Understanding AI and consent

The growing use of artificial intelligence (AI) tools in clinical settings is transforming how care is delivered and bringing benefits to healthcare professionals (HCPs) and their patients. When used appropriately, AI tools can streamline and reduce administrative tasks and allow more time for patient care. That said, AI use is not without risks—medicolegal concerns around consent issues, particularly around diagnostic tools, ambient scribes, or generative AI, are increasingly common on the Medical Protection advice line.

For clinicians, understanding how to navigate consent in the context of AI is essential to maintaining trust and upholding professional and ethical standards. It is also important to remember patient autonomy. The AI guide published by the Malaysian Medical Council (MMC) says: ‘It is important to ensure that AI does not interfere with human autonomy… Privacy, confidentiality, informed consent, and data protection laws all play a crucial role in safeguarding patient autonomy.’

This article aims to provide a practical overview of the consent implications to consider when using AI in clinical practice.

Consent to use of AI in the first place
Health information is classified as sensitive personal data which requires the express consent of the data subject. The Personal Data Protection Act 2010 (PDPA) requires that there is a lawful basis for processing this type of data, and healthcare facilities should ensure that when implementing AI software, they continue to comply with their PDPA obligations.

The MMC state that patient data must not be shared on any AI system without patient consent. Respecting a patient’s right to dissent may become more difficult with time as AI becomes increasingly embedded in healthcare systems. Medical Protection advise particular care before using AI tools that require the sharing of their personal data with a third party.

This is in line with guidance from the MMC, which states that registered medical practitioners should inform patients before the consultation of how the AI tools are being used in their clinical care, any known risks associated with the use of the AI tool, explain the safeguards and if there have been any adverse outcomes. [https://tinyurl.com/477djpva]

Consent in relation to clinical decision-making
Considerations around consent extend beyond the processing of personal data.  Doctors will also need to consider consent for the use of AI in other situations.  For example, if AI was being utilised in clinical decision making, it would be advisable that patients are made aware of, and are content with, the fact that the recommendations for management will be a combination of the AI and clinician’s assessment.  This may help to avoid complaints in future if an issue arose and a patient complained that they were unaware AI was being utilised. The MMC, in its AI guidance, list some of the information that should be communicated to a patient as part of the consent process, including any known risks associated with the tool and the basis of any results generated by it.

The MMC also makes it clear that AI tools should only support, not replace, clinical judgment: “registered medical practitioners remain responsible and accountable for the patient’s clinical outcomes’’ and that “AI should complement, not replace clinical judgement.”  For the consent to be valid, the patient should be sufficiently informed and so the clinician needs to have adequate knowledge and understanding of the AI tool itself, to be able to relay this adequately to the patient.

Consent and ambient voice technology
This technology, often referred to as ambient scribe, usually takes the form of software that records a consultation and transcribes this into written note form, often integrated into clinical systems. This has the potential advantage of saving time taking notes and allowing doctors to focus more on active engagement with patients.

It is important that when clinics or clinicians are using AI scribes, patients understand that the technology is being utilised, are given opportunity to ask questions about this (for example patients may have questions about the processing and flow of their personal data), and are asked explicitly whether they consent to its use. Consent for the use of scribe software should also be documented in the medical records.

Doctors and clinics need to be prepared in the event a patient does not consent, so that patient care is not adversely impacted.

Case study: AI scribe used without patient consent
Dr S, began using an AI scribing tool in the clinic to record consultations, summarise clinical notes, and draft reports and referrals, with the goal of improving efficiency. The clinic had no formal AI policy in place regarding the use of AI or when informed patient consent should be obtained, and Dr S did not inform her patient, Mrs B, that her consultation was being recorded.

Mrs B subsequently contacted the clinic with a complaint about the medical report that had been produced for her insurer, as she noticed some inaccuracies. The clinic advised that the consultation notes were AI-generated, which was a surprise to Mrs B.  She complained to the clinic that she had not been told the consultation was recorded and would not have consented to the use of AI.

Medical Protection assisted Dr S with the drafting of a letter to Mrs B, apologising for not gaining her consent before using the AI scribe tool to record her consultation. The patient accepted this explanation and apology, and Dr S reissued a report with the inaccuracies corrected. After this complaint, the clinic introduced a clear AI policy, which also set out the consent process.

HCPs with questions or concerns about the use of AI and consent can contact their Medical Defence Organisation.