AI Disclosure in Healthcare: The Hard Questions Nobody Has Answered Yet

Consider a patient moving through a single hospital stay: an AI triaged their initial presentation, a risk stratification algorithm influenced their bed assignment, an AI-assisted tool read their imaging, an ambient scribe transcribed the physician conversation, a generative AI system drafted their discharge instructions, and a patient portal message was AI-generated. If each of these requires separate disclosure — the most aggressive reading of laws like TRAIGA — the patient is buried in notifications before they've processed why they're in the hospital.

The research literature calls this consent fatigue, and it's well-documented in clinical research settings, where informed consent forms have grown so long and legalistic that most patients sign without reading. The same dynamic — disclosure as ritual rather than communication — is a live risk in clinical AI. The Mello framework explicitly warns against indiscriminate notification: too much disclosure can stoke distrust of tools that are genuinely beneficial.

We shouldn't optimize disclosure for ease of institutional delivery. Patients are encountering AI tools that carry genuine risk. The solution to consent fatigue is better disclosure design, not less disclosure. Pharmaceutical packaging has evolved from dense insert text toward structured, patient-centered formats. AI disclosure could evolve similarly — from incident-level notifications toward a coherent, cumulative picture of how AI is present across a care episode.

There is also a precedent question: we do not generally allow institutions to decide that a type of risk is too complex for patients to understand and therefore not worth disclosing. The complexity argument has historically been used to justify withholding information that patients would, in fact, want.

The question the field needs to answer is what the right unit of consent is: the individual tool, the clinical encounter, the care episode, or the ongoing care relationship. Different answers produce radically different compliance architectures — and different levels of meaningful patient engagement.

The populations most likely to experience AI-related harm in healthcare are not the patients most likely to benefit from AI disclosure. The evidence on algorithmic bias in clinical AI is extensive: systems trained primarily on data from majority populations have documented performance disparities across race, gender, age, and socioeconomic strata. The Office for Civil Rights has made clear that AI use in healthcare cannot discriminate on the basis of protected characteristics.

But the patients most affected by biased AI are also, disproportionately, those with the least capacity to act on a disclosure. Lower health literacy, language barriers, limited access to second opinions, and structural dependence on the healthcare systems they interact with all reduce the practical meaning of consent. A patient told that AI is involved in their care, but who cannot evaluate what that means, cannot seek alternatives, and cannot navigate a grievance process if something goes wrong, has received a disclosure that protects the institution more than it protects them.

Disclosure may be doing two distinct jobs simultaneously, and conflating them may be why current practices feel inadequate to both. The first function is protecting individual autonomy — the patient who can read, evaluate, and act on a disclosure. The second function is maintaining public accountability — disclosures that exist, are auditable, and can be reviewed by regulators, advocates, and journalists regardless of whether individual patients engage with them.

The Evans and Bihorac argument in NEJM AI points toward this: if individual consent is structurally inadequate for large-scale AI environments, community-based oversight structures may be the only mechanism that gives patients genuine collective voice — as opposed to individual notifications that are, in practice, unreadable.

These two functions may warrant different mechanisms. A consent form cannot serve both. The honest question is whether current disclosure frameworks are protecting the patients who can already protect themselves — and leaving everyone else to absorb the risk.

The AMA survey finding — 71% privacy concern for non-institutional tools vs. 42% for institutional ones — reflects an intuition that has some basis. Institutional deployment carries governance infrastructure that consumer tools don't: vendor contracts, business associate agreements, clinical validation processes, and mandatory human oversight requirements. TRAIGA draws exactly this distinction. The implicit premise is that an institution that has procured, validated, and deployed an AI tool has done diligence that justifies reduced patient concern.

Research on over-disclosure supports a version of this: indiscriminate notification about all AI — including well-validated, low-risk administrative tools deployed through vetted institutional channels — can undermine patient trust in tools that are genuinely safe and beneficial. If the institution has done the work, the argument goes, the patient doesn't need to replicate it every encounter.

The 2025 CHIME Foundation survey found that only 8% of healthcare organizations are "very confident" in their ability to identify emerging AI risks. The institutional governance process that is supposed to earn the trust discount may be thinner than patients — or physicians — assume. Accreditation and procurement approval are not the same as rigorous clinical validation.

There is also a scale argument that runs in the opposite direction. When a health system deploys an AI tool across an entire enterprise, a failure doesn't affect one patient — it affects everyone the tool touches. Scale amplifies both the benefit and the harm, which may warrant more transparency, not less. The question of whether institutional deployment reduces disclosure obligations may be exactly backward: precisely because institutional tools are deployed at scale, the governance infrastructure surrounding them needs to be more transparent, more auditable, and more patient-legible — not less.

The emerging Joint Commission / CHAI voluntary certification pathway is an attempt to make institutional governance rigorous enough to genuinely earn that trust. Whether the standards are set with sufficient independence is the question worth watching.

When the AMA's 2026 Physician Survey found that clear liability frameworks ranked first among regulatory priorities — selected by 31% of physicians as their single most important action — this is the underlying concern. Not abstract legal tidiness. Physicians want to know: if I disclose that AI was involved and a patient proceeds, and something goes wrong, who bears responsibility?

The legal doctrine of informed consent establishes that patients have the right to understand material factors influencing their care. Evidence suggests many patients would think or behave differently about their care if they knew AI was involved — creating a plausible argument that AI use meets the materiality threshold for disclosure under existing doctrine. The UK's Montgomery v. Lanarkshire precedent — establishing that disclosure is required for what a reasonable patient would consider significant — applied to AI, opens significant liability territory.

If a clinician discloses AI use and a patient proceeds, does that disclosure shift moral and legal responsibility toward the patient in the event of an AI error? If so, disclosure functions as a liability transfer mechanism — essentially a release that says "you knew AI was involved and accepted the risk." Patients have strong reason to distrust a disclosure process designed primarily to protect the institution rather than inform them.

The opposite theory is also active. In August 2025, the Texas attorney general opened an investigation into AI chatbot platforms for potentially deceptive trade practices — the theory of liability being not patient harm from a bad clinical decision, but failure to be honest about what the tool is. Non-disclosure as deception, rather than disclosure as liability transfer, is a distinct and growing enforcement theory.

Entrepreneurs building consent management products are building into this unresolved tension. The product architecture of a consent management platform looks very different depending on which liability theory dominates in the jurisdictions where it operates — and the legal answer is not yet settled in any of them.

The federal deregulatory shift — the Trump executive order, the HTI-5 proposed rule, HHS signals that AI adoption acceleration is the priority — creates a vacuum that multiple parties are attempting to fill simultaneously, without coordination.

States are filling it with statutes, but inconsistently: four distinct disclosure regimes across California, Texas, Illinois, and Florida, with no mechanism for harmonization and no shared definition of what counts as AI use requiring disclosure. A multi-state health system is now building manual compliance workflows for the same enterprise tools, jurisdiction by jurisdiction.

Industry is filling it through CHAI and the Joint Commission — the most credible and scalable voluntary governance pathway currently in motion. But voluntary certification has an inherent limitation: organizations most likely to invest in rigorous AI governance are those that already have compliance cultures and governance infrastructure. The organizations most likely to harm patients through poorly governed AI are least likely to pursue voluntary certification.

Research institutions are filling the vacuum with frameworks — the Mello JAMA paper, the MRCT Center's clinical research AI framework, the bioethics literature — but academic frameworks are not enforceable and they move on publication timescales slower than AI deployment timescales.

The standards that end up governing AI disclosure will not necessarily be the ones that best protect patients. They will be the ones that achieve sufficient industry alignment to become operative. The Joint Commission / CHAI pathway is currently the most plausible route to a national de facto standard, and it is advancing faster than most people outside healthcare AI governance recognize.

The question for everyone in this field — entrepreneurs, clinicians, policymakers, patient advocates — is whether to engage with that standard-setting process now or wait for federal coherence that may not arrive. The playbooks are being written. The voluntary certification criteria are being drafted. The window for shaping what those standards actually require of AI tools at the point of patient disclosure is open, and it will not stay open indefinitely.