AI scribes are moving into veterinary exam rooms at speed. CoVet reported 550% user growth in 2025 across six continents and 20 languages. The pitch is compelling: less charting, shorter days, happier doctors. But every one of these tools records conversations between a veterinarian and a client, and that fact triggers a patchwork of state wiretapping laws, evolving veterinary board guidance, and data-retention questions that most practice owners have not thought through. Rolling out an AI scribe without understanding those obligations creates real legal and reputational risk. This article explains the legal landscape and gives you a practical compliance checklist.

HIPAA does not cover veterinary medicine

Pets are property under the law, not persons. The Health Insurance Portability and Accountability Act (HIPAA) governs human health information only. There is no HIPAA for veterinary records.

That does not mean veterinary clinics have no data obligations. The AVMA reports that 35 states have statutes addressing confidentiality for veterinary records. California, Florida, Georgia, Kentucky, and others impose specific duties on how veterinary medical information is handled.

California illustrates the point. Under California law, veterinary medical records may be shared with third parties only for purposes of diagnosis or treatment, and disclosure without the owner's consent is prohibited. Other states set their own retention minimums, access rules, and penalty structures.

The practical takeaway: even though HIPAA does not apply, veterinary practices have real data-protection duties under state law. AI scribes that record, transcribe, and store exam-room audio create a new category of sensitive data that sits outside most practices' existing compliance frameworks.

Recording consent: the patchwork problem

AI scribes work by recording conversations. Recording consent is governed by state wiretapping and eavesdropping laws, not HIPAA. The United States is split between two consent regimes, and the difference matters.

One-party consent states. In most US states, only one person in the conversation needs to consent to the recording. Because the veterinarian is a party to the exam-room conversation, the veterinarian's own consent is sufficient. The client does not need to be told. This covers the majority of states.

All-party (two-party) consent states. In these states, every person in the conversation must consent to being recorded. As of 2026, all-party consent states include California, Delaware, Florida, Pennsylvania, Illinois, Connecticut, Maryland, Massachusetts, Montana, Nevada, New Hampshire, and Washington. Michigan's statute appears to require all-party consent on its face, but state courts have ruled that the eavesdropping law applies only to third-party interception — a participant in the conversation may record without the other party's consent, making it effectively a one-party state. If your practice operates in any all-party consent state, recording a client without their informed consent is a violation of state law.

Penalties can be severe:

• California. California Penal Code section 632 makes unlawful recording a wobbler offense prosecutable as either a misdemeanor or a felony, with fines up to $2,500 per violation.
• Florida. Florida Statute section 934.03 classifies unlawful recording as a third-degree felony.
• Pennsylvania. 18 Pa.C.S. section 5703 makes it a third-degree felony to intercept a communication without the consent of all parties.

These are criminal penalties, not just civil liability. A practice that deploys an AI scribe across multiple locations in an all-party consent state without a consent process is exposing itself to per-incident liability.

McDermott Will and Emery published a detailed analysis of AI scribe legal risks on JDSupra that is worth reading in full. The American Association of Veterinary State Boards (AAVSB) issued a position statement on AI in veterinary medicine that recommends informed consent for AI use, regardless of state recording law.

What consent looks like in practice

Consent does not need to be complicated, but it does need to be documented. Three layers of protection work best:

Verbal consent. The simplest approach. Scribenote recommends a script along these lines: "Before we start, I use an AI tool that records our conversation to help with medical records. Is that okay?" The key is getting an affirmative response and noting it in the record.

Written consent. Add a specific clause to your intake or registration paperwork. Language should disclose that an AI tool may record the appointment audio for the purpose of generating medical records, that recordings are stored by a third-party vendor, and that the client can opt out at any time. In all-party consent states, written consent is strongly recommended because it provides a paper trail if a dispute arises.

Visual notice. Posters in the waiting area and exam rooms that state "Appointments may be recorded for medical records purposes" reinforce the consent chain. ScribbleVet offers a consent poster generator that produces signage customized to your practice.

Best practice is to combine all three: visual notice before the appointment, verbal consent at the start, and written consent in the intake form. In one-party consent states, this is belt-and-suspenders. In all-party consent states, it is the minimum defensible position.

If a client declines, the practice must have a documented process for proceeding with manual notes. This should not be an afterthought; it should be part of staff training.

Data retention: what happens to recordings and transcripts

Consent gets you through the door. What happens to the data afterward is where most practices have not done their homework. Before signing a contract with any AI scribe vendor, get answers to these questions in writing:

1. How long are audio recordings stored? Some vendors retain audio for 30 days, others indefinitely. Indefinite retention creates risk you cannot control.
2. Are transcripts stored separately from recordings? Separation limits exposure if one data store is breached.
3. Can you delete patient data on request? If a client asks you to remove their pet's recording, can the vendor actually do it, and how quickly?
4. Is customer data used to train AI models? If yes, is participation opt-in or opt-out? This is the question most vendors dance around.
5. Does the vendor publish a subprocessor list? You need to know who else touches your clients' data.
6. Will the vendor put "no training on our data" in writing? Verbal assurances do not survive an acquisition or a terms-of-service update.

Vendor security certifications matter. Here is where the major players stood as of early 2026:

A notable open question, raised in VIN News coverage: are AI-generated recordings and transcripts part of the veterinary medical record? Many state practice acts do not address this yet, and the answer affects retention requirements, client access rights, and discovery obligations in malpractice proceedings. Until state boards clarify, practices should treat recordings as potentially discoverable and set retention policies accordingly.

The ScribbleVet acquisition lesson

In January 2026, ScribbleVet was acquired by Instinct Science (maker of Instinct EMR). For practices already using Instinct, this may deepen integration and improve workflow. For practices on AVImark, Cornerstone, ezyVet, or any other PIMS, the acquisition creates strategic risk. Integration quality and support priority for non-Instinct customers may degrade over time as the product roadmap shifts toward the parent company's priorities.

This is not unique to ScribbleVet. Any AI scribe vendor could be acquired by a PIMS company, a consolidator, or a private-equity firm. The lesson for practice owners is to evaluate vendor independence and PIMS-lock risk before committing. Ask what happens to your data and integration if the vendor is acquired or discontinues your PIMS connector.

For a deeper comparison of AI scribe options, see the VetMedGuide AI scribe guide.

Compliance checklist for practice owners

Use this checklist to build a defensible AI scribe rollout:

• Identify your state's recording consent law (one-party vs. all-party). If you operate in multiple states, map each location.
• Update intake paperwork with AI scribe consent language. Include the disclosure, the vendor name, and the opt-out process.
• Add recording notification posters to exam rooms and the waiting area.
• Train all staff on the verbal consent script. Practice it until it is natural.
• Review the vendor's Business Associate Agreement (BAA) or equivalent data processing agreement. If they do not offer one, ask why.
• Ask the vendor in writing: is our data used for model training? Get the answer in your contract.
• Verify vendor security certifications. SOC 2 Type II should be the minimum for a tool that records client conversations.
• Document your data retention policy. Decide how long recordings and transcripts are kept and stick to it.
• Create a documented process for clients who decline recording. Staff should know exactly what to do without hesitation.
• Set a calendar reminder to review consent procedures and vendor terms annually. State laws are evolving fast.

For related guidance on protecting practice data, see veterinary PIMS cybersecurity and backup drills. For governance of the medical records your scribe generates, see SOAP template governance for veterinary PIMS.

State law is still evolving

The regulatory landscape for AI in veterinary medicine is not settled. Several developments are in motion:

• The AAVSB published model regulations for medical recordkeeping in 2025 that address the role of AI in record creation. These model regulations are guidance for state boards, not binding law, but they signal where regulation is heading.
• The California Veterinary Medical Board discussed AI regulation in its July 2025 meeting, including questions about AI-generated records, supervision requirements, and client disclosure.
• The AAVSB position statement on AI encourages veterinary boards to educate licensees on AI regulatory considerations, including informed consent, data security, and the veterinarian's responsibility for AI-generated content.

Expect more state-level guidance in 2026 and 2027. The practices that build consent infrastructure now will be ahead of the curve when their state board issues formal requirements. The practices that ignore the problem will be scrambling to retrofit consent forms after a complaint or an audit.

Sources

• VIN News — More veterinarians using AI for medical records: https://news.vin.com/doc?id=12903793
• CoVet — CoVet vs ScribbleVet comparison (HIPAA/vet exemption): https://www.co.vet/post/covet-vs-scribblevet
• ScribbleVet — Recording consent laws across the U.S.: https://www.scribblevet.com/blog/recording-consent-laws-across-the-us
• VetSoftwareHub — Veterinary AI Scribe Buyer's Guide 2026 (governance section): https://www.vetsoftwarehub.com/article/veterinary-ai-scribe-buyers-guide
• JDSupra — Legal risks and best practices for AI scribe recording (McDermott Will & Emery): https://www.jdsupra.com/legalnews/ready-set-press-pause-legal-risks-and-5352318
• CoVet — Veterinary medical records laws by US region: https://co.vet/post/veterinary-medical-records-laws
• Law Office of Anthony Mahan — Data privacy in veterinary practices: https://mahanlaw.com/practice-areas/veterinary-practice-consulting/data-privacy-and-security-in-veterinary-practices
• AAVSB — AI in Veterinary Medicine position statement (included in CA VMB July 2025 meeting materials): https://vmb.ca.gov/meetings/materials/20250716-17_item_8.pdf
• AAVSB — Model Regulations: Medical Recordkeeping: https://www.aavsb.org/wp-content/uploads/2025/08/2025-Model-Regulations-Medical-Recordkeeping_-1.pdf
• Scribenote — Privacy policy and consent: https://scribenote.com
• CoVet — Best AI Scribe 2026 buying guide: https://co.vet/post/best-ai-scribe-2026
• Scribing.io — State-by-state consent requirements for AI scribing: https://www.scribing.io/blog/state-by-state-patient-consent-requirements-ai-scribing