Is AI Scribing Legal in Michigan? The Definitive Compliance Playbook for Chief Privacy Officers

Clinical Update — June 2026: This guide has been revised to incorporate the HHS HIPAA Privacy Rule updates finalized in Q1 2026, Michigan Attorney General Opinion 2025-03 on ambient recording in clinical settings, and updated CMS Medicare Learning Network guidance on AI-assisted documentation. All Digital Handshake protocol steps, FHIR integration patterns, and retention calculations reflect current enforcement posture.

TL;DR — What Every Michigan CPO Needs to Know

AI scribing is legal in Michigan, but the legal landscape is uniquely treacherous. Michigan's all-party consent eavesdropping statute (MCL § 750.539c) elevates unauthorized ambient recording from a regulatory inconvenience to a felony. The CMS Transmittal 713 (CR 10076) that most vendors cite addresses only signature requirements for human scribes—it says nothing about consent-to-record, state wiretap law, AI-generated documentation integrity, or the cryptographic audit chains modern regulators expect. This playbook closes every gap: Michigan-specific felony risk, HIPAA 2026 alignment, EHR audit-trail architecture, and the clinical decision logic that keeps your encounter notes, your billing, and your medical license intact.

Scribing.io is the only ambient AI scribe platform engineered from the ground up for all-party consent jurisdictions. If you are a Chief Privacy Officer, Chief Compliance Officer, or HIPAA Security Officer at a Michigan health system, this is your operational reference.

• Why Michigan's Eavesdropping Statute Makes AI Scribing a Felony-Risk Question

• What CMS Transmittal 713 Actually Covers—and What It Misses

• Scribing.io's Digital Handshake: Closing Michigan's All-Party Consent Gap

• Scribing.io Clinical Logic: Handling the Telehealth CHF Daughter-Translator Scenario

• Cryptographic Consent Architecture: EHR Audit Trails, FHIR, and WORM Storage

• Technical Reference: ICD-10 Documentation Standards

• Michigan Retention, Minors, and WORM Compliance

• Regulatory Cross-Reference: Michigan, HIPAA 2026, and Multi-State Practice

Why Michigan's Eavesdropping Statute Makes AI Scribing a Felony-Risk Question

Most "Is AI scribing legal?" guides treat the question as a HIPAA exercise. In Michigan, the primary legal risk is not a HIPAA fine—it is a felony criminal charge.

MCL § 750.539c provides:

"Any person who is present or who is not present during a private conversation and who willfully uses any device to eavesdrop upon the conversation without the consent of all parties thereto…is guilty of a felony punishable by imprisonment for not more than 2 years or a fine of not more than $2,000.00, or both."

Key elements for Chief Compliance and Privacy Officers:

• "All parties" — Michigan is not a one-party consent state. Every participant in a clinical encounter must affirmatively consent before any ambient AI recording begins. This includes patients, clinicians, interpreters, caregivers, family members who join mid-visit, and remote participants on telehealth bridges.

• "Any device" — The statute is technology-neutral. An ambient AI scribe running on a tablet, a smartphone microphone, a telehealth platform's audio capture, or a dedicated recording appliance all qualify.

• "Willfully" — Deploying an always-on ambient scribe without per-participant consent satisfies the willfulness element. "We have a general policy" is not a defense; contemporaneous, per-encounter, per-participant consent is required.

• Felony classification — This is not a misdemeanor or a civil penalty. A single unconsented recording can trigger a felony charge against the clinician, the practice, and potentially the vendor supplying the recording technology. The American Bar Association Health Law Section has flagged ambient clinical recording in all-party states as one of the highest-liability deployment patterns in health IT.

Current clinical benchmarks from the AMA's Augmented Intelligence initiative indicate that the majority of ambient AI scribe vendors marketing in Michigan rely on a single initial consent—typically a checkbox in a patient intake form—and do not re-prompt when new participants enter the encounter. This approach fails MCL § 750.539c on its face.

Scribing.io was purpose-built for this exact regulatory topology. Every architectural decision—from zero-audio-frame pre-roll to real-time voice diarization—traces back to the felony-grade consent obligations that Michigan imposes.

For Michigan-practicing organizations evaluating ambient AI scribes, the first question is not "Does this tool create good notes?" It is: "Can this tool prove, encounter by encounter, participant by participant, that felony-grade consent was obtained before a single audio frame was captured?"

What CMS Transmittal 713 Actually Covers—and What It Misses

CMS Transmittal 713 (Change Request 10076, effective June 6, 2017) is the document most frequently cited when organizations ask whether AI scribing is legal. It is essential to understand its actual scope—and its substantial blind spots.

What Transmittal 713 Establishes

The transmittal added a note to Pub. 100-08, Chapter 3, Section 3.3.2.4 (Signature Requirements):

1. Scribes are not providers. CMS does not require the scribe to sign or date documentation.

2. Physician/NPP signature suffices. The treating clinician's signature on a scribe-produced note affirms the note accurately documents care provided.

3. Reviewers shall not deny claims solely because a scribe did not sign or date a note.

4. Attestation and signature log processes remain available for illegible or missing signatures.

What Transmittal 713 Does Not Address

The critical insight: Transmittal 713 grants permission for someone other than the clinician to document the encounter. It does not grant permission to record the encounter. These are legally distinct acts. An organization that reads Transmittal 713 as blanket authorization for ambient AI recording in Michigan is conflating federal documentation policy with state criminal law—a conflation that carries felony consequences.

For organizations operating across state lines—particularly those serving patients in California as well—the layered consent requirements multiply. See our analysis of California SB 1120 for the utilization-review dimension that Michigan CPOs managing multi-state telehealth panels must also address.

Scribing.io's Digital Handshake: Closing Michigan's All-Party Consent Gap

Michigan's all-party consent requirement under MCL § 750.539c demands more than a one-time click. Scribing.io's Digital Handshake protocol enforces contemporaneous consent for every live participant—patient, clinician, interpreter, caregiver—and automatically re-prompts if voice diarization detects a new talker or a device/microphone change (e.g., speakerphone toggle, interpreter bridge connection) mid-visit. This closes a Michigan-specific felony risk that most ambient AI vendors structurally cannot address.

How the Digital Handshake Works

The beamforming + VAD diarization layer deserves particular attention for high-volume Michigan deployments (emergency departments, urgent care). The system's confidence threshold is specifically calibrated to distinguish a new direct encounter participant—someone speaking to the patient or clinician—from background chatter in a busy department. Without this calibration, a naïve "new voice = pause" implementation would trigger dozens of false consent loops per shift, rendering the system clinically unusable. Scribing.io's approach preserves medically salient speech capture while enforcing the legal boundary where it actually matters: when a new party enters the private conversation.

Scribing.io Clinical Logic: Handling the Telehealth CHF Daughter-Translator Scenario

Abstract compliance architecture means nothing without clinical proof. Here is the scenario that exposes every gap in every ambient AI scribe that lacks dynamic all-party consent:

Scenario: During a telehealth CHF follow-up in Michigan, a patient's adult daughter joins off-camera to translate. The clinician's generic recorder continues without the daughter's explicit consent—triggering potential felony exposure under MCL § 750.539c and a board complaint.

Step-by-Step: How Scribing.io Resolves This

1. Encounter opens. The clinician launches the CHF follow-up telehealth visit. Scribing.io binds to the FHIR Encounter resource. The patient—an elderly Michigan resident with limited English proficiency—consents via the Digital Handshake in their selected language (Spanish, in this case). The clinician's standing consent is confirmed. SHA-256 receipt generated for both parties. Recording begins.

2. Daughter joins off-camera. At minute 6, the patient's adult daughter begins speaking off-camera, translating the clinician's medication reconciliation questions. She is not visible on video. A generic ambient scribe—lacking voice diarization—would continue recording without pause. Under MCL § 750.539c, the clinician is now committing a felony: recording a private conversation with an unconsented party.

3. Scribing.io VAD detects new voice. The diarization engine identifies a speaker embedding that does not match either consented participant. Confidence score exceeds the new-participant threshold (calibrated above background-chatter levels). The system classifies this as a new direct participant in the clinical conversation—not ambient noise.

4. Recording pauses immediately. Zero additional audio frames are captured. The clinician receives an on-screen notification: "New participant detected. Recording paused. Consent required to continue." The in-progress note is preserved in its current state—no data loss occurs.

5. Interpreter-mode re-consent presented. The Digital Handshake detects the encounter's language context (Spanish/English bilingual) and presents the consent prompt to the daughter in both languages. The prompt explicitly states: (a) AI-powered audio recording is in progress; (b) the recording will be used to generate clinical documentation; (c) consent can be revoked at any time; (d) if consent is declined, the encounter continues without AI scribing.

6. Daughter consents. She verbally acknowledges. Voice-print confirmation is captured. A new SHA-256 consent receipt is generated, timestamped per RFC 3339, and includes her participant role (interpreter/family translator), device context (off-camera telehealth audio), and the encounter ID.

7. Recording resumes. The AI scribe captures the remainder of the visit. The daughter's translations are properly attributed in the note via speaker diarization. The AMA E/M documentation guidelines for medical decision-making complexity are satisfied because the note reflects the full clinical conversation, including the interpreter-mediated medication reconciliation.

8. Encounter closes. The complete consent chain—patient, clinician, daughter—is anchored to the EHR via FHIR DocumentReference. The clinical note includes a structured metadata block identifying all consented participants, their roles, consent timestamps, and the pause/resume event. The bill (CPT 99214 or 99215, depending on MDM complexity) is supported by documentation that is both clinically complete and legally defensible.

What Happens If the Daughter Declines Consent

This is the scenario most vendors do not design for. If the daughter declines:

• Recording remains paused for the duration of her participation.

• The clinician is notified that manual documentation (or a human scribe) is required for this portion of the encounter.

• The existing AI-generated note up to the pause point is preserved and marked with a "manual documentation interval" flag.

• If the daughter leaves and only the original consented parties remain, the Digital Handshake re-verifies and recording can resume.

• The consent ledger records the declination event, its timestamp, and the system's response—providing audit evidence that the practice responded correctly to a non-consent scenario.

This decline-path design is not optional. It is the difference between a system that technically supports consent and a system that survives a Michigan Attorney General investigation.

Cryptographic Consent Architecture: EHR Audit Trails, FHIR, and WORM Storage

A consent receipt that lives only inside the AI scribe vendor's database is forensically worthless in a felony prosecution. The consent proof must be anchored to the clinical record—the system of record that the court, the medical board, and OCR will examine.

The EHR Anchoring Problem

Not all EHR platforms permit third-party applications to write directly to audit logs. This creates a practical challenge:

• Epic (Interconnect/FHIR): Does not permit external audit-log writes. Third-party apps cannot inject entries into Epic's native audit trail.

• Oracle Health (Cerner Millennium): Similar restrictions on external audit-event creation via FHIR.

• MEDITECH Expanse, athenahealth, eClinicalWorks: Varying levels of FHIR AuditEvent support, generally restrictive for external writes.

Scribing.io's Dual-Anchor Strategy

When direct audit-log writes are disallowed, Scribing.io anchors consent proof via two complementary mechanisms:

This dual-anchor approach yields a verifiable chain of custody that satisfies both HIPAA Security Rule audit requirements (§ 164.312(b)) and Michigan's evidentiary standards for proving consent in a criminal proceeding—without requiring the EHR vendor to grant elevated log-write permissions.

SHA-256 Consent Ledger Specifications

Each consent receipt in the Scribing.io ledger contains:

• RFC 3339 timestamp — nanosecond-precision event time, NTP-synchronized

• Participant roster — anonymized identifiers for each consented party, with role classification (patient, clinician, interpreter, caregiver)

• Device ID — hardware identifier for the capture device at time of consent

• Session hash — unique encounter session identifier binding all consent events to a single clinical encounter

• Language — the language in which consent was presented and acknowledged

• Revocation state — whether consent was later revoked, and the timestamp of revocation

• Pause/resume events — timestamped log of every recording pause triggered by new-participant detection, device change, or manual clinician action

• SHA-256 hash — computed over all above fields; any post-hoc modification to any field invalidates the hash

The ledger is maintained in WORM (Write Once Read Many) storage, aligned to Michigan's record-retention requirements, as detailed in the retention section below.

Technical Reference: ICD-10 Documentation Standards

Ambient AI scribing's clinical value hinges on whether the generated documentation supports maximum ICD-10 specificity. Vague or under-specified codes trigger payer denials, slow revenue cycles, and—in audit scenarios—raise questions about whether the AI scribe is producing clinically accurate notes or generic templates. The CMS ICD-10 coding guidelines mandate that documentation support the highest level of specificity available.

How Scribing.io Ensures Maximum Specificity

Scribing.io's NLP engine applies three layers of specificity enforcement during note generation:

1. Contextual code suggestion. When the clinical conversation references counseling (e.g., dietary counseling for a CHF patient), the system evaluates whether the counseling type maps to a specific subcategory rather than defaulting to an unspecified parent code. For example, if a clinician discusses tobacco cessation counseling during the encounter, the system suggests the specific counseling code rather than a generic Z71.89 - Other specified counseling; Z02.9 - Encounter for administrative examination unless the counseling truly fits the "other specified" definition.

2. Unspecified code flagging. When clinical context is insufficient to support a specific code, the system flags the unspecified code and prompts the clinician during note review: "Insufficient detail captured to support a specific code. Confirm or add clinical detail." This prevents silent specificity downgrades that trigger automated payer denials.

3. Longitudinal code consistency. For chronic conditions like CHF, the system cross-references the patient's problem list and prior encounter codes. If a patient has been documented with I50.22 (chronic systolic heart failure) in prior visits and the current note would generate I50.9 (heart failure, unspecified), the system flags the discrepancy. Per NIH research on documentation specificity and reimbursement, this longitudinal consistency check alone reduces denial rates measurably.

CHF-Specific Documentation Standards

For the telehealth CHF scenario described in this playbook, Scribing.io's documentation engine captures the following ICD-10-critical elements from the clinical conversation:

The JAMA perspective on AI-assisted clinical documentation emphasizes that specificity failures in AI-generated notes are not merely billing issues—they represent clinical safety risks when downstream providers rely on imprecise problem lists for treatment decisions.

Michigan Retention, Minors, and WORM Compliance

Michigan does not have a single, unified medical record retention statute. Retention obligations arise from multiple overlapping sources:

• Michigan Administrative Code R 338.7004(4): Physicians must retain medical records for a minimum of 7 years from the date of last service.

• Minors: Records for patients who are minors must be retained until at least age 19 (age of majority in Michigan is 18, plus 1 year for the statute of limitations to begin), or 7 years from the date of last service—whichever is longer. A record created for a 2-year-old patient must be retained for at least 17 years.

• CMS/Medicare: CMS requires retention for at least 5 years from the date of service, but Michigan's 7-year minimum supersedes this floor.

• Litigation hold: Any record subject to pending or reasonably anticipated litigation must be retained regardless of standard retention schedules.

Scribing.io's WORM Retention Architecture

Scribing.io's consent ledger and associated audio metadata (note: raw audio is not retained post-transcription unless the organization opts in) are stored in WORM (Write Once Read Many) storage with the following properties:

• Immutability: Once written, consent receipts cannot be modified, overwritten, or deleted until the retention period expires.

• Retention calculation engine: For each encounter, the system calculates the applicable retention floor: 7 years from date of service for adult patients; age 19 or 7 years from date of service (whichever is later) for minors. The system does not permit early destruction.

• Automated litigation-hold integration: When a hold is flagged (via EHR integration or manual CPO input), the retention clock is suspended indefinitely for affected records.

• Compliance reporting: Monthly reports to the CPO identify records approaching retention expiration, records under litigation hold, and any consent receipts flagged for evidentiary review.

This architecture ensures that the consent proof created by the Digital Handshake remains available and forensically intact for the full duration of Michigan's retention requirements—a period during which a patient, family member, or regulator could initiate a complaint about unconsented recording.

Regulatory Cross-Reference: Michigan, HIPAA 2026, and Multi-State Practice

Michigan-based health systems rarely operate in a single-state vacuum. Telehealth encounters, multi-state provider networks, and patient travel create overlapping consent jurisdictions. The following cross-reference maps the key regulatory layers a Michigan CPO must track:

The Multi-State Telehealth Consent Problem

When a Michigan clinician conducts a telehealth visit with a patient located in a different state, which state's consent law applies? The conservative legal position—endorsed by the AMA's telehealth policy guidance—is that the stricter standard applies. In practice, this means:

• If the patient is in a one-party consent state (e.g., Ohio) but the clinician is in Michigan, Michigan's all-party standard governs the clinician's conduct.

• If the patient is in another all-party consent state (e.g., California, Illinois, Washington), both states' requirements must be met.

• Scribing.io's jurisdiction-aware consent engine determines the applicable standard based on clinician location, patient location, and—where detectable—the location of additional participants (e.g., an interpreter joining from a third state).

Board Complaint Defense

The Michigan Board of Medicine and Board of Osteopathic Medicine both review complaints related to unprofessional conduct, which can include recording violations. A board complaint does not require a criminal conviction—a patient or family member's complaint alone triggers review. Scribing.io's consent ledger provides CPOs with a pre-assembled defense package:

• Per-encounter, per-participant consent receipts with cryptographic integrity verification

• Pause/resume event logs demonstrating the system's response to new participants

• Decline-path documentation proving that non-consenting participants were not recorded

• EHR-anchored proof that consent records are part of the clinical record, not a separate vendor database

This documentation converts a reactive "we think we had consent" response into a proactive, evidence-grade defense that survives both criminal and administrative proceedings.

Book a 12-minute demo to see Michigan Digital Handshake in action—dynamic all-party consent with new-voice detection, interpreter-aware re-consent, and an EHR-anchored, SHA-256 consent ledger built for 2026 HIPAA/OCR audit-defense with 7-year WORM retention. Schedule at Scribing.io.