal notification script for providers to use at the beginning of encounters | ☐ |
7 | Establish a clear opt-out workflow and alternative documentation process for patients who decline | ☐ |
8 | Train all clinical and administrative staff on the consent process and common patient questions | ☐ |
9 | Post visible signage in waiting areas and exam rooms regarding AI-assisted documentation | ☐ |
10 | Conduct periodic compliance audits to ensure ongoing adherence to state and federal requirements | ☐ |
11 | Verify telehealth patient locations — apply the stricter consent standard if the patient is in a two-party consent state | ☐ |
12 | Consult with a healthcare attorney licensed in Indiana to review your specific implementation | ☐ |
Disclaimer: This guide is for informational purposes only and does not constitute legal advice. Laws and regulations may change. Healthcare providers should consult with a qualified attorney licensed in Indiana to address their specific circumstances.
