AI Scribe Patient Consent: Implied or Explicit for UK Clinics?

Implied consent is enough for individual care under NHS England's March 2026 ambient scribe guidance, provided patients are told at the start of the session and can object. But 81% of adults polled for Healthwatch England want to be asked first. For a private clinic, the safer rule is to ask in one sentence and log the answer.

The two positions are closer than they look. The guidance says explicit consent is not needed for individual care, yet insists that patients are told and that the tool stays off for anyone who dissents. The people polled want to be asked. A clinic that tells every patient clearly, offers a real no and records the answer meets the guidance and the public mood at once. The sharper split is among doctors' bodies: the BMA's GP committee for England called for explicit, informed consent in 2025, before the current guidance appeared.

Follow me on Instagram@sagnikteaches

What NHS England's guidance says

The document that settles the consent question is NHS England's information governance guidance, "Using AI-enabled ambient scribing products in health and care settings", dated 31 March 2026 and reviewed by a working group that included the Information Commissioner's Office and the National Data Guardian. It sits beside NHS England's wider guidance on adopting ambient scribing products. On consent it says:

Connect on LinkedInSagnik Bhattacharya

• You do not need explicit consent to use an ambient scribe for tasks that deliver individual care. The appropriate basis under the common law duty of confidentiality is implied consent.
• Because the technology is new, patients must be told at the start of any session. The guidance adds that, as people become familiar with scribes, telling them aloud every time may not always be needed, and that the approach should be kept under review.
• On top of the spoken notice, it suggests posters and screens in waiting areas, website pages, newsletters and leaflets for people without digital access.
• Patients can dissent, and if they do, you cannot use the tool. They also have a right to object under UK GDPR. Dissent given after a visit applies to future use, though the patient can still object to the tool keeping what it already holds.
• The person using the scribe is responsible and accountable for the accuracy of what enters the record, and should check the output every time it is used.

Two further points matter for a clinic owner. The health or care organisation should be the controller when a scribe is used for individual care, and a supplier that decides some of the means and purposes of processing may be treated as a joint controller; either way, the organisation should make sure the supplier does not use patient data for purposes beyond the patient's care. Organisations are also expected to assess tools independently rather than rely on the vendor's word. The guidance even suggests a line for scribe-assisted letters: "This letter has been written with the assistance of an ambient scribe and has been reviewed by the health or care professional who takes responsibility for the content."

Subscribe on YouTube@sagnikteaches

The guidance first appeared on the NHS Transformation Directorate website, which stopped being updated on 31 March 2026 because it is being retired, so search for the title on NHS England's current sites and read the live version before relying on this summary. The NHS England guidance on adopting ambient scribing products links to it.

What patients say they want

Healthwatch England's write-up of its YouGov poll covers 4,039 adults surveyed between 16 and 27 April 2026, published in July. Four in five (81%) said they would like health professionals to tell them a scribe is being used and to ask for their consent first. Around one in ten (11%) did not want to consent at every appointment but wanted the option to opt out. Of the 2,795 who had had an appointment in the previous year, nearly 90% said they were not aware of a scribe being used, which may mean no scribe was used or that nobody told them.

The same poll shows comfort falling with the subject of the consultation: 48% were comfortable with a scribe at a routine health check, against 29% for sexual health, 28% for mental health and 23% for domestic abuse. Over two-thirds (69%) said a clear commitment from the professional to check the scribe's output would make them more comfortable. Healthwatch itself notes that NHS staff currently have no requirement to get opt-in consent for direct care. It recommends telling patients at booking through posters, websites, the NHS App, receptionists and leaflets, and respecting requests to switch the scribe off for sensitive topics.

Be careful with numbers here. Comfort with a scribe and wanting to be asked are different questions, and the poll gives different figures for each. If you quote one to staff or patients, name the source and the question it answers.

What professional bodies say

The doctors' bodies lean further towards asking. GPC England, the BMA committee that represents GPs in England, wrote a summary for local medical committees of NHS England's first ambient scribe guidance in 2025. It says plainly: "Consent must be explicit and informed", and lists what to explain: what the AI is recording and why, how the data is stored and for how long, and the patient's right to refuse recording or withdraw consent. That summary predates the March 2026 information governance guidance, so check whether the BMA has updated its position since.

The Medical Protection Society, which supports its medical members, responded to the Healthwatch poll on the day it was published, 16 July 2026. Its deputy medical director said, as also reported by Management in Practice, that when using AI scribe tools, "particularly those requiring the sharing of personal data with a third party", informed consent should be sought before use and documented. A cloud-based scribe sends audio to its supplier, so that condition will cover many clinics. Check your own regulator and indemnifier as well, since each may take its own line, and your indemnifier's view is the one that matters if a complaint arrives.

Implied or explicit: why the gap exists

The difference is partly a matter of law and partly of trust. Under the common law duty of confidentiality, consent can be implied where a patient would reasonably expect information to be used that way for their care, which is how a referral letter or a note to a colleague works. A national guidance document aims for something workable for thousands of NHS teams, so it leans on implied consent plus transparency. A patient survey asks a different question: "Would you want to be asked?" People understandably say yes.

Data protection law adds a separate layer. Even if confidentiality is satisfied by implied consent, the clinic still needs a lawful basis for processing, an accurate privacy notice and, for new technology touching health data, a data protection impact assessment; NHS England published a template assessment for ambient scribes alongside the March 2026 guidance. The guidance names public task and the health and care condition as the most likely lawful bases, which fit NHS bodies, so a private clinic should ask its data protection adviser which basis it relies on. Consent for confidentiality and a lawful basis for processing are different things, and getting the first does not tick the second.

Five questions that settle it for a private clinic

Use this in order. Stop at the first line that applies.

1. Does the tool record audio or keep transcripts? If yes, ask explicitly. Recorded voices are more intrusive than typed notes, and you may be keeping them.
2. Is the consultation sensitive? Sexual health, mental health, safeguarding, abortion, addiction, a minor or someone lacking capacity: ask explicitly, offer to switch off and be ready to.
3. Does your indemnifier or regulator advise explicit consent? If so, follow it, whatever the national guidance says.
4. Is the vendor a joint controller, or does it keep data for its own purposes? If yes, ask explicitly, because the patient's data is going further than your clinic.
5. None of the above? Telling every patient at the start and offering a clear opt-out is at least what the national guidance expects. Explicit asking remains the safer default for a private clinic, since it costs about ten seconds and gives you a logged answer.

In practice, nearly every private clinic ends up on line one or five, so asking explicitly is the sensible standard. The implied-consent line is a floor, not a recommendation to stay on it.

Consent wording you can copy

At booking

"At [clinic] we use an AI note-taking tool that listens to your consultation and drafts the clinician's notes. Your clinician checks every note. You'll be asked at the start of your appointment, and you can say no at any time without any effect on your care. More information: [link]."

In the room

"I'd like to use a tool that listens and drafts my notes. I read and correct every note, and [the audio is deleted once the note is made / the audio is kept for X days]. Is that all right, or would you rather I typed?"

On the poster or privacy notice

We use approved AI software to help our clinicians write notes. It does not replace the clinician, who checks and takes responsibility for the record. You can opt out at any appointment. Ask any member of staff, or see our privacy notice for how your information is handled.

Each sentence must be true of your tool. If the vendor keeps audio for 30 days, say so rather than "deleted". The pages on consent wording that works and rolling out an AI scribe without losing patient trust go further on tone.

A worked example: a four-clinician private physiotherapy clinic

Illustrative. A clinic with four clinicians sees about 120 patients a week and chooses an AI scribe that records audio and deletes it after note creation. The owner goes through the rule: the tool records audio (line one), so the clinic asks explicitly.

• The booking confirmation carries the notice above.
• The intake form has an "AI notes: agree / prefer not" tick box that writes to a field on the record.
• The clinician repeats the in-room line, and the answer is logged with one click.
• A poster in reception names the tool's purpose and says how to opt out.
• For a patient who says no, the flag appears on the record and the notes are written by hand.

After a month, the owner counts 460 visits, 421 agreed and 39 preferred not (about 8.5 per cent). Those are illustrative numbers, but the habit of counting is real: a refusal rate that rises over time tells you the wording or the explanation needs work, and a rate of zero tells you people are not being offered a genuine choice.

Four situations to plan for

The patient says yes and later regrets it

Stop using the tool for them from that point and flag the record. Under the guidance, dissent applies to future use, not to what has already been processed, but the patient can still object to the tool keeping what it holds. Treat that as a data protection request. If they also ask you to restrict processing while you consider it, leave the data untouched, which means not deleting it either, until the restriction is lifted. Then tell them honestly what was done and put the withdrawal in the record.

The patient who has not been told

A walk-in or a telephone appointment gives no chance to read a poster. The in-room or on-the-call sentence carries the whole weight, so never skip it because the day is busy.

A third party in the room

A relative, interpreter or chaperone is also recorded. Ask them, too, and if either objects, switch off. Interpreters in particular may be bound by their own confidentiality rules.

A patient who cannot decide

Where capacity is in doubt, do not rely on a tick box. The guidance asks you to check whether someone has legal authority to accept or dissent on the patient's behalf, and whether the patient has expressed a view on scribes before; if neither applies, the decision is made in the patient's best interests. Writing the notes by hand is the safe default while you work that out.

Ask or tell: what each approach costs a busy clinic

Owners sometimes resist explicit consent because they picture it adding minutes to every visit. Compare the two approaches by effort and by what you can prove afterwards.

Time a few of your own consultations rather than trusting those estimates. On a clinic seeing 120 patients a week, an extra five to ten seconds adds roughly 10 to 20 minutes across the whole week, spread over four clinicians. That is a small price for a logged answer, and the logging can be one click if the field sits on the record.

Three clinics, three answers

A private dental practice

Dentists often have a nurse in the room and a patient lying back with their mouth full. Ask at check-in or on the intake form rather than mid-treatment, repeat briefly in the chair, and confirm the nurse understands how to switch off. Given audio is usually captured, explicit asking applies.

A private counselling or psychology practice

This is the sensitive end. The material is deeply personal and trust is the treatment. Many practices in this area will decide not to use a scribe at all, or to offer it only where the client asks for it. If you do use one, explicit consent is the standard, the client should be able to switch it off during a session without explanation, and your notice should say exactly what is kept. Check your professional body, which may have its own position.

A private GP or aesthetics clinic

Mixed sensitivity. For routine consultations, ask at booking and in the room. For anything touching sexual health, mental health or a minor, move to a spoken explicit question plus an easy opt-out, and note that you did. The same tool can run across all consultation types, but the consent bar changes with the content.

What to put in the privacy notice

An accurate notice is part of the transparency the guidance asks for. Draft a paragraph in plain words and have your data protection adviser check it. An illustrative paragraph: "We use software that listens to consultations and drafts notes for your clinician. Your clinician checks and approves every note before it is saved. The software supplier acts on our instructions under a contract, does not use your information to train its products, and deletes recordings after [period]. We rely on [basis] to process this information. You can object at any time by telling your clinician or contacting us at [contact]."

Each bracket needs a real answer from your vendor terms. Leaving one in vague, such as "a reasonable period", is a sign you have not asked. If the vendor cannot answer, that is a reason to reconsider the vendor.

A data protection impact assessment, in plain steps

For a tool that processes health information in new ways, an impact assessment is a sensible discipline and is often expected. It need not be long. Work through five questions in writing:

1. What data does the tool collect: audio, transcripts, notes, metadata?
2. Where does it go, who can see it, and which sub-suppliers are involved?
3. What are the risks to patients if it is wrong, lost or misused?
4. What have you put in place to reduce each risk: consent step, access limits, deletion, review?
5. Who signed it off, and when will you review it?

Keep it to two pages and update it when the vendor, plan or settings change. Your adviser may want a longer form, but a clear short document beats a long one nobody reads.

A log you can keep in a spreadsheet

If your practice software has no field for it, a spreadsheet does the job. Illustrative columns and a sample row: Date (14 Nov), Patient ID (not name; use your internal number), Clinician (initials), Asked (Y/N), Answer (agreed/declined), Method (spoken/form), Tool on (Y/N), Note checked (Y/N). A monthly check counts rows where "Tool on" is Y and "Answer" is not agreed. That count should be zero. Any non-zero count gets a short note of what happened and what changed.

The first minute recorded before anyone asked

A clinician, running late, starts the tool as the patient sits down, intending to mention it afterwards. The patient says, "Is that recording me?" The clinician says yes and explains, and the patient agrees, but the first minute was captured before the question. The fix is mechanical: make the explanation the first thing said, before pressing record, and build the tool's start button into the flow after the answer. Where your tool has a consent prompt that must be accepted before recording starts, use it. The tutorial on dental practice AI mistakes covers similar slips in a related setting.

Gaps in the guidance you should still fill

On sensitive consultations the guidance says only that a scribe may not be appropriate during highly sensitive conversations, and leaves the call to professional judgement. The Healthwatch comfort figures suggest patients expect more than that, so if your clinic sees such patients, set your own standard and write it down. The guidance is also written with NHS bodies in mind, so a private provider has to work out how each point applies to it. Document that you read it, how you applied it and who signed off, so that a regulator or patient can see your reasoning.

Also write down what the vendor does with data. Ask whether audio and transcripts are kept, where they are stored, whether staff at the vendor can listen, whether content is used to train models, and what happens when you leave. The same questions appear in the tutorial on what to ask before buying any AI tool for a medical practice, and a chiropractic version is in the consent and data checks before recording tutorial.

A short script for the reception team

Front-desk staff will be asked the questions first. Give them three answers and a handover. "What is it?" "It's software that listens to your appointment and helps the clinician write the notes. The clinician checks everything." "Where does it go?" "It's processed by an approved supplier under a contract with us. You can read more in our privacy notice, or ask your clinician." "Can I say no?" "Of course. Just tell the clinician and they'll type the notes instead." For anything else, such as technical detail or a complaint, hand over to the practice manager. Never let staff guess about retention, training or deletion, and never let them say "it's completely safe".

A monthly and quarterly review of the consent routine

1. Each month, compare visits where the tool ran against visits with a logged agreement. They should match.
2. Read the opt-out list. Are patients declining at higher rates in one clinician's lists? That points to how the question is being asked.
3. Read the vendor's terms again every quarter and compare with your notice. If either changed, update the other.
4. Test the opt-out end to end once a quarter, from the flag to a hand-written note.
5. Re-read the NHS England guidance and your regulator's position every six months, since this area is moving.

The money question is covered in AI scribe costs compared for small clinics. If you would rather work through the decision rule with someone for your own clinic, that is what my AI implementation consultation covers, through the contact page. This tutorial describes practice and is not legal advice: confirm with your data protection adviser, indemnifier and regulator.

Consent questions from UK clinic owners

Does a private clinic have to follow the NHS England guidance?

It is written for health and care organisations using a scribe for individual care, and its examples, such as the public task lawful basis, suit NHS bodies. It is guidance rather than law, but it was reviewed with the ICO and the National Data Guardian, so it is a sensible baseline. The data protection duties behind it apply to you either way. Check with your regulator and indemnifier.

Is implied consent the same as no consent?

No. Implied consent means the patient reasonably expects the use because they were told and could object. That depends on telling them at the start. If a patient has not been told and the tool is running, there is nothing for consent to be implied from.

Should I ask for written consent?

The guidance does not require explicit or written consent for individual care, but it can suit private clinics that record audio, keep transcripts, or serve patients who are likely to be uneasy. A tick on the intake form plus a spoken check gives you a record without slowing the visit.

What if a patient objects?

Stop the tool and write the notes by hand. Record the objection in the patient's file so it applies to future visits. Do not ask twice, justify the tool at length or suggest that care will be worse.

Does the answer change for mental health or sensitive consultations?

Yes, take more care. Even where implied consent is acceptable, consider asking explicitly in sexual health, mental health, safeguarding and other sensitive consultations, and be ready to switch off. Healthwatch recommends respecting a patient's request to switch off for sensitive topics. Check the latest from your own professional body.

Further reads

• What Is an AI Scribe and How Does It Work in a Consultation? — How an AI scribe works inside a consultation.
• Is an AI Scribe Worth It for a Small Private Clinic? — Whether a scribe is worth it for a small private clinic.
• AI-Generated SOAP Notes for Chiropractors: A Review Checklist — A review checklist for each AI-written note.
• What Does an AI Receptionist Cost a Dental Practice in 2026? — Cost context from a similar practice type.
• A Worked AI Implementation Plan for a Small Medical Practice — Where consent fits in a full rollout plan.
• Do Small Medical Practices Need an AI Consultant? — Whether outside help is worth it for a small practice.
• AI Chatbot for Healthcare: A Small Clinic's Data and Consent Checklist — Twenty checks before a clinic puts an AI chatbot on its website: contracts, legal basis, disclosure, scope and logging.
• Heidi Health for Dentists: Setup, Templates and Patient Consent — A step-by-step Heidi setup for a dental practice: the plan to start on, template tweaks, getting notes into the PMS, and patient consent wording.
• AI Charting for Dietitians: Drafting ADIME Notes With a Review Step — Draft Assessment, Diagnosis, Intervention and Monitoring notes with AI, then check each line before it enters the record.
• AI Scribe Consent Form: US Wording and State Recording Laws — Template wording for an AI scribe consent form, a plain map of one-party and all-party recording states, and an opt-out that still gets the patient seen.
• AI Scribe for Audiology: Fitting Notes, Counselling and Consent — Four AI scribes compared for fitting appointments, with filled-in fitting and counselling notes and consent wording for patients who struggle to hear.
• AI Scribe for Counsellors: A Safe Trial Plan With Consent and Opt-Out — A six-week scribe trial for counsellors: who to include, consent and opt-out wording, comparing drafts with your own notes, and when to stop.
• AI Scribe for Physiotherapists in the UK: A Consent and GDPR Checklist — A twelve-step checklist for a UK physio clinic adopting an AI scribe: consent, DPIA, vendor contract, data location, retention and HCPC standards.
• Chartered Society of Physiotherapy and AI: A Clinic Checklist — Turn the CSP's AI principles into a working checklist: what each asks of a clinic, who owns it, what evidence to keep and when to review.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: NHS England information governance guidance, Using AI-enabled ambient scribing products in health and care settings (31 March 2026, archived copy); NHS England guidance on adopting ambient scribing products; Healthwatch England's July 2026 write-up of its YouGov poll; GPC England summary for LMCs (2025); Medical Protection Society statement (16 July 2026) and Management in Practice report (July 2026); BMA committee pages. Checked November 2026.