Ambient AI Scribes: Building the Patient Consent and Post-Visit Review File

Dianne Bourque, Partner | Holland & Knight (Boston)

Ms. Bourque advises healthcare clients on data acquisition and use in artificial intelligence algorithm training, research, product development, and digital health applications, and counsels providers on HIPAA, 42 C.F.R. Part 2, and state medical privacy law compliance, including review of HIPAA-related contracts and forms and privacy-related due diligence. A substantial part of her practice involves counseling researchers and research sponsors on FDA- and OHRP-regulated clinical research, including patient consent, and she has served as counsel to a hospital’s Institutional Review Board and Ethics Committee overseeing those consent processes. She was formerly in-house counsel to an academic medical center and is the first Suffolk University Law School graduate to hold a concentration in Health and Biomedical Law.

• Education & Credentials

Suffolk University, MPA; Suffolk University Law School, J.D. (first Suffolk Law graduate with a concentration in Health and Biomedical Law); Boston College, B.A. Admitted to practice in Massachusetts.

• Recognition & Leadership

Named in The Best Lawyers in America guide for Health Care Law, 2020–2027, and in the Chambers USA – America’s Leading Business Lawyers guide for Massachusetts Healthcare, 2015–2017 and 2021–2026. Recognized as a Client Service All-Star by the BTI Consulting Group in 2022.

• Professional Involvement

Member, American Healthcare Lawyers Association, 2005–2025. Former adjunct professor at Stonehill College, teaching an undergraduate course on healthcare law, and a guest lecturer in the Boston College MS in Cybersecurity, Policy and Governance program and at Boston University Law School.

• Experience

Advised a national clinical lab on incident response and mitigation following a data breach affecting 12 million individuals, avoiding OCR enforcement, and represented a publicly traded precision medicine company in parallel OCR investigations opened by two regional OCR offices after back-to-back large-scale breaches, avoiding enforcement in both. Advised a national telehealth provider on the structure and implementation of its HIPAA compliance program and counseled a national provider of digital health products for oral care in a dispute with an overseas business associate vendor over the return of HIPAA-protected patient records. Provided regulatory and strategic advice, including data acquisition for algorithm training, to the developer of an AI-supported, hand-held medical imaging device and software platform. Served as counsel to the Institutional Review Board of a Massachusetts academic medical center and community hospital system, represented a national high-complexity genetic testing laboratory in structuring a collaborative data repository for testing and clinical outcomes data, and assisted a manufacturer of smart, wireless prescription bottles with structuring its patient interface consistent with privacy and data security law.

William F. Farley, Partner | Holland & Knight (Chicago)

Mr. Farley’s data privacy practice includes defending consumer-facing clients in class actions involving website wiretap litigation under federal and state law, including claims under the Video Privacy Protection Act and the Illinois Biometric Information Privacy Act (BIPA), and he advises clients nationwide on data privacy compliance and on responding to data breaches and other security incidents. He is an International Association of Privacy Professionals Certified Information Privacy Professional for the U.S. private sector (CIPP/US) and has used artificial intelligence and automation technology to organize, evaluate, and defend large volumes of claims, and advises clients on legal issues involving the metaverse. His client industries include healthcare and life sciences, banking and financial services, insurance, and technology.

• Education & Credentials

Loyola University Chicago School of Law, J.D.; University of Michigan, B.A., Political Science. Admitted to practice in Illinois, and before the U.S. District Courts for the Northern District of Indiana, the Southern District of Illinois, and the Northern District of Illinois, and the U.S. Tax Court.

• Recognition & Leadership

Named a Holland & Knight Emerging Leader, Class of 2020, and selected for the Chicago Bar Association Leadership Institute’s Inaugural Class, 2016.

• Professional Involvement

International Association of Privacy Professionals, CIPP/US, since 2020; member, Chicago Bar Association. Contributing author, Annals of Health Law, The Health Policy and Law Review of Loyola University Chicago. Maintains an active pro bono practice.

• Experience

Represented numerous consumer-facing clients defending class actions alleging invasion of privacy and violation of federal and state wiretap law arising from website recording, analytics tools, cookies, and pixels, and represented multiple Illinois employers defending BIPA class actions. Defended clients against claims that consumer website activity was recorded through session-replay software in violation of a state wiretap act, and advises clients on privacy policy and website functionality for compliance with state wiretap laws nationwide. Advises clients in the aftermath of data breaches and other security incidents, including remediation, investigation, and required notifications. Also represents clients in general commercial disputes, including supply chain, trade secret, and breach-of-contract matters, and is an experienced appellate lawyer before state and federal courts.

SESSION 1 – Building the Patient Consent and Privacy Framework for Ambient AI Scribes | 12:00pm – 1:00pm

This session examines the privacy, consent, and regulatory considerations healthcare providers should address before deploying ambient AI scribing technology. It will cover HIPAA, state medical privacy laws, all-party consent requirements, and emerging legal developments affecting the recording, transcription, storage, and use of patient encounters. The session will also address how providers can develop patient-facing disclosures and consent documentation that create a defensible compliance record.

BREAK | 1:00pm – 1:10pm

SESSION 2 – Building the Post-Visit Review, Record Retention and Vendor Risk File | 1:10pm – 2:10pm

This session focuses on the documentation and risk-management framework that should remain in place after an ambient AI scribe is activated. It will examine post-visit accuracy review, the treatment and retention of AI-generated notes and underlying data, and the contractual protections healthcare providers should seek from technology vendors. The discussion will also address how counsel can identify and mitigate privacy, clinical documentation, and regulatory risks associated with AI-generated patient records.