AI is arriving in dental offices quickly. Ambient scribes write chart notes, image-analysis software flags caries on radiographs, and treatment-planning tools suggest next steps. These tools can save time and improve care. They also create new legal exposure for the practice owner. In our latest Pediatric Dentistry Today column, we walk through how to choose an AI tool and how to bring it into a practice without creating HIPAA, consent, or liability problems.

Choosing an AI tool: questions to ask first

Start with the purpose. What problem should the tool solve, and does it actually solve it in a practice like yours? The ADA has published standards for evaluating dental image-analysis AI, and they make a good checklist. From there, look closely at:

• Data: What protected health information (PHI) does the tool need? Who can access it? Does the vendor send data to subcontractors for processing or storage?
• Technology: Will it run on your hardware and network, and will it work with your practice management and imaging systems?
• Performance: Does the vendor share validation results and regular audit reports on accuracy, bias, and errors? For an AI scribe, how does it handle an open-bay operatory with several people talking?
• Training data: Was the model trained on representative patient populations, to reduce the risk of biased results?
• The vendor itself: Is the company financially stable? Can it show security certifications and audits that demonstrate it takes health care compliance seriously?

HIPAA and the Business Associate Agreement

Any AI vendor that handles PHI is a business associate under HIPAA. You need a signed BAA before sharing patient data. Many AI vendors want to use practice data to train and improve their products. That use is likely not a “health care operation.” If you allow it at all, the BAA has to require proper de-identification first.

De-identification is harder than it sounds. Dental images carry embedded DICOM metadata, including patient and provider details, and AI’s pattern recognition makes re-identification a real risk. Using identifiable data for other purposes requires each patient’s written, revocable authorization. Be cautious before agreeing to any use beyond treatment, payment, and operations.

Patient consent and state law

Some states, including California, Florida, and Illinois, are “all-party consent” states for recording conversations. Using an AI scribe there may require consent from every person in the room. Other states now require you to tell patients when AI is used to document a visit or to support diagnosis and treatment decisions. Ohio practices that treat patients across state lines, or that use telehealth, should know the rules in each state involved.

Contract terms dentists should negotiate

The vendor’s standard agreement protects the vendor. Your agreement should protect your patients and your practice:

• Warranties: measurable performance thresholds, prompt repair of material defects, lawfully sourced training data that has been tested for bias, and regulatory compliance that extends to the vendor’s subcontractors.
• Indemnification: coverage for the vendor’s negligence, privacy and security violations, and breach of warranty. The contract should also allocate responsibility for patient harm caused by AI error, as distinct from the dentist’s own clinical judgment.
• Insurance: proof of the vendor’s cyber, technology errors and omissions, and malpractice coverage. Check your own malpractice policy for AI exclusions too.
• Data ownership and exit: you own inputs and outputs, you keep access for patient care, audits, and defense, and at termination the vendor returns your data and certifies in writing that it has destroyed its copies.
• Updates: advance notice of material version changes, and the right to delay an update until you’ve reviewed it.

Best practices for a “human in the loop” practice

1. Use a deliberate process to select and adopt any AI tool.
2. Stay current on federal and state AI rules, especially consent and disclosure requirements.
3. Adopt a written policy that bans identifiable patient information in public AI tools.
4. Train staff, define roles, and require a clinician to review and approve every AI-generated note, referral, prescription, and procedure code. Document when you follow or depart from an AI recommendation.
5. Audit performance and security regularly.
6. Don’t do it alone. Build an AI governance team that includes your attorney and IT consultant.

Avoiding AI altogether isn’t automatically the safe choice. The legal standard of care evolves to include proven new technology. The goal is to adopt AI with care, not to avoid it.

Frequently asked questions

Do I need a Business Associate Agreement with an AI scribe or diagnostic software vendor?

Yes. If the vendor creates, receives, stores, or transmits PHI for your practice, HIPAA requires a BAA before any patient data is shared.

Who is liable if an AI tool makes a diagnostic error?

The treating dentist remains the responsible licensed provider. A well-negotiated vendor contract can shift some financial responsibility for algorithmic errors to the vendor, but it does not replace the dentist’s duty of care.

Can my team use ChatGPT or other public AI tools for patient notes?

Not with identifiable patient information. Public AI tools generally are not covered by a BAA. Your practice policy should prohibit entering PHI into them.

Do I need patient consent to use an AI scribe?

It depends on the state. All-party consent states require consent from everyone being recorded, and several states require disclosure when AI is used in documentation or care decisions.

This article is for general information only and is not legal advice. Reading it does not create an attorney-client relationship.

Related DSO Affiliation: What a Selling Pediatric Dentist Should Consider|Terminating the Dentist-Patient Relationship