State AI disclosure laws for patient messages

Independent practices now use AI in places patients can see: a chat window on the website, a voice agent that answers the phone after hours, a tool that drafts portal replies or letters. California, Utah, Texas and Colorado have passed laws on when and how a person must be told that the words came from AI, and two of them reach a clinic or physician office directly. The laws differ in what they cover, when the notice must appear and who enforces them. This guide walks through the state laws we checked, the federal FTC Act that applies to how you describe an AI tool, and wording a practice can put in chat, voice and written messages so one setup works across them.

This guide is about the disclosure rules. How to choose and set up an AI receptionist is in our guides to AI receptionists for medical offices and AI receptionists for dental offices. What a website chatbot should collect, and how it handles emergencies, is in our guide to AI chatbots on a practice website. AI-written blog posts, images and synthetic voices in ads are in our guide to AI-generated content in healthcare marketing. Text reminder rules are in our guide to text message appointment reminders.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: California Health and Safety Code section 1339.75 (AB 3030), California Business and Professions Code sections 4999.8 and 4999.9 (AB 489), Utah Code Title 13, Chapter 75 (SB 226, 2025) and Chapter 72a (HB 452, 2025), Texas Health and Safety Code section 183.005 (SB 1188, 2025), Texas Business and Commerce Code section 552.051 (HB 149, 2025), the Colorado General Assembly pages for SB 24-205, SB 25B-004 and SB 26-189, 15 U.S.C. 45 and the FTC announcement of Operation AI Comply. This is not a survey of all fifty states, other states may have passed or changed laws since, and the rules apply based on where the patient is as well as where the practice is. Check your own setup with a health care attorney.

California: AB 3030 and generative AI patient communications

California Health and Safety Code section 1339.75 was added by AB 3030 (Stats. 2024, Ch. 848) and took effect January 1, 2025. It applies to a health facility, clinic, physician’s office or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information. Those communications must include two things. The first is a disclaimer telling the patient the communication was generated by generative AI. The second is clear instructions on how the patient can contact a human health care provider, an employee of the practice or another appropriate person.

The statute sets where the disclaimer goes for each format:

Letters, emails and other written messages on paper or digital media: prominently at the beginning of each communication.
Continuous online interactions, including chat-based telehealth: prominently displayed throughout the interaction.
Audio: spoken at the start and at the end of the interaction.
Video: prominently displayed throughout the interaction.

Two limits matter for a front desk tool. First, “patient clinical information” means information relating to the health status of a patient, and the statute says it does not include administrative matters, including appointment scheduling, billing or other clerical or business matters. Second, the disclaimer is not required when a human licensed or certified health care provider has read and reviewed the AI-generated communication. A violation by a physician falls under the Medical Board of California or the Osteopathic Medical Board of California; licensed clinics and health facilities face the enforcement provisions the section names.

Use, at the top of an AI-drafted result letter that no clinician reviewed: “This message was written by generative artificial intelligence. To talk with a person on our care team, call [phone] or reply in the portal and ask for staff.”
Avoid: sending AI-drafted messages about symptoms, results or care plans with no disclaimer and no human path, on the assumption that the scheduling exception covers them. It covers administrative matters only.

California: AB 489 and AI that implies a licensed person

AB 489 (2025) added Chapter 15.5, “Health Advice From Artificial Intelligence,” to the California Business and Professions Code. Section 4999.9 makes the existing rules against using terms, letters or phrases that imply a health care license enforceable against a person or entity that develops or deploys an AI system using those terms in its advertising or functionality. It also prohibits using a term, letter or phrase in the advertising or functionality of an AI system that indicates or implies the care, advice, reports or assessments offered through it are provided by a natural person holding the right license. Each use counts as a separate violation, and the licensing boards have jurisdiction.

Use: a plain product label such as “[Practice name] virtual assistant” or “automated scheduling assistant.”
Avoid: naming the bot “Nurse [name]” or “Dr. [name],” giving it initials such as RN or MD, or a greeting such as “I’m your nurse, how can I help?”

Utah: disclosure for regulated occupations

Utah’s 2025 SB 226 repealed Utah Code section 13-2-12 and enacted Title 13, Chapter 75, effective May 7, 2025. Section 13-75-103 has two duties. A supplier using generative AI in a consumer transaction must disclose that the person is talking with generative AI and not a human if the person clearly and unambiguously asks. Separately, an individual providing services in a regulated occupation must prominently disclose when a person receiving those services is interacting with generative AI, if the use is a high-risk artificial intelligence interaction. A regulated occupation is one regulated by the Utah Department of Commerce that requires a license or state certification.

Section 13-75-101 defines a high-risk interaction to include one that involves collecting sensitive personal information, including health data, or providing personalized recommendations, advice or information that could reasonably be relied on to make significant personal decisions, including medical advice or services and mental health advice or services. The disclosure must be given verbally at the start of a verbal interaction and in writing before the start of a written interaction. Section 13-75-104 gives a safe harbor from enforcement when the AI clearly and conspicuously discloses, at the outset and throughout the interaction, that it is generative AI, is not human, or is an AI assistant.

A chat or voice tool that asks a patient about symptoms or takes health history is the kind of use the definition names, so a licensed Utah practice should treat it as covered. The safe harbor wording is simple to meet: say it at the start and keep it visible for the whole conversation.

Utah: mental health chatbots

Utah’s 2025 HB 452 enacted Title 13, Chapter 72a for mental health chatbots. Section 13-72a-203 requires the supplier to have the chatbot clearly and conspicuously disclose that it is artificial intelligence technology and not a human: before the user can access its features, at the beginning of an interaction if the user has not used it in the previous seven days, and whenever the user asks whether AI is being used. Section 13-72a-202 limits advertising inside the conversation: an ad for a specific product or service must be identified as an ad, with any sponsorship, business affiliation or promotion agreement disclosed, and the user’s input may not be used to target or customize ads other than for the chatbot itself. The section says the chatbot may still recommend that a user see a licensed professional. A behavioral health practice that offers or links to a mental health chatbot should check that the tool meets these rules for Utah users.

Texas: AI used for diagnosis and in health care services

Texas SB 1188 (2025), effective September 1, 2025, added Health and Safety Code section 183.005. A health care practitioner may use AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment based on a patient’s medical record, if the practitioner acts within the scope of their license, the use is not otherwise restricted by law, and the practitioner reviews all records created with AI in line with Texas Medical Board standards. A practitioner who uses AI for diagnostic purposes must disclose that use to their patients.

Texas HB 149 (2025), the Texas Responsible Artificial Intelligence Governance Act, took effect January 1, 2026 and added Business and Commerce Code section 552.051. The section requires a governmental agency that offers an AI system meant to interact with consumers to disclose that fact before or at the time of the interaction, clearly and conspicuously, in plain language, without a dark pattern, and permits the disclosure to be made through a hyperlink. Subsection (f) adds that if an AI system is used in relation to health care service or treatment, the provider of the service or treatment gives that disclosure to the patient or their personal representative no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency. Because the section opens with a duty on governmental agencies, how far subsection (f) reaches private practices is a question for your attorney. A written notice at intake costs little either way.

Use, in intake paperwork or the patient portal: “[Practice name] uses artificial intelligence tools in some parts of your care, including [describe use]. Your clinician reviews AI output before it becomes part of your record. Ask us if you have questions.”
Avoid: a notice buried in a website footer that the patient never sees before the visit.

Colorado: from SB 24-205 to SB 26-189

Colorado’s SB 24-205 (2024) was set to start February 1, 2026. SB 25B-004, signed August 28, 2025, moved that date to June 30, 2026. Then SB 26-189, signed May 14, 2026, repealed and reenacted those provisions with a narrower framework on automated decision-making technology used in consequential decisions, starting January 1, 2027. The General Assembly’s summary lists decisions about access to, eligibility for or compensation related to health-care services among consequential decisions.

Under the summary, a deployer of covered technology must give clear and conspicuous notice to consumers at the point of interaction, explain in plain language the technology’s role within 30 days after it makes a consequential decision with an adverse outcome, and honor requests for data correction and human review. The attorney general enforces it under the Colorado Consumer Protection Act and must adopt rules on the adverse-outcome disclosures by January 1, 2027. A scheduling bot is not the target of this law, but a tool that screens patients for eligibility, triages who gets an appointment or flags accounts could be. If you see patients in Colorado, ask counsel before January 1, 2027 whether any tool you use materially influences such a decision.

The FTC Act: how you describe the AI

Section 5 of the FTC Act, 15 U.S.C. 45, prohibits unfair or deceptive acts or practices in commerce in all states. When the FTC announced its Operation AI Comply sweep in September 2024, it said the cases make clear there is no AI exemption from the laws on the books, and the sweep included a company claiming to sell “AI Lawyer” services. The same reasoning applies to a practice describing its own tools. Claims about what the AI can do, how accurate it is or whether a human is involved need to be true and supported.

Use: “Our virtual assistant can book, move and cancel appointments and answer questions about hours, location and insurance we accept. For anything about your health, it connects you with our staff.”
Avoid: “AI doctor,” “AI nurse available 24/7,” “never miss a diagnosis,” or any accuracy figure you cannot document.
Avoid: AI-written patient reviews or testimonials. Our guide to patient testimonials covers the endorsement rules.

One disclosure setup that works across these laws

The laws above differ in detail, but they point the same way: tell the patient early, keep it visible in live chat, give a way to reach a person, and do not let the tool pass as a licensed human. A practice that sees patients from more than one state can build one setup that meets the strictest timing in the list instead of switching by state.

Chat: a disclosure line in the first message and a persistent label in the chat window for the whole conversation, plus a visible “talk to staff” option.
Voice: a spoken disclosure at the start of the call and again at the end, with an option to reach a person or leave a message for staff.
Letters, emails and portal messages drafted by AI: the disclaimer at the top unless a licensed clinician read and reviewed the message, with a phone number or portal path to a human.
When asked: the tool answers “Are you a person?” truthfully and directly.
Names and titles: no human first name presented as a staff member, no clinical titles or credentials.
Intake: a short written notice about AI use in care, including any AI used for diagnostic support.
Emergencies: the tool tells patients it is not for emergencies and to call 911, and points patients in crisis to 988. Our chatbot guide covers this in detail.

Wording a practice can adapt

These lines are starting points for your attorney to review, not approved legal text. Replace the brackets with your own details.

Chat opening: “Hi, I’m [Practice name]’s virtual assistant. I’m an AI system, not a person. I can help with appointments and general questions. To reach our staff, tap ‘Talk to staff’ or call [phone]. If this is an emergency, call 911.”
Chat label shown throughout: “AI assistant. Not a person.”
Voice opening: “Thanks for calling [Practice name]. You’re speaking with an automated AI assistant, not a person. Say ‘staff’ at any time to leave a message for our team.”
Voice closing: “This call was handled by our AI assistant. To speak with our staff, call [phone] during office hours.”
Written message: “This message was generated by artificial intelligence. To contact a member of our care team, call [phone] or reply in the portal.”
Answer to “Are you real?”: “I’m an AI assistant, not a person. I can connect you with our staff.”

Where practices get caught out

Treating the California scheduling exception as a blanket exception. A bot that answers “Is this rash serious?” has moved into clinical information.
Saying a clinician reviews AI messages when no one does. The California exception needs actual review by a licensed or certified provider.
A disclosure only at the start of a long chat, when California asks for one displayed throughout and the Utah safe harbor asks for it at the outset and throughout.
A voice agent with a human name and a friendly backstory that patients take for a receptionist.
Vendor scripts copied without checking. The practice using the tool is the one these laws name.
Marketing pages that oversell the tool, which the FTC Act reaches whatever the state law says.

Claims to leave out

On your website, ads and social posts about AI tools, leave out claims you cannot support. Under 15 U.S.C. 45, the claim itself must not mislead. If you quote a patient praising the tool, 16 CFR 255.2(b) applies: an ad presenting one consumer’s experience is likely to be read as what others will generally get, so without substantiation that it is representative, the ad should clearly and conspicuously disclose the generally expected performance.

Avoid: “Our AI is as accurate as a doctor.”
Avoid: “Get a diagnosis from our AI in minutes.”
Avoid: “24/7 medical advice from AI.”
Avoid: invented response times, call answer rates or patient satisfaction figures.
Use: a factual description of what the tool does and how to reach a person.

Illustration: one practice, two versions of a chat greeting

This is an invented example to show the difference, not a real practice. A family practice adds a website chat tool. The vendor’s default greeting reads: “Hi! I’m Jenny from the front desk. Tell me what’s going on and I’ll help you figure out what you need.” Patients may take Jenny for a staff member, the bot invites symptom talk, and nothing says it is AI or how to reach a person.

The revised greeting reads: “Hi, I’m [Practice name]’s virtual assistant. I’m an AI system, not a person. I can book or change appointments and answer questions about our hours and location. For questions about your health, tap ‘Talk to staff’ or call [phone]. If this is an emergency, call 911.” The chat window keeps an “AI assistant” label visible, and symptom questions go to staff instead of getting an answer from the bot.

Checklist before an AI tool talks to patients

We listed each place AI produces words a patient sees or hears: chat, phone, texts, portal replies, letters, emails.
We know which states our patients are in and checked the current law in each, not only the ones in this guide.
Chat shows an AI disclosure at the start and a label throughout, with a visible way to reach staff.
Voice says it is AI at the start and the end, with a way to reach a person or leave a message.
AI-drafted clinical messages carry the disclaimer at the top unless a licensed clinician read and reviewed them, and we record who reviewed.
The tool has no human name presented as staff and no clinical title.
The tool answers truthfully when asked whether it is AI.
Intake paperwork explains AI use in care, including diagnostic support where used.
Colorado patients: counsel reviewed whether any tool influences decisions on access to care before January 1, 2027.
Website and ad copy about the tool makes no claim we cannot support.
The vendor’s data handling was confirmed in writing before any patient information went through the tool.
A clinician, the practice manager and a health care attorney approved the scripts.

How we help

We build websites, local search, patient lead generation and AI front desk tools for independent practices and health businesses. For AI disclosure, that means chat and voice scripts that state up front that the patient is talking with AI, a visible path to staff, no human names or clinical titles on the tool, and site copy that describes the tool plainly. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

What does California AB 3030 require?

Health and Safety Code section 1339.75, effective January 1, 2025, requires a health facility, clinic, physician’s office or group practice office that uses generative AI for patient communications about clinical information to include a disclaimer that the message was AI-generated and clear instructions for reaching a human. It does not apply when a licensed or certified provider read and reviewed the message.

Does AB 3030 apply to an AI scheduling assistant?

The statute excludes administrative matters, including appointment scheduling, billing and other clerical or business matters, from patient clinical information. Once the tool discusses a patient’s health status, that exclusion no longer fits.

Can our AI assistant use a human name?

California AB 489 prohibits terms or phrases in an AI system’s advertising or functionality that imply care or advice comes from a licensed person. A plain label such as “virtual assistant” avoids that, and the Utah safe harbor asks the tool to say it is AI or not human. Synthetic voices and presenters in ads raise separate rules, covered in our guide to AI voices and avatars in practice ads.

Does Utah require an AI disclosure for health care?

Utah Code 13-75-103 requires an individual in a regulated occupation to prominently disclose generative AI use in a high-risk interaction, which includes collecting health data and giving medical advice. The disclosure comes verbally at the start of a call or in writing before a written interaction.

What changed with the Colorado AI Act?

SB 24-205 never took effect. SB 26-189, signed May 14, 2026, repealed and reenacted it as a narrower law on automated decision-making in consequential decisions, including health-care services, starting January 1, 2027.

Is there a federal law on AI disclosure for practices?

This guide covers state laws and the FTC Act. Section 5 of the FTC Act prohibits deceptive practices, and the FTC has said there is no AI exemption from existing law, so claims about what an AI tool does must be true.

State AI disclosure laws for patient messages: California AB 3030 and AB 489, Utah, Texas, Colorado and the FTC Act, with wording for chat, voice and letters