Two different laws apply, and satisfying one does not satisfy the other
An AI scribe recording a therapy session triggers two independent legal regimes: state recording law, which governs whether you may record a conversation at all, and HIPAA, which governs what happens to the recording afterwards. Practices routinely satisfy one and assume they have covered both.
Ambient documentation is the fastest-moving area in behavioral health technology and the one with the least settled compliance practice. The underlying law is not new — recording statutes long predate AI — but its application to a scribe listening to a therapy session is new enough that many practices have not worked through it.
Regime one: state recording law
Every state regulates recording of private conversations, and they divide broadly into two camps.
One-party consent states permit recording where one party to the conversation consents — which can be the clinician. All-party consent states (often called two-party, though the requirement extends to everyone present) require consent from every participant.
Roughly a dozen states fall in the all-party camp, and several others have mixed or nuanced rules distinguishing in-person from electronic communications, or applying different tests depending on the expectation of privacy. The exact roster changes and the nuances matter, so this is a question to confirm for your specific state rather than to take from any list, including one on this page.
Three complications specific to behavioral health. Telehealth crosses state lines, and which state's law governs a recorded session between a clinician in one state and a client in another is not always obvious. Family and group sessions mean multiple participants, each of whose consent may be required. And a client who consented at intake may not have understood that consent to extend to every future session.
Regime two: HIPAA
Separately, the recording and any transcript are protected health information, and the vendor processing them is a business associate. That means a BAA is required, along with the usual safeguards, breach obligations and subcontractor flow-down.
Being HIPAA-compliant does not make a recording lawful under state recording law, and having recording consent does not satisfy HIPAA. They are orthogonal, and a vendor's "HIPAA compliant" marketing addresses only one of them.
What consent should cover
A consent that does its job is specific rather than general. At minimum:
- What is recorded — audio, video, or transcript only — and whether audio is retained after the note is produced.
- What the recording is used for. Producing documentation, and what else if anything.
- Who has access, including the vendor and any subprocessors.
- How long it is retained, stated concretely rather than as "as long as necessary."
- Whether the data is used to train models. This is the question clients ask most and the one vendors answer least clearly.
- The right to decline, explicitly and without consequence for their care.
- The right to withdraw, including mid-session, and what happens to the partial recording if they do.
- That the clinician remains responsible for the accuracy of the final note.
Consent is per session, not per client
The practice worth adopting regardless of what the minimum requires.
A signature at intake in March is weak evidence of consent in October — circumstances change, clients forget, and a session covering material a client would not have wanted recorded is exactly the session where a stale consent fails them. Confirming at the start of each recorded session, and timestamping that confirmation, is a small operational cost and a large difference in defensibility.
In all-party consent states this is not optional in family or group work, where a participant who was not present at intake has consented to nothing.
Questions to ask a vendor
- Will you sign a BAA, and does it flow down to your subprocessors?
- Is audio retained after the note is generated, and for how long?
- Is our data used to train your models, or any third party's? Get this in the contract, not in an email.
- Where is data stored and processed, and is any of it processed outside the country?
- Which subprocessors touch our data?
- What happens to our data if we leave, and can we get it back in a usable form?
- What is your breach notification process and history?
- Can recording be stopped mid-session, and what happens to the partial capture?
Clinical considerations that are not legal ones
Worth separating out, because they are real and no consent form resolves them.
Recording changes sessions. Some clients will disclose less knowing a device is listening, particularly on the material that matters most — abuse, substance use, intrusive thoughts, anything with legal implications. That effect is not evenly distributed: clients with reason to distrust institutions are more affected, which means the burden falls unevenly across a caseload.
The clinical judgement about whether to use a scribe with a particular client at a particular stage is yours, and it is not the same question as whether you are permitted to. A defensible practice makes declining genuinely easy and revisits it rather than treating intake consent as settled.
The note is still yours
Whatever the scribe produces, the clinician signs it and is responsible for its accuracy. AI documentation systems make errors — mishearing, misattributing, inventing plausible detail that was not said. A note signed without review is a note you have attested to without reading, and neither the vendor nor the model carries that responsibility.
This is also where scribes that cannot read the treatment plan fail structurally rather than occasionally: a fluent note that cites no goal is a documentation gap the clinician has now signed. See the golden thread.
Group and family sessions
The hardest case, and the one most vendors' consent flows do not handle.
In a group of eight, an ambient scribe records eight people. In an all-party consent state every one of them must consent. If one declines, the practical options are not to record, or to structure the session so that person is not captured — which in a group setting is usually not achievable.
There is a further problem specific to groups: the recording contains other members' disclosures, and the resulting note lives in one member's chart. Producing per-participant notes from a shared recording means each note is generated from material that includes other clients' protected information, and the boundary between what may appear in whose chart has to be enforced by the system rather than by the clinician's editing.
Family sessions raise a narrower version: a participant who is not the identified patient has consented to recording, but the record belongs to someone else, and their own words are now in another person's chart.
None of this makes ambient documentation unusable in group or family work. It does mean the consent flow and the note-generation boundaries need to be designed for it explicitly, and a vendor who has not thought about it is telling you something about how much of their product was built for behavioral health.
What to document about consent
Consent that cannot be evidenced is consent you may as well not have obtained. The record should show who consented, when, to what specifically, by what method, and — where relevant — that participants in a multi-person session each consented.
Where a client declines, record that too. A chart showing an explicit decision not to record is far better than one that is simply silent, because silence is ambiguous between "declined" and "nobody asked." And where consent is withdrawn mid-course, the date matters: it determines which sessions were properly recorded and which were not.
Verified 29 July 2026. Federal rules cited here (HIPAA, 42 CFR Part 2, Medicare billing requirements) are supplemented and sometimes exceeded by state law, which varies substantially; professional licensing boards impose further obligations. Regulatory requirements in this area have changed repeatedly and continue to develop. Primary references: HHS HIPAA; 42 CFR Part 2; CMS billing guidance. This page is general reference, not legal advice. Decisions with compliance consequences warrant healthcare counsel licensed in your jurisdiction.