Your EHR's Consent Template Is Not Yours

Colorado's AI psychotherapy law took effect this month. Most of the coverage I read described it as another state restricting AI therapy chatbots, which is accurate as far as it goes. The act prohibits an AI system from implying its output is equivalent to a licensed clinician's, representing that it provides psychotherapy, or claiming confidentiality protections comparable to therapist-client privilege.

The part I am not seeing covered is the part aimed at licensees.

A licensed provider in Colorado may not allow an AI system to engage in any form of therapeutic communication with clients without synchronous, real-time interaction among the provider, the system, and the client. A provider may not allow an AI system to generate therapeutic recommendations or treatment plans without the provider's review and approval. Failing to comply is grounds for board discipline.

And before a provider may use an AI system to record or transcribe a session, the client must be informed in advance, in writing, that an AI system will be used and the specific purpose for which it will be used, and must provide written consent. Refusal cannot be used as a basis to deny services.

That news is what sent me to my own library of consents and policy forms.

The other thing that sent me there is that I have started professionally reviewing clinical content and patient-facing tools for other people. I cannot walk somebody else's intake flow and write up what I found if I have not done the same work on my own practice. So I have been going through it piece by piece, and when a law changes or litigation lands, that is usually a good signal to check whether my own house is in order before I say anything about anyone else's.

It, umm, was not up to my own standard.

What I thought I knew about the deadline

I am licensed in Arizona, not Colorado, so I went looking at my own rule, expecting to find I had time.

Beginning January 1, 2027, Arizona adds a consent element requiring notification of the extent, if any, to which clinical services are provided through, recorded or documented with, or involve the use of artificial intelligence, machine learning, deep learning, or any other human simulation modality. The Board's definition of artificial intelligence is broad enough to cover a scribe.

So I originally thought I had until 2027.

Then I read the rest of the rule.

R4-6-1101(4) says a licensee shall obtain a dated and signed written informed consent from the client, or the client's legal representative, before audio or video taping the client.

That provision is not new. It was written for a world of tape recorders and one-way mirrors, and it does not mention artificial intelligence anywhere.

But an AI scribe records the session. That is what it does before it does anything else. Whether the Board reads subsection (4) as covering a software tool is a question I put to them directly rather than assuming the answer, and the reading I came away with is that a tool which records and transcribes can fall within it. Board staff are prohibited from offering formal rule interpretation, so treat that as my conclusion rather than theirs.

What is not ambiguous is the relationship between the two provisions. The element arriving in 2027 is in addition to the existing recording requirement, not a replacement for it. So if you have been waiting on 2027 to think about this, you may have been waiting on the wrong date.

The provision both states wrote independently

Here is the part that changed how I think about this.

Colorado's consent requirement for AI recording applies to the initial use of the system, and then again if the purpose or manner of use materially changes.

Arizona requires signed consent before treatment and again when any consent element changes in a way that might affect the client's consent.

Two states, different statutory schemes, no relationship between them, and they landed on the same rule. A consent form is not a document you execute once. It describes a set of facts, and when those facts change materially, consent must be obtained again.

Now read that against a vendor change.

If your form describes how session data is stored and deleted, and you switch tools or your vendor ships an update that changes the default, the element's content has changed. Not the wording on your page. The facts underneath it.

The gap

Your EHR gives you a consent template. Your AI vendor gives you a consent template. Neither describes your specific configuration.

My EHR says, directly beneath its consent templates, that the forms are for reference only and that it is my responsibility to customize them to meet my state's requirements. That disclaimer has been there the entire time I have been in practice. When I opened the standard consent and read it, It did not occur to me that I needed to do anything additional. It seemed fine.

It occurred to me when I hired an attorney to review my documents, and he said the thing that should be obvious and somehow is not. The platform is not the party that will be asked to defend the legality of those statements. You are, and the disclaimer exists to ensure it.

Colorado's act carves this out explicitly on one side. Its consumer-protection section says nothing in that section imposes liability on a licensee for defects in an AI system attributable to the developer or deployer. Read the boundary carefully. That shield sits in the section governing what companies may claim about their products. The duties placed on the licensee, including the consent requirements, remain the licensee's.

I have never once had a peer mention getting their forms reviewed by an attorney. That is not carelessness. A document review can run into the thousands, most people opening a practice do not have it, and telling them it is the price of entry does not make it any more likely to appear. That cannot be the standard.

What informed consent training actually covered

It is close to a running joke how little graduate training prepares a therapist to run a practice. I remember being told outright that private practice is more work than it is worth.

In that training, informed consent was mostly about mandated reporting. Say the words, make sure the client understands the limits, document it. It had the shape of Miranda rights. Something you recite so you are not in trouble for failing to recite it.

The actual rule is more detailed. Arizona requires eight documented elements today and ten beginning in 2027. The elements are: purpose of treatment; general procedures including benefits, limitations, and risks; confidentiality and its limits; notification of supervision or treatment team involvement; how to obtain records; the right to participate in treatment decisions; the right to refuse or withdraw and be advised of the consequences; and fees, refunds, and collection policy. Then in 2027, AI use and a description of the professional nature of the therapeutic relationship.

Most clients sign a stack of intake paperwork without reading it. There is evidence for the readability half of that, though not the half you would expect. A 2025 systematic review analyzed 26 studies covering nearly 14,000 informed consent forms and found roughly three quarters had poor readability. Every one of those forms was for a medical or surgical procedure. I could not find an equivalent body of work on behavioral health treatment consents. Our forms have not been measured.

None of that is a reason to write a thinner document. It is a reason to make the document true and then say the parts that matter out loud.

The three documents

There is no published protocol for this. Nobody has written the paper on reconciling a clinical consent form against a vendor's configuration, so what follows is the procedure I ran, not a summary of a field.

You need three things open at once.

Your consent form. Which vendor is named in it. What claims it makes about how data is stored, retained, and deleted. Whether it names artificial intelligence as artificial intelligence, or calls it a digital service, a scribe, a documentation tool. And whether it states the specific purpose the tool is used for, which is the standard Colorado now applies, rather than the general fact that technology is involved.

Your Business Associate Agreement. Its effective date. What uses of protected health information it actually permits. Whether it grants the vendor any right to de-identify your clients' information and use it. The breach notification window. And the liability cap, which will be lower than you expect.

Your vendor's settings page. Not the compliance page, the settings inside your own account, where the defaults live.

Then read them side by side and then ask what they disagree on.

What I found

My form described data retention and deletion practices belonging to a different product than the one processing my sessions. Not thin detail. Inaccurate content in a document clients had signed.

Then I opened the settings. I remembered setting them up, mostly because I had been annoyed at how long it took. The one I cared about was the privacy toggle that strips identifying information out of transcripts, so a name spoken in session never appears as a name.

What I had not tracked was an update to the tool itself. These tools ship features constantly, and a default I never chose was doing something I would not have agreed to.

I changed the configuration first, then rewrote the form to match. Then I reissued to every active client, and I wrote down the date I found the problem and the date I corrected it. A contemporaneous record of a self-caught error is a materially different fact than a discovered one.

You have to fix the configuration before you write the form, or you will be documenting a practice you have not implemented or is not aligned to your actual practice.

Cadence

Put a review date on every consent document you use. Put a calendar reminder six months out. Trigger a review any time you add a tool, change a vendor, or a rule changes in your state. Both states I looked at treat a material change in how a tool is used as an event requiring consent again, not just an updated file.

Unfortunately, I do not expect many clinicians to run this check. Not out of carelessness. The field is exhausted, administrative work is unpaid, and the reasonable response to one more compliance task is to confirm the consents are current and move on. That is what I did for a long time, and I did not feel like I was cutting a corner.

But this particular check is free. It costs an hour and three open tabs.

And there is a deadline attached, whether we run it or not. Beginning January 1, 2027, Arizona requires three clock hours of continuing education per renewal period in technology related to behavioral health, explicitly naming the use of artificial intelligence. The Board is telling us this is a competency, not a preference.

The failure here was not a bad form. It was a form written once and never opened again, which will always outlive the tool it describes.

I am not an attorney, and this is not legal advice. I am licensed in Arizona and describe Colorado's act only as a leading indicator. Read your own board's rules directly from your own board's website. They are changing quickly.