New York excludes PTs from child abuse law

Your outpatient physical therapy practice just turned on an AI scribe, and somewhere between the demo and the invoice, a harder question showed up: if something a patient says during a session should be reported, does the AI tool change what you're legally required to do about it? For a practice already treating post-stroke patients, older adults with early cognitive decline, and the occasional pediatric caseload, that's worth getting right before the tool is switched on, not after.

The OT and SLT side of this site already mapped safeguarding duties against AOTA and ASHA guidance (see AI HIPAA rule delayed to 2027, safeguarding duty isn't). Physical therapy has its own regulator, its own association, and a more inconsistent state-by-state reporting picture than most PT owners assume. Seven questions worth answering below.

Does an AI scribe change my legal duty to report abuse as a physical therapist?

No. The answer doesn't come from your software vendor, it comes from your state. Mandated-reporter status is set by state statute and attaches to you as a licensed clinician, whatever you use to write your notes. In Pennsylvania, every physical therapist and physical therapist assistant is a mandated reporter of suspected child abuse (49 Pa. Code §40.202). Connecticut names physical therapists among its mandated reporters (Connecticut Department of Public Health, checked August 2026). California's reporting law sweeps in any health practitioner employed in a clinic, health facility, or physician's office, covering most outpatient PTs.

New York is the outlier worth knowing if you practice there. Under Social Services Law §413(a), physical therapists and physical therapist assistants aren't named as mandated reporters of child abuse, unless their employment falls into a specific category such as hospital personnel or staff of a licensed residential care facility for children (New York State Education Department, Office of the Professions, "Reporting Suspected Abuse and Neglect," Alert 21, checked August 2026). A solo outpatient PT in private practice in New York carries a different legal duty than a PT employed by a hospital three blocks away.

So what for you: look up your own state's statute by name, once, rather than relying on what a colleague in a different state told you.

If physical therapists aren't mandated reporters in my state, am I off the hook entirely?

No, and New York shows why. The same state that excludes most private-practice PTs from its general child-abuse reporting law separately requires them to report incidents involving "vulnerable persons," anyone who, because of a physical or cognitive disability, is receiving services from a facility or provider agency (New York Social Services Law, sections 488 and 491, enforced through the Justice Center's Vulnerable Persons' Central Register). A PT treating a patient in a supported-living or day-program setting can carry zero general child-abuse duty and a real, separately enforced duty to report abuse of that same patient, under a completely different statute.

So what for you: map your caseload against your state's separate statutes rather than a single blanket rule. Pediatric patients, adults with disabilities in facility-based care, and general adult patients can each sit under a different reporting scheme in the same state.

Does APTA require me to tell patients I'm using AI to record their sessions?

Not in the specific way AOTA does for occupational therapists. APTA's House of Delegates policy on AI, P07-24-10-09 (adopted September 23, 2024), states that the association "supports the ethical development and integration of artificial intelligence that reduces administrative burden," a statement of support, not a consent requirement (American Physical Therapy Association, Policy P07-24-10-09). APTA's new Code of Ethics for the Physical Therapy Profession, adopted July 2025 and posted January 1, 2026, was modernized to help PTs reason through AI-related ethics questions, but no public provision requiring advance patient consent before an AI tool records a session, comparable to AOTA's Policy E.19, could be confirmed at time of writing. APTA does publish a member-only practice advisory on AI-enabled ambient scribes (issued September 2025), whose exact consent language can't be verified from public sources.

So what for you: don't wait for APTA's public guidance to catch up with AOTA's. Adopt the stricter standard voluntarily: disclose AI use in writing before you switch it on, every time.

Do I have to tell patients I'm using AI under Texas law?

Yes, if you practice in Texas. The Texas Responsible AI Governance Act (TRAIGA, House Bill 149), in force since January 1, 2026, requires anyone licensed to provide health care services, which includes physical therapists, to disclose to a patient that an AI system is being used "in relation to health care service or treatment." Disclosure must arrive no later than the date service is first provided, in clear, plain language, with no dark pattern used to obscure it (Holland & Knight, "Texas Enacts Comprehensive AI Governance Laws with Sector-Specific Healthcare Provisions," 2025; Texas Medical Association AI disclosure summary, checked August 2026). Emergencies get an exception: disclose as soon as reasonably possible afterward. TRAIGA isn't PT-specific, but it applies by scope of activity, not profession, so an AI scribe, intake chatbot, or triage tool is covered.

So what for you: if you practice in Texas, this isn't a future compliance project, the law is already in force. Put a plain-language AI disclosure line into your intake paperwork this month.

Is there a HIPAA rule specifically for AI and vulnerable patients yet?

Not yet, and not soon. HHS's Office for Civil Rights proposed updates to the HIPAA Security Rule on January 6, 2025, that would require covered entities to inventory AI tools touching protected health information and fold AI vendor risk into Business Associate Agreement reviews. The comment period closed March 7, 2025 with more than 4,000 responses. OCR's own target of a final rule by May 2026 came and went with nothing published, and the federal regulatory tracker, the OMB Unified Agenda (RIN 0945-AA22), now lists July 2027 (HHS.gov, HIPAA Security Rule NPRM factsheet, 2025; OMB Unified Agenda, checked July 2026). That delay doesn't leave AI unregulated. The existing Security Rule risk-analysis requirement, in force since 2005, already obligates you to assess any technology, AI included, that touches patient data, and a signed Business Associate Agreement with any AI vendor is already required, not a 2027 addition.

So what for you: run the risk analysis and get the BAA signed now. Waiting for 2027 buys you nothing except two more years of unaddressed exposure.

Does a patient with a cognitive impairment need a different AI consent process?

Yes, procedurally, and physical therapy caseloads carry more of this population than most specialties realize. Neuro rehab, post-stroke recovery, traumatic brain injury, and geriatric fall-risk referrals routinely include patients whose capacity to consent to an AI tool is reduced, fluctuating, or genuinely contested. Research ethics protocols already require a formal capacity assessment before consent from a cognitively impaired participant is accepted at face value, routing consent to a surrogate or legally authorized representative when capacity is reduced (University of California San Francisco Human Research Protection Program guidance, 2026). Clinical AI use isn't research, but the logic transfers directly: if a patient can't understand what an AI scribe does with a recording, the disclosure needs to reach whoever holds legal authority for them, not just be read aloud and checked off a form.

So what for you: build a capacity flag into intake for your neuro and geriatric caseload, and route AI consent to a healthcare proxy or guardian whenever that flag is raised.

Can an AI-generated note put a domestic violence patient at more risk?

It can, in a way that has nothing to do with AI accuracy and everything to do with where the note ends up. Physical therapists regularly treat injury patients, and mechanism-of-injury detail (how a fall happened, where a bruise came from, what the patient said in their own words) is exactly what an AI scribe is built to capture in full. Under the 21st Century Cures Act's information-blocking rule, that expanded note becomes visible to the patient through the portal by default, and portal access isn't always exclusive to the patient: password-sharing and proxy access are common, and the documented risks include an abusive partner reading notes never intended for them (see the analysis of multiuser electronic health record access in "The 21st Century Cures Act and Multiuser Electronic Health Record Access: Potential Pitfalls of Information Release," PMC, 2022). A terser note reading "reports fall, right ankle sprain" carries far less of that risk than an AI transcript preserving the patient's exact account of what happened and who was present. The Cures Act's preventing-harm exception lets a practice withhold specific information from a portal when release could reasonably endanger the patient, use it deliberately rather than letting every AI note publish automatically.

So what for you: if intake ever flags a patient as being in an unsafe home situation, treat that as a trigger to review AI-generated notes before they reach the portal, not after.

The bottom line

None of the seven answers above change because a practice added an AI tool. Mandated-reporter status, capacity-based consent, HIPAA's existing risk-analysis duty, and Texas's new disclosure law all attach to you as the licensed clinician, not to whatever software sits between you and your notes. What does change is the paper trail: an AI-generated record is more detailed, more discoverable, and, through portal access, more exposed than a quick handwritten note ever was. The fix costs an afternoon, not a compliance program: look up your own state's reporting statute, write a one-paragraph AI disclosure for intake, flag patients whose capacity or safety situation calls for extra care before a note reaches a portal, and get a signed Business Associate Agreement from any AI vendor if you haven't already. For the consolidation pressure sitting alongside this compliance question, see 7% of US physio clinics are now PE-owned.

Related: AI HIPAA rule delayed to 2027, safeguarding duty isn't  ·  7% of US physio clinics are now PE-owned  ·  the AI Opportunity & Growth Assessment

This article is for informational purposes only and does not constitute legal, clinical, or safeguarding advice. Mandated-reporter obligations vary by state; confirm current requirements with your state licensing board and legal counsel before relying on anything above.