# Do patients need to know they are talking to an AI? Disclosure rules for medical practices

> What California, Utah and the FCC actually require as of October 2026, what they do not, and a disclosure line you can use on every call.

Source: https://medphone.ai/blog/do-patients-need-to-know-they-are-talking-to-ai

Author: Agni Patel, MedPhone AI. Published 2026-10-23.

**As of October 2026, no federal law requires a US medical practice to tell patients they are talking to an AI on an inbound phone call, but California and Utah require AI disclosure in specific situations, and the FCC treats AI generated voices on outbound calls as artificial voices that need prior consent. Because the rules depend on the state and on what the call is about, the safe and better practice is for an AI receptionist to say it is an AI at the start of every call and offer a route to a person.**

## Key facts

- California SB 1001 (Chapter 892, Statutes of 2018), in force since July 1, 2019, makes it unlawful to use a bot online to mislead a person about its artificial identity in order to drive a sale or influence a vote.
- California AB 3030 (Chapter 848, Statutes of 2024), effective January 1, 2025, requires an AI disclaimer on generative AI patient communications about clinical information, given verbally at the start and end of an audio interaction.
- California AB 3030 defines patient clinical information to exclude administrative matters such as appointment scheduling and billing.
- California AB 3030 does not apply to an AI generated communication that a human licensed or certified health care provider has read and reviewed.
- California AB 489 (Chapter 615, Statutes of 2025), operative January 1, 2026, makes it unlawful to use AI in a way that implies health information or services come from a licensed health care professional.
- Utah S.B. 226 (2025), effective May 7, 2025, requires regulated occupations to disclose generative AI verbally at the start of a high risk interaction, which includes collecting health data.
- Utah S.B. 226 also requires a business using generative AI in a consumer transaction to disclose it when a person clearly asks whether they are talking to a human.
- The FCC ruled on February 8, 2024 (FCC 24-17) that AI generated voices are artificial voices under the TCPA, so outbound calls using them need prior express consent unless an emergency purpose or exemption applies.

## Do I have to tell patients they are talking to an AI?

A US practice has to disclose AI to patients in some states, depending on what the AI does on the call, and disclosing on every call is the easiest way to meet every rule. This is not legal advice; confirm your position with your own counsel. The landscape as of October 2026:

| Rule | Where | In force | What it requires | Relevance to an inbound practice line |
| --- | --- | --- | --- | --- |
| SB 1001, bot disclosure | California | July 1, 2019 | No bot misleading people about being a bot, online, to sell or sway a vote | Written for online bots; disclosure removes the liability |
| AB 3030, generative AI in patient communications | California | January 1, 2025 | AI disclaimer plus instructions to reach a human, spoken at start and end of audio | Applies to clinical information, not to purely administrative calls |
| AB 489, AI and professional titles | California | January 1, 2026 | AI must not imply it is a licensed health professional | Do not give the AI a clinical title or persona |
| S.B. 226, regulated occupations | Utah | May 7, 2025 | Prominent verbal disclosure at the start of high risk AI interactions | Practice calls often collect health data, which is high risk |
| S.B. 226, consumer transactions | Utah | May 7, 2025 | Disclose AI when a person clearly asks | Answer truthfully when a caller asks if it is a person |
| FCC ruling on AI voices | United States | February 8, 2024 | AI voices count as artificial voices under the TCPA | Outbound calls only; inbound answering is not covered by this ruling |

## What does California require?

California has three laws that touch an AI receptionist: SB 1001 on bots, AB 3030 on generative AI in patient communications, and AB 489 on implied clinical credentials.

### SB 1001: the 2019 bot disclosure law

SB 1001 added sections 17940 and following to the Business and Professions Code. It makes it unlawful to use a bot to communicate with a person in California online with intent to mislead them about its artificial identity, to incentivize a purchase or influence a vote, and a clear and conspicuous disclosure removes the liability. The law defines a bot as an automated online account or application, so its reach to a phone line is unclear; a disclosed bot is outside it either way.

### AB 3030: generative AI in patient communications

AB 3030 added section 1339.75 to the Health and Safety Code. A health facility, clinic, physician's office or group practice that uses generative AI to generate patient communications pertaining to patient clinical information must include a disclaimer that AI generated the communication, plus clear instructions for reaching a human health care provider or other appropriate person. For audio, the disclaimer is given verbally at the start and the end of the interaction.

Two limits matter for a front desk line. The law's definition of patient clinical information excludes administrative matters, including appointment scheduling, billing and other clerical or business matters. And a communication read and reviewed by a human licensed or certified health care provider is exempt. A call that only books a visit is administrative; one where the AI relays anything about a patient's health status is closer to the line, another reason to transfer clinical calls.

### AB 489: no implied clinical credentials

AB 489, signed on October 11, 2025, makes it unlawful to use AI in a way that implies health information or services come from a licensed professional when they do not, including through protected titles. For a phone agent the practical rule is simple: call it an assistant, never a nurse, and never give it a persona that sounds like clinical staff.

## What does Utah require?

Utah requires prominent AI disclosure at the start of high risk interactions in regulated occupations, and truthful disclosure on request in consumer transactions. S.B. 226, signed on March 27, 2025, replaced the 2024 Artificial Intelligence Policy Act disclosure rules from May 7, 2025.

- A person in a regulated occupation, meaning one licensed or certified through the Utah Department of Commerce, must prominently disclose generative AI verbally at the start of a high risk interaction
- High risk includes collecting sensitive personal information such as health data, and giving medical or mental health advice
- A safe harbor protects a person whose AI clearly discloses at the outset and throughout the interaction that it is generative AI, is not human, or is an AI assistant

Whether a scheduling call counts as regulated services is a question for counsel. An assistant that says it is an AI at the start and throughout fits the safe harbor either way.

## Does the FCC ruling apply to inbound calls?

The FCC ruling does not apply to inbound calls. The February 2024 declaratory ruling concerns calls initiated with an artificial or prerecorded voice, which now includes AI generated voices, so outbound reminder and recall calls made with an AI voice need prior express consent unless an emergency purpose or exemption applies, and must identify the entity responsible for the call. An AI receptionist answering calls that patients place is not initiating a call.

## Why give a disclosure to patients talking to an AI when no law requires it?

Disclose because patients want to know and the cost to satisfaction is small. HIPAA contains no rule that specifically requires telling patients about AI, so the case rests on trust. The evidence so far comes from portal messages rather than phone calls, but it points one way.

- A Duke University Health System survey of 1,455 patient advisory members (JAMA Network Open, March 2025) found satisfaction 0.09 points lower on a 5 point scale when AI authorship was disclosed, with more than 75 percent satisfied either way. The authors concluded disclosure should be maintained
- A follow up interview study of 40 patients (JAMA Network Open, July 2026) found participants broadly endorsed AI disclosure as important for trust, while differing on timing and format

## What should the disclosure say?

A good AI disclosure says the caller is talking to an AI, what it can do, and how to reach a person, in the first ten seconds. Here is a line you can adapt:

> Thank you for calling [practice name]. I am the practice's AI assistant. I can book, change or cancel appointments and take prescription refill requests. If you would rather speak with a person, just ask at any time. If this is a medical emergency, hang up and dial 911.

And a closing line, which covers the California requirement for audio communications to disclose at the end as well as the start:

> Before you go, a reminder that you have been speaking with [practice name]'s AI assistant. To reach a member of our team, [how to reach a person].

- Answer truthfully every time a caller asks whether they are talking to a person
- Make the route to a person work: a transfer during hours, and a clear callback or on call path after hours

## How does MedPhone AI handle disclosure?

MedPhone AI answers inbound calls that patients place, so the FCC ruling on outbound AI voices does not reach that work. The greeting, and the words MedPhone AI uses to say it is automated, are set with each practice during deployment, and clinical, urgent and unusual calls transfer to staff under rules the practice sets. Outbound reminders are separate work with their own consent rules, so ask what a plan includes.

Related: [How to deploy an AI phone agent, including the greeting](https://medphone.ai/blog/how-to-deploy-an-ai-phone-agent-at-a-medical-practice) · [Greeting and voicemail scripts for a doctors office](https://medphone.ai/blog/doctors-office-voicemail-greeting-scripts) · [How MedPhone handles PHI on a call](https://medphone.ai/hipaa-compliance)

Sources:
- [California Legislative Information, SB 1001 (2018), Bots: disclosure](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1001)
- [California Legislative Information, AB 3030 (2024), Health care services: artificial intelligence](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB3030)
- [California Assembly Committee on Privacy and Consumer Protection, 2025 analysis summarizing existing bot disclosure law](https://apcp.assembly.ca.gov/media/888)
- [California Assembly Committee on Privacy and Consumer Protection, 2025 analysis of AB 489, summarizing AB 3030](https://apcp.assembly.ca.gov/media/909)
- [California Board of Psychology, legislative advisory on AB 489, Chapter 615, Statutes of 2025](https://psychology.ca.gov/laws_regs/ab489_advisory.pdf)
- [Utah Legislature, S.B. 226 (2025), Artificial Intelligence Consumer Protection Amendments](https://le.utah.gov/~2025/bills/static/SB0226.html)
- [FCC Declaratory Ruling on AI generated voices under the TCPA, released February 8, 2024](https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf)
- [Cavalier et al., Ethics in patient preferences for AI drafted responses to electronic messages, JAMA Network Open, 2025](https://pubmed.ncbi.nlm.nih.gov/40067301/)
- [Owens et al., Patient perspectives on AI drafted electronic portal messages, JAMA Network Open, 2026](https://pubmed.ncbi.nlm.nih.gov/42412426/)

## Questions people ask

### Do I have to tell patients they are talking to an AI on the phone?

A US medical practice has to tell patients they are talking to an AI in some states and situations, and as of October 2026 no federal rule requires it on inbound calls. California requires an AI disclaimer for generative AI patient communications about clinical information, and Utah requires verbal disclosure at the start of high risk interactions in regulated occupations. Disclosing on every call meets both and is the better practice anyway.

### Does California AB 3030 apply to AI receptionists?

California AB 3030 applies when generative AI produces patient communications about clinical information, and its definition excludes administrative matters such as appointment scheduling and billing. An AI receptionist that only books, moves or cancels visits is doing administrative work; one that relays health information is covered unless a licensed provider reads and reviews the communication.

### Does HIPAA require disclosing AI to patients?

HIPAA contains no rule that specifically requires telling patients they are speaking to an AI. AI disclosure duties for US practices come from state laws such as those in California and Utah, while HIPAA still governs how the AI vendor handles protected health information under a business associate agreement.

### Does the FCC AI voice ruling apply to a practice answering calls with AI?

The FCC's February 2024 ruling applies to calls initiated with an AI generated voice, so it covers outbound calls, not a practice answering calls patients place. Outbound reminder or recall calls using an AI voice need prior express consent unless an exemption applies, and must identify the practice.

### What should an AI receptionist say to disclose it is an AI?

An AI receptionist should say, in its first sentence or two, that it is the practice's AI assistant, what it can help with, and that the caller can ask for a person at any time, followed by the 911 instruction. It should answer truthfully whenever asked if it is human, and never use a clinical title.

### Is it illegal for an AI receptionist to pretend to be human?

An AI receptionist that pretends to be human can break state law. California SB 1001 bars bots that mislead people online about their artificial identity to drive a sale, though its reach to phone lines is unclear; Utah requires a truthful answer when a person clearly asks in a consumer transaction, and California AB 489 bars AI from implying it is a licensed health professional. The safe rule is to answer truthfully every time a caller asks.