What one patient’s story reveals about AI, trust, and the future of regulation. This article is based on a presentation at the 2025 Annual Education Meeting by Nancy Kirsch, Alan Lee, Charlotte Martin, and Meg O’Connor.
Meg did not walk into her physical therapy clinic expecting to later teach regulators, boards, and practitioners a lesson about artificial intelligence. She walked in as a patient. Over five years—and more than 250 visits—she built a deeply trusting relationship with her physical therapist.
She trusted him with her care, her body, and something perhaps even more sensitive: her story. In the private setting of a treatment room, Meg shared the full context of her life—stressors, diagnoses, challenges, humor, and fears. It was the kind of therapeutic alliance physical therapists know well, where conversation is not incidental to care but part of it.
What she did not know was that she was not alone with her therapist. One day, mid-conversation, Meg noticed something unusual on her therapist’s screen. When she asked, the answer came quickly: the clinic had begun using an AI-powered scribe—software that leverages Artificial Intelligence to make sense of recorded conversations. The software records conversations, transcribes them, and generates documentation using Large Language Models to create meaningful notes and summaries.
Her therapist explained it was designed to save time, reduce documentation burden, and improve care. There was just one problem—he hadn’t told her ahead of time. In fact, he had been recording their sessions for three months without her knowledge.
What followed was not simply discomfort—it was a profound rupture in trust. Was it legal? In her state, yes—it was a one-party consent state, meaning recording could occur without her permission. But was it ethical?
Meg’s concerns extended beyond the act of recording itself. As a data scientist, she understood that the issue was not just that she was being recorded, but what happened to that recording afterward.
Her therapist could not answer those questions in the moment. When the technology vendor eventually supplied answers, they were alarming.
The company stored full transcripts and audio recordings for up to ten years. The data was not de-identified. It could be accessed for legal discovery. Human reviewers could evaluate the data. The stakes shifted instantly. For Meg, this transformed a documentation tool into something far more consequential.
What she had thought were ephemeral conversations—shared in a trusted clinical setting—had become permanent, searchable artifacts.
The impact of the discovery went beyond data privacy and into a loss of autonomy. Because she did not know she was being recorded, she could not choose what to share, how to share it, or whether to share it at all. Her ability to make informed decisions about her own participation in care had been removed.
Physical therapy relies heavily on conversation—on rapport, trust, and the willingness of patients to speak openly about their lives. When that trust is broken, the consequences are not abstract. The technology intended to improve practice efficiency had instead undermined one of the practitioner’s core strengths.
Meg’s story exposes a critical truth: in many ways, AI is advancing faster than regulation, guidance, and professional understanding. Several gaps became evident:
Perhaps most importantly, the situation revealed a mismatch between expectations and reality. Patients assume that their privacy is protected in a clinical setting. Practitioners assume that tools marketed as “HIPAA compliant” are safe. Regulators assume that existing standards will apply. But AI introduces new complexities—particularly when data is transmitted, stored externally, or used to train systems. Regulations and protections are scrambling to keep up with the rapid pace of technological advancement, leaving many gaps.
Rather than pursuing immediate disciplinary action, Meg raised a concern that reached far beyond her own experience. She was not trying to punish practitioners. She wanted practitioners and patients alike to understand what these new tools can do, what risks they may carry, and what safeguards need to be in place before AI becomes a routine part of care.
Regulators play an important role here. Rather than waiting for complaints and responding after harm occurs, boards have an opportunity—and arguably a responsibility—to act proactively. Boards should consider how they can best educate practitioners to enhance public protection.
In Meg’s state, the Louisiana Physical Therapy Board carefully considered Meg’s concerns and created the following resources for practitioners:
These efforts demonstrate that boards can play a critical role—not just as enforcers, but as educators and partners.
Meg’s story offers several clear, actionable lessons for boards considering their approach to AI.
Boards should clarify expectations around informed consent—not only for recording, but for any technology that captures or transmits patient data. At a minimum, practitioners should take the following actions:
Informed consent is not just a legal concept—it is foundational to patient autonomy and trust.
Many practitioners, particularly in smaller clinics, are not equipped to evaluate complex technology agreements. Boards can help by offering the following resources:
Meg’s case highlights how critical these details are—and how easily they can be overlooked.
AI adoption is often driven by real pressures—time constraints, reimbursement challenges, and administrative burden. AI-powered documentation tools can address real challenges:
These are meaningful benefits, especially for smaller practices and clinicians facing increasing pressures. It can help practitioners avoid tedious work and spend more time focused on patients. Boards should acknowledge this reality. Guidance should not simply warn of risks, or worse, ban such technology. Instead, it should also provide practical pathways for safe use, recognizing that these tools are increasingly part of everyday practice.
Meg’s role in shaping the regulatory response demonstrates the value of patient input. Boards should also consider educating patients and the public.
Patients are not passive participants—they are partners in protecting their own data.
Perhaps most importantly, boards should resist the instinct to focus solely on discipline. Education and guidance can prevent violations before they occur. If boards only act after harm, they miss the opportunity to shape safer practice. A proactive approach builds trust—not just with licensees, but with the public.
Meg had the knowledge, persistence, and platform to raise concerns and seek answers. However, many patients do not. They will not know what questions to ask. They will not understand the risks. They may never realize what has happened to their data.
That is why this moment matters.
Artificial intelligence is not a distant future challenge—it is already in clinics today. And as adoption accelerates, so too does the need for thoughtful, proactive oversight. Boards are uniquely positioned to guide practitioners—clearly, practically, and proactively—so that the benefits of AI can be realized without sacrificing the trust that defines the patient-provider relationship.