AI tools are being increasingly integrated into clinical practice, offering many advances in administration and patient care. However, as with any emerging technology, there are risks that practitioners should understand and manage. One such risk that clinicians should not overlook is consent, especially understanding how to navigate consent when using diagnostic support tools, ambient scribes or generative AI. Ensuring fully informed consent has been obtained, and can be withdrawn, is essential to maintaining trust and upholding professional and ethical standards. This article aims to provide a practical overview of the consent implications to consider when using AI in clinical practice.
Consider this scenario: Dr F started using an AI scribe tool to record patient consultations and summarize clinical notes to help minimize time spent on administrative tasks. However, the clinic had no formal policy regarding use of AI tools or when informed patient consent should be obtained, and Dr F failed to inform the patient, Ms P, that her consultation was being recorded by AI.
Later, Ms P contacted the clinic with a question about her consultation. Whilst reviewing the notes, Dr F mentioned in passing that they had been generated by AI. Ms P was very surprised by this and made a formal complaint to the practice that she had not been informed that the consultation would be recorded and that she would not have consented to AI recording it.
Importance of consent when using AI
The Personal Data (Privacy) Ordinance (PDPO) (Cap.486) requires a lawful basis for processing personal data. Consent is the commonly used lawful basis in medicine. There are six Data Protection Principles (DPPs) that must be followed, and the first touches on the purpose and manner of collection. It states that data should only be collected for a lawful purpose directly related to a function of the data user, and the collection should be necessary but not excessive for the purpose. It also requires “inform[ing] the data subjects whether it is voluntary or obligatory to supply the data, the purpose of using their data, and the classes of person to whom their data may be transferred”.
Any use of personal data for a purpose unrelated to the original purpose of data collection requires the data subject’s “express and voluntary consent” as per Data Protection Principle 3 (DPP3). This must therefore be borne in mind when considering transfer or use of data for AI training, for example. Explicit consent is also a requirement prior to data collection for using generative AI in healthcare, according to the Digital Policy Office’s Generative Artificial Intelligence Technical and Application Guideline published in December 2025.
Creating a policy for implementation and use of AI, including when informed patient consent should be obtained, is a must for every practice to ensure employees understand the expectations on them and are consistent in their application of AI tools. Medical Protection advises that informed consent should be sought from patients before using AI tools that require sharing of their personal data with a third party, and special consideration should be taken if any data is transferred outside of Hong Kong, for instance in cross-border data transfer (Section 33 of the PDPO).
The Medical Council of Hong Kong (MCHK)’s Code of Professional Conduct advises medical professionals, under Section 1.1.5, to comply with their responsibilities under the PDPO, and specifies the requirement for patient consent prior to any transfer of medical data to a third party not involved in the medical referral (1.4.1 MCHK). Insufficient consent and notification when processing data through AI can result in criticism by the MCHK and the Privacy Commissioner for Personal Data (PCPD). Practitioners who are also Chief Medical Executives (CMEs) at licensed healthcare facilities should also be aware of their obligations under the Private Healthcare Facilities Ordinance (PHFO); the Codes of Practice for Clinics, Day Procedure Centres and Hospitals all refer to the need for staff to have “due regard” for their responsibilities under the PDPO.
The issue of consent should also be considered beyond the processing of personal data. For example, if AI was utilized in clinical decision making, patients should be made aware of, and be content with, the fact that the recommendations for management would be a combination of the AI’s and the clinician’s assessment. This may help avoid future complaints if an issue arose and a patient complained of not being unaware that AI was utilized.
Although the MCHK has not developed specific guidance for AI use in healthcare, the usual professional obligations will apply regardless of the technology used. In the existing Code, there is reference to an expectation and encouragement of innovative ideas, alongside a reminder that respect must be maintained for patients’ human rights and dignity (22.1).
Consent and ambient voice technology
This technology, often referred to as an ambient scribe, usually takes the form of software that records a consultation and transcribes this into written note form, often integrated into existing clinical systems. Potential advantages are saving time taking written notes or writing reports, and allowing doctors to focus more on active engagement with patients.
Importantly, practitioners using AI scribes should ensure patients understand that the technology is being utilized, are given opportunity to ask questions about this, and consent to its use. The MCHK touches on the issue of recording in its guidance on telemedicine, advising that “it is a must, instead of a matter of courtesy” for consent to be obtained from patients prior to a recording is made of a teleconsultation, and it should be assumed that this applies to regular face-to-face consultations (see Questions and Answers to the Ethical Guidelines on Practice of Telemedicine).
To fulfil the required obligations, practitioners and relevant clinic staff should be in a position to communicate to patients how the technology works, the information storage and processing, and safeguards in place. Importantly, patients should be offered a true choice when asked if they consent to its use, and clinicians should be prepared to proceed with the clinical interaction if the patient does not provide consent for scribe use, without negatively impacting patient care.
Looking ahead
Over time, AI technology will become increasingly embedded in various aspects of the healthcare sector. With the current regulatory framework, this would bring significant implications from a patient choice and data protection perspective, especially if a patient refuses the use of AI in his/her care but the technology’s implementation across a practice’s processes makes this difficult without impacting the quality of care. In the meantime, clinicians should continue to bear in mind their obligations around consent for AI use, so as not to compromise patient autonomy and data protection, and to ensure that their professional reputation is protected.
Contact your medical defence organization if there are questions or concerns about the use of AI and consent.
Medical Protection has developed the AI Safer Practice Framework to help practitioners integrate AI safely and responsibility into their practice. The Framework consists of two parts – INFORMED and RECORDS – and has been structured around these acronyms to ensure it is practical and memorable. Members can also access the “Managing the risks of AI in medicine” course on The Learning Hub, as a benefit of membership. The interactive course can be accessed any time: https://prism.medicalprotection.org/course/view.php?id=1834
