Subscriber Benefit
As a subscriber you can listen to articles at work, in the car, or while you work out. Subscribe Now
AI chatbots are the new, favored search engine. Patients use AI to summarize medical records, explain diagnoses, prepare questions for their next appointment and even organize therapy notes. It’s fast, convenient and increasingly commonplace. But there’s a legal catch. If a patient voluntarily uploads confidential medical information to a public AI platform, have they also given up the privilege protecting those communications?
Privilege, like attorney-client privilege, protects confidential communications. Voluntarily sharing privileged content with an unprivileged third party risks that confidentiality. The question for Indiana practitioners is straightforward but unsettled: Does a patient waive physician-patient or psychotherapist-patient privilege by disclosing their confidential data to an AI platform? Of course, the answer is fact-specific and depends on the forum and applicable privilege law. But two recent federal decisions involving AI and attorney-client privilege offer instructive analogies for the patient-privilege context.
Recent decisions on attorney-client privilege
United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026), is the sharper cautionary tale. A criminal defendant used a public-facing chatbot to prepare for an investigation, intending to discuss the results with counsel. The court held those chats were not protected by attorney-client privilege, because the communications were not with counsel, were shared with a third-party system whose privacy policy allowed collection of inputs and outputs, and were not made to obtain legal advice. The court emphasized the defendant could not have a reasonable expectation of confidentiality.
Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026), is more nuanced. The court protected a pro se plaintiff’s AI materials as work product and did not find actual privilege waiver. But it reiterated the black-letter principle that “voluntary disclosure of confidential material to a third party waives any applicable attorney-client privilege.” Id. at 636 [quoting Schanfield v. Sojitz Corp. of Am., 258 F.R.D. 211, 214 (S.D.N.Y. 2009)]. The court distinguished work-product waiver (which requires disclosure to an adversary) and described generative AI programs as “tools, not persons.” Id. at 636–37. Outside the work-product context, the same disclosure would present a stronger waiver problem.
These are attorney-client privilege cases, not physician-patient privilege cases. But the underlying logic — that submitting confidential information to a public AI platform may constitute voluntary third-party disclosure — applies with equal force to patient-held privileges.
Physician-patient privilege in Indiana
Physician-patient privilege in Indiana is statutory. Indiana Code § 34-46-3-1 provides that physicians shall not testify “as to matters communicated to them by patients, in the course of their professional business, or advice given in such cases.” The privilege protects patient-physician communications so patients may receive necessary diagnosis or treatment and is intended to inspire “full and complete communication.” Matter of C.P., 563 N.E.2d 1275, 1277–78 (Ind. 1990); Darnell v. State, 674 N.E.2d 19, 21 (Ind. Ct. App. 1996).
Indiana courts strictly construe the privilege, because it was unknown at common law and impedes the search for truth. Darnell, 674 N.E.2d at 21. Indiana extends privilege to third persons who aid physicians, but the key inquiry is the “nature and degree of control exercised” by the physician, “under [their] close supervision….” Id. at 21–22. A public-facing AI assistant would likely not qualify — it is not under physician supervision, not necessary for patient-physician communication and not operating as the physician’s agent.
The analogy to attorney-client privilege is direct. In Canfield, the Court held that the physician-patient privilege receives similar protection because of the “marked similarity of interests being protected.” Canfield v. Sandock, 563 N.E.2d 526, 529 (Ind. 1990). Indiana recognizes limited third-party exceptions, including common-interest protection for attorney-client communications furthering “an ongoing joint enterprise with respect to a common legal interest.” Price v. Charles Brown Charitable Remainder Unitrust Tr., 27 N.E.3d 1168, 1173 (Ind. Ct. App. 2015). Assuming the common-interest protection applies to physician-patient privilege, a public-facing AI platform would not appear to fit that exception.
Indiana Rule of Evidence 501(b) is central to the waiver analysis: A privilege holder waives the privilege by “voluntarily and intentionally disclosing … any significant part of the privileged matter.” This applies to both physician-patient and attorney-client privilege. In federal court adjudicating state-law claims, Federal Rule of Evidence 501 incorporates state privilege law, so Indiana patients’ AI use is evaluated under Indiana rules.
How AI can waive privilege
Under Indiana Rule of Evidence 501(b), when a patient submits privileged information to a consumer AI platform whose terms allow the provider to access, store and use the content, that disclosure would likely waive privilege as to “any significant part of the privileged matter” disclosed. Implied-waiver cases suggest a limited form of waiver may exist in Indiana. Collins v. Bair, 256 Ind. 230 (1971), held that waiver extended only to matters causally or historically related to the condition at issue. That waiver may be limited to the specific information submitted, not the patient’s entire medical history.
Conversely, one could argue AI platforms are “tools” rather than “persons,” that the patient had a reasonable privacy expectation or that mere technical access should not constitute “disclosure.” However, after Heppner, courts will likely look at the provider’s actual ability to access and use content, not the patient’s subjective expectations. If a user is noticed that the platform could retain data, there is real risk of waiving privilege.
Conclusion
No Indiana court has yet addressed whether a patient’s use of a consumer AI platform waives physician-patient or psychotherapist-patient privilege, but the framework for one already exists. Darnell, Matter of C.P., and Canfield commit Indiana courts to construing these privileges narrowly, not expansively. Rule of Evidence 501(b) already supplies the waiver mechanism, requiring only “voluntary and intentional disclosure” of a significant part of the privileged matter. Heppner now supplies the template for how a court applies that mechanism to AI specifically: not the patient’s subjective expectations, but the platform’s actual data practices and the objective absence of a licensed, confidential relationship. Warner offers a narrow counterweight, but it turns on work-product’s adversary-disclosure requirement, which does not exist in the physician-patient context.
Until Indiana courts say otherwise, practitioners should treat a client’s or patient’s AI use the same way they’d treat any other public disclosure — with caution and discretion.•
__________
Dudlo is a partner in Dentons’ Evansville office, and Overmyer is a partner in the Indianapolis office.
Please enable JavaScript to view this content.