1. Two separate bodies of law apply, and only one is HIPAA
Clinics tend to ask “is the scribe HIPAA compliant?” and stop there. That question matters and it is not the one that governs recording.
| The law | What it governs | What satisfies it |
|---|---|---|
| HIPAA | How the vendor may handle the protected health information | A signed BAA, plus the vendor actually doing what it says |
| State recording law | Whether you may record the conversation at all | Consent, in the form your state requires |
A vendor can be impeccable on the first and leave the second entirely to you — and most do, correctly, because it is your conversation with your patient. The BAA is not consent to record. They answer different questions, and having one does nothing about the other.
2. One-party and all-party states
States fall into two groups, and which group you are in decides whether the patient has to agree before you may record.
| Category | What it means | What it means for a scribe |
|---|---|---|
| One-party consent | One person in the conversation consenting is enough, and you are a party to it | Recording is lawful on your consent alone — but see below on why you should still ask |
| All-party consent | Every person in the conversation must consent | The patient must agree before the recording starts, not after |
We are deliberately not publishing a state-by-state table. These classifications move with legislation, some states have exceptions that swallow the rule, and a stale row in a table about recording patients is the kind of error that reaches a real person. Your state bar, your malpractice carrier and your own counsel will all tell you which category you are in, and that answer takes one call.
Two complications worth knowing before you make it. Telehealth can put you and the patient in different states, and the stricter rule generally governs. And a patient who moves, or who takes the call from somewhere else that day, can change the answer for that visit.
3. Ask anyway, even where the law does not require it
In a one-party state you may be entitled to record without asking. Doing it is still a bad idea, for reasons that have nothing to do with legality.
A patient who finds out afterwards that their hormone consultation, their weight conversation or their mental-health history was recorded by software they were never told about does not experience that as a compliance question. They experience it as a breach of trust, and the clinic finds out through a review, a complaint or a departure rather than a lawsuit.
There is also a practical argument: one consent policy is easier to run than two. A clinic operating in several states, or doing telehealth at all, will eventually have a visit that crosses a line. Asking everyone, every time, removes the need for anyone at the front desk to know which rule applies today.
4. What the consent actually has to say
A generic “we may record for quality purposes” line is not consent to put a medical conversation through an AI system. These are the elements worth having, and most of them are one sentence each.
| Element | Why it matters |
|---|---|
| That the visit is recorded | The basic fact, stated plainly rather than buried |
| That software processes the recording to draft a note | Patients reasonably distinguish “recorded” from “processed by AI” |
| That a clinician reviews and signs the note | Addresses the fear that a machine is writing the record |
| How long the recording and transcript are kept | The question patients ask second, after “who hears it?” |
| That they may decline, and care continues | Consent that cannot be refused is not consent |
| How to withdraw it later | And what happens to what already exists |
The fifth row is the one to be most careful about operationally. If declining the recording quietly means a worse visit, a longer wait or a visible sigh from the provider, you have built a consent process that does not work. The scribe has to be genuinely optional at the point of care.
5. The software behaviour that decides whether you are covered
A consent form in a filing cabinet does nothing if the software records regardless. The question to put to any vendor is what happens when consent cannot be confirmed.
| Behaviour | What happens on the day something is missing |
|---|---|
| Fails closed | It does not record. You have no recordings you cannot account for |
| Fails open | It records, and the gap is discovered later, across every visit since |
This is worth saying from experience rather than principle. Our own recording gate originally reused the check that governs booking, which is deliberately permissive — when you cannot tell whether a form is signed, you should still see the patient. Applied to recording, that logic inverts, and four separate situations produced “go ahead and record”: a clinic that had never uploaded a consent template, which is every clinic on day one; a transient database error; a patient who had signed some unrelated form; and an appointment with no patient attached. It was rebuilt in August 2026 to refuse in all four cases, and the booking gate was left permissive on purpose.
The asymmetry is the whole point, and it is worth stating to your vendor in these terms: for a visit, “we could not tell” means see the patient. For a recording, “we could not tell” means there is no evidence of permission. A vendor whose product fails open has chosen the convenient default on a question where the convenient default is the wrong one.
6. A checklist you can run this week
Six items, most of them one call or one setting.
| Step | Done when |
|---|---|
| Establish your category | You know whether your state is one-party or all-party, and have it in writing |
| Decide the telehealth rule | You know what happens when the patient is in another state |
| Write the consent | It covers recording, AI processing, review, retention, refusal and withdrawal |
| Put it in the intake pack | New patients sign it before their first recorded visit, not during |
| Back-fill existing patients | Everyone currently being recorded has signed the current version |
| Confirm the gate fails closed | You have tested that a patient without consent is not recorded |
The last one is a two-minute test and almost nobody runs it. Create a test patient with no consent on file, start a visit, and watch what the scribe does. Whatever the vendor told you, that is the answer.
7. Frequently asked questions
Do you need patient consent to use an AI scribe?
In all-party consent states, yes, before recording starts. In one-party states you may be permitted to record without it, but asking anyway is the safer operational policy and avoids a trust problem that compliance rules do not cover.
Does a BAA cover recording consent?
No. A business associate agreement governs how the vendor handles protected health information. Whether you may record the conversation at all is state recording law, and the two are unrelated.
What should an AI scribe consent form include?
That the visit is recorded, that software processes it to draft a note, that a clinician reviews and signs, how long recordings and transcripts are kept, that the patient may decline without affecting their care, and how to withdraw consent later.
What happens if a patient refuses to be recorded?
The visit proceeds without the scribe and the provider documents as they otherwise would. If refusing is made difficult or visibly inconvenient, the consent is not meaningful.
Which state’s law applies in a telehealth visit?
Where the patient is physically located matters, and when the two parties are in different states the stricter rule generally governs. Confirm with counsel, and note that a travelling patient can change the answer for that visit.