Posted on
May 2, 2026
Is AI Scribing Legal in South Dakota? (2026 Compliance Guide for Healthcare Providers)
Quick Answer
Yes, AI scribing is legal in South Dakota when implemented in compliance with state recording consent laws, HIPAA regulations, and professional medical standards. South Dakota is a one-party consent state, meaning that only one party to a conversation must consent to its recording. As the physician conducting the encounter, your own consent to the AI scribe's recording satisfies the minimum legal threshold under South Dakota law. However, HIPAA obligations and medical ethics best practices strongly recommend—and in many cases functionally require—that you also obtain and document patient consent.
Practice in South Dakota? Scribing.io is fully compliant with South Dakota recording laws. Try it free.
Recording Consent Laws in South Dakota
South Dakota's wiretapping and electronic surveillance law is codified under SDCL § 23A-35A-20, which makes it a crime to intercept or record any wire, electronic, or oral communication without the consent of at least one party to that communication. This statute is part of South Dakota's broader chapter on interception of communications (SDCL Chapter 23A-35A).
Under this framework:
One-party consent is sufficient. If you, the physician, are a party to the clinical conversation, your consent to the AI scribe's recording satisfies the statutory requirement.
It is unlawful to record a conversation to which you are not a party without obtaining consent from at least one participant.
Violations of SDCL § 23A-35A-20 can result in criminal penalties, including felony charges under certain circumstances.
It is important to note that this statute governs the legality of the recording itself. It does not address the separate obligations healthcare providers have under federal law (HIPAA) regarding the use, storage, and disclosure of protected health information (PHI) captured by AI scribing tools.
One-Party vs Two-Party Consent: What It Means for Your Practice
In a one-party consent state like South Dakota, a physician who is participating in the clinical encounter may legally authorize an AI scribing tool to record and transcribe the conversation without technically requiring the patient's permission under state wiretapping law.
However, there is a critical distinction between what is legally permissible under state recording law and what is required under healthcare regulations and professional ethics:
Requirement | South Dakota State Law | HIPAA / Federal | Medical Ethics Best Practice |
|---|---|---|---|
Patient consent to record | Not required (one-party consent) | Not explicitly required for treatment operations, but transparency is expected | Strongly recommended |
Patient notification of AI tool use | Not specifically addressed | Required under Notice of Privacy Practices obligations | Required |
PHI safeguards for recorded data | Not specifically addressed | Required under Security Rule | Required |
The practical takeaway: while South Dakota's one-party consent framework provides a permissive legal environment for AI scribing, responsible implementation demands patient transparency and documented consent.
HIPAA Requirements on Top of State Law
Regardless of South Dakota's permissive recording laws, any AI scribing tool used in a clinical setting must comply with the Health Insurance Portability and Accountability Act (HIPAA), specifically:
Business Associate Agreement (BAA)
Under 45 CFR § 164.502(e) and 45 CFR § 164.504(e), any AI scribing vendor that processes, transmits, or stores protected health information on behalf of your practice is a business associate. You must have a signed Business Associate Agreement in place before using the tool. This BAA must specify how the vendor will safeguard PHI, handle data breaches, and limit use of the information.
Minimum Necessary Standard
Under 45 CFR § 164.502(b), your practice must ensure that the AI scribe collects and processes only the minimum necessary PHI to accomplish its documentation purpose. Configure the tool to avoid capturing unnecessary sensitive information outside the scope of the clinical encounter.
Notice of Privacy Practices (NPP)
Under 45 CFR § 164.520, your Notice of Privacy Practices must inform patients about how their PHI is used and disclosed. If you are using AI-powered documentation tools, your NPP should be updated to reflect this. Patients have a right to understand that technology, including artificial intelligence, may be involved in processing their health information.
Security Rule Compliance
Under 45 CFR Part 164, Subpart C, all electronic PHI (ePHI) generated by an AI scribe—including audio recordings, transcripts, and generated clinical notes—must be protected with administrative, physical, and technical safeguards. This includes encryption in transit and at rest, access controls, and audit logging.
Patient Right to Access
Under 45 CFR § 164.524, patients retain the right to access any records generated about them, including AI-generated clinical documentation. Ensure your practice can produce these records upon request.
Patient Consent Best Practices for South Dakota
Even though South Dakota law does not mandate patient consent for recording when one party consents, the following best practices are strongly recommended for healthcare providers using AI scribing tools:
Provide verbal notification at the start of each encounter. Inform the patient that an AI-powered documentation tool will be used to assist with note-taking during the visit. Use plain, clear language such as: "I use an AI-assisted tool to help document our conversation today. This helps me focus on your care rather than typing notes. The recording is processed securely and becomes part of your medical record. Do you have any questions or concerns about this?"
Obtain written consent during intake. Include an AI documentation consent form as part of your patient intake paperwork. This form should explain what the tool does, how data is stored, who has access, and the patient's right to opt out.
Offer an opt-out option. Patients should have the ability to decline AI scribing without it affecting the quality of their care. If a patient opts out, document the encounter manually or through traditional methods.
Update your Notice of Privacy Practices. Explicitly reference the use of AI documentation technology in your NPP. This satisfies HIPAA's transparency requirements and establishes a clear record that patients were informed.
Document consent in the medical record. Whether consent is verbal or written, note it in the patient's chart for each visit where AI scribing is used. This creates a defensible record in the event of a complaint or audit.
Train all staff. Ensure that front desk personnel, medical assistants, and nursing staff understand the AI scribing workflow and can answer basic patient questions about the technology.
What Happens if You Don't Comply?
Non-compliance with the applicable legal and regulatory framework carries several categories of risk:
State Criminal Liability
If an AI scribing tool is deployed in a manner that violates SDCL § 23A-35A-20—for example, recording a conversation to which no consenting party is present—the responsible party could face criminal charges. Under South Dakota law, unlawful interception of communications can be charged as a Class 5 felony under SDCL § 23A-35A-20, carrying potential penalties of up to five years imprisonment and fines.
HIPAA Penalties
Failure to comply with HIPAA requirements can result in civil monetary penalties enforced by the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Penalties are tiered under 42 USC § 1320d-5 and can range from $137 to over $2 million per violation category per year (adjusted annually for inflation). Willful neglect of HIPAA requirements that remains uncorrected can result in penalties at the highest tier.
Medical Board Discipline
The South Dakota Board of Medical and Osteopathic Examiners has authority to investigate complaints and impose discipline for unprofessional conduct. While no South Dakota-specific precedent exists as of 2026 regarding AI scribing discipline, failure to maintain appropriate patient privacy and informed consent practices could be viewed as unprofessional conduct under SDCL § 36-4-30, which outlines grounds for disciplinary action.
Civil Litigation
Patients who believe their privacy was violated may pursue civil claims. While South Dakota does not have a comprehensive state health data privacy law separate from HIPAA, patients can bring claims based on common law invasion of privacy, breach of the physician-patient relationship, or negligence in safeguarding medical information.
Reputational Harm
Beyond formal legal consequences, improper handling of AI scribing can erode patient trust. In a state like South Dakota where healthcare providers often serve smaller, close-knit communities, reputational damage from a privacy incident can have outsized impacts on practice viability.
Implementation Checklist
Use this checklist to ensure your South Dakota practice is fully compliant when deploying AI scribing technology:
Confirm your AI scribing vendor will sign a HIPAA-compliant Business Associate Agreement (BAA).
Verify the vendor uses end-to-end encryption for audio capture, transmission, and storage.
Confirm the vendor's data retention and deletion policies align with your practice's records retention requirements.
Update your Notice of Privacy Practices to reference AI-powered documentation tools.
Develop a patient-facing AI scribing consent form for inclusion in intake paperwork.
Establish a verbal notification script for providers to use at the beginning of each encounter.
Create a documented opt-out workflow for patients who decline AI scribing.
Train all clinical and administrative staff on AI scribing policies and patient communication.
Document patient consent (verbal or written) in the medical record for each encounter.
Conduct a security risk assessment that includes the AI scribing tool as part of your ePHI environment.
Review and audit AI-generated clinical notes regularly for accuracy and completeness.
Establish an incident response plan that covers potential data breaches involving AI scribe data.
Consult with a South Dakota healthcare attorney to review your specific implementation for compliance.
This guide is provided for informational purposes only and does not constitute legal advice. Healthcare providers should consult with a qualified attorney licensed in South Dakota for guidance specific to their practice circumstances. Laws and regulations are subject to change; verify all cited statutes and regulations for current applicability.
