AI Scribe Laws Tell Patients About the Tool, Not the Error

Rhode Island Requires Notice and Review. Vermont Requires Approval. Neither Tests Whether the Clinician Catches Anything.

by Sam Rogers
7 min read
analysis
healthcare
patient-safety
governance
regulated-industries
AI Scribe Laws Tell Patients About the Tool, Not the Error

This article is for educational purposes and does not constitute legal or medical advice. Organizations subject to state AI documentation notification laws should consult qualified counsel about their specific obligations.

Telling a patient the note was written by AI protects nobody if the clinician signed it without reading it.

Two States, Two Verbs

Three months ago on June 22, 2026, Rhode Island enacted the Use of Artificial Intelligence by Healthcare Providers Notification Act, effective on passage. The operative section is one sentence, and it's worth reading in full. Any healthcare provider or facility that employs AI to document in-person or telehealth visits shall notify patients of the use of AI for that purpose and review the AI-generated documentation for accuracy after the visit. The definition of provider reaches physicians, physician assistants, dentists, nurses at every license level, nursing assistants, and anyone else licensed by the state health department.

Five days earlier, on June 17, Vermont's Act 156 took effect on passage. It regulates AI in mental health services and conditions a professional's safe harbor on two things: the tool is HIPAA-compliant, and the professional reviews and approves any mental health services the tool touches. At EveryAILaw, the Rhode Island record and the Vermont record both carry the human oversight obligation category (Rhode Island's carries transparency as well). That is an index of what the statutory text asks for, not a finding that either statute applies to any particular provider.

Two states, two verbs. Rhode Island says notify and review. Vermont says review and approve. Both put a licensed person between the model's output and the patient's record, and both stop right there. Neither says what the review must find, how long it may take, or what happens when the reviewer is on their thirtieth note of the day at six in the evening.

The timing isn't accidental. On September 2 and 3, 2026, less than 90 days after Rhode Island's law took effect, NIST and the HHS Office for Civil Rights held their Safeguarding Health Information conference, with a NIST AI Risk Management Framework session and an AI in Healthcare roundtable on the September 3 agenda. Ambient documentation is the AI deployment most clinicians have already met, and it's the one regulators are reaching for first.

What Notification Proves

A notice tells the patient that a machine drafted the note. That's worth something. It's honest, it's cheap, and the patient can object.

It proves nothing about the note. A patient who's told the visit was recorded by AI has no way to know whether the medication list in the resulting document is the one they described, whether the negative finding on exam became a positive one in the summary, or whether a symptom they mentioned twice appears at all. The disclosure is about provenance. The risk is about content, and content is what the clinician's review exists to check.

Rhode Island's drafters understood this, which is why the review requirement sits in the same sentence as the notice. The review is the control. The notice is the courtesy. Everything that matters to the patient depends on the second clause, and the second clause is the one nobody can see.

The Errors Clinicians Actually Face

The research on LLM-generated clinical notes has converged on a small, stable taxonomy. A 2025 PLOS Digital Health study of emergency department encounter summaries scored every error against three criteria: inaccuracy of summarized information, hallucination of information not present in the source, and omission of clinically relevant information. Inaccuracies and hallucinations clustered in the plan sections. Omissions clustered in the physical examination and history of presenting complaint.

A separate clinical safety framework built from more than twelve thousand clinician-annotated sentences uses the same two primary categories, hallucination and omission, and grades each error for potential harm. The PLOS study reports that individual errors on average had low potential for harm, with a small number rated as having potential for permanent harm. The framework paper separates major from minor errors and reports driving major errors down through prompt and workflow changes. The PLOS authors draw the conclusion that matters here: understanding where and what kind of errors appear is what makes clinician review workable, because the errors aren't evenly distributed.

The taxonomy matters because these errors fail in different directions. An omission produces a note that reads cleanly and is missing something. A hallucination produces a note that reads cleanly and contains something false. A negation flip turns denies chest pain into reports chest pain and reads cleanly either way. None of them announces itself. The note we most need to read slowly is indistinguishable, at a glance, from the one we could skim. Fluency is the medium. It carries no information about accuracy.

Review Under Clinic Pressure

Now put the statutory review inside a real clinic day.

Ambient scribes were adopted to give time back, and they do. The clinician who used to spend the evening writing notes now spends it reading them. The queue is long, the notes are polished, and the first twenty were fine. Anyone who's reviewed a stack of fluent AI output knows what comes next. The operational drift sequence runs the same way it runs everywhere else. Adoption increases. Output volume increases. Verification rigor decreases. False confidence increases. Human review becomes performative. Drift accumulates. Liability emerges.

At every point the record shows a signed note with a timestamp. The audit trail is complete. Rhode Island's review requirement was satisfied in the sense that a licensed person clicked a button. Whether the review happened in the sense the drafters meant, a person reading a document for the specific error types the literature says are there, is invisible to the patient, the health system, the state, and often to the clinician.

A notice of AI use doesn't change this. A signature line doesn't change this. A policy requiring review doesn't change this. Every one of those artifacts records that a review was supposed to happen. Not what they report, what they do.

What a Health System Can Measure Without Reading a Note

The obvious fix is monitoring: log the edits, time the reviews, flag the clinicians who sign fast. There's a vendor deck for it already, I'm sure. I'd push back on that one. It builds a surveillance system over licensed professionals, it breaks in unionized and academic environments, and what it produces is edit counts, which measure activity and say nothing about whether the omission in the exam section was caught.

PAICE (People + AI Collaboration Effectiveness) takes the other route. It measures behavioral reliability by assessment rather than observation. The assessment seeds errors of exactly the kind the scribe studies describe, an omitted finding, a fabricated detail, a flipped negation, inside polished output, under time pressure, and scores whether the person detects them, verifies the claim that carries the decision, and escalates when something can't be confirmed. A clinician who sounds fluent about AI but signs the flipped negation scores lower than a terse one who catches it.

The results hold no patient data, no note text, no recording, and no transcript. Scores attach to hashed identifiers. Individual results are structurally unavailable to the health system rather than withheld by policy. A chief medical information officer sees the verification reliability of a cohort and where it degrades. The clinician sees their own.

Rhode Island and Vermont have written the clinician's review into law. That's the right control. The question a health system can now answer, before a state auditor or a plaintiff's expert asks it, is whether the review is real.

Want to assess your clinicians' verification behavior without surveillance? Learn about PAICE for organizations or take an individual assessment to see it firsthand.

Curious but short on time?

Take the 3-minute PAICE Pulse — a quick confidence check that maps how you see your own AI collaboration posture. No login required.