Compliance

Patient Photo Consent for AI Tools: What Your Forms Need to Say

A general "we may photograph you for treatment purposes" line, buried in a new-patient packet, wasn't written with AI simulation in mind and probably doesn't cover it. If you're generating AI simulations from patient photos, your consent language should say so specifically. Here's what that covers, with sample language you can adapt.

July 13, 2026 · 5 min read

This article explains what to consider and offers sample language as a starting point. It isn't legal advice, and consent requirements vary by state. Have your compliance officer or an attorney review any form before you use it.

Why "General Photo Consent" Often Isn't Enough

Most new-patient packets include a line about photographs for treatment or marketing purposes. That language predates AI simulation and usually doesn't address the specific things that make AI different: the photo is processed by a third-party tool, a synthetic image is generated from it, and the result may be shown to the patient, shared with them, or used elsewhere. Broad "we may take photos" consent doesn't clearly cover any of that.

What Specific Consent Should Cover

  1. 1That the photo will be processed by a third-party AI simulation tool, named specifically
  2. 2That the output is an AI-generated simulation of a possible outcome, not a guarantee or a clinical prosthetic design
  3. 3How long the photo and the generated simulation are retained, and when they're deleted
  4. 4Whether the simulation may be used for any purpose beyond the patient's own consultation (marketing, case studies, training) — and that this requires separate, explicit consent
  5. 5That the patient can decline the simulation without it affecting their care

Sample Consent Language

"I consent to having a photograph taken of my smile for the purpose of generating an AI-simulated preview of a possible treatment outcome using [vendor name]'s software. I understand this is a visualization tool, not a clinical diagnosis or guarantee of results. My photo and the generated simulation will be retained according to the practice's privacy policy and deleted automatically after [retention period]. This simulation will not be used for marketing or shared outside my care team without my separate written consent."

Adjust the bracketed details to your actual vendor and retention policy — a form that states a retention period your vendor doesn't actually honor is worse than no form at all.

Separate Consent for Marketing Use

If you want to use a patient's before/after simulation on your website, social media, or in a case study, treatment consent doesn't cover that automatically. Use a distinct marketing-release form, specific to that use, with its own signature line — bundling it into the general intake consent invites exactly the kind of dispute a separate signature avoids.

Where This Fits With Your BAA

Patient consent and your vendor's BAA cover different things: the BAA governs the relationship between your practice and the vendor handling PHI; patient consent governs what the patient has agreed to. You need both — a signed BAA doesn't substitute for patient consent, and patient consent doesn't substitute for a BAA.

HIPAA handled by default. Consent is still on you.

BAA signed at signup, 7-day auto-delete. $5 per simulation.

Get Started See pricing