Real Consent Before Anything Records a Therapy Session

The tools that record sessions are no longer exotic: AI scribes that draft the note from audio, teletherapy platforms with a record button, a phone propped on a tripod to capture a home program demonstration. What has not kept up, in many practices, is the consent underneath. A checkbox added to the intake packet in a hurry — "I consent to recording for documentation purposes" — is doing a job three different bodies of rules actually define, and it usually satisfies none of them well. This article separates those rules so you can see what your consent process has to do, then gives you the working pieces: the conversation to have, form language to adapt, the plan for minors and the other voices in the room, and the revocation workflow that makes a no as easy to honor as a yes.

Start by untangling what "consent to record" actually has to cover, because three distinct frameworks each have a claim on it. The first is state recording law — the wiretap and eavesdropping statutes that govern whether a conversation may be recorded at all. The second is HIPAA, which does not decide whether you may press record but governs everything about the recording once it exists, because a recording of a therapy session is protected health information. The third is professional ethics: ASHA, AOTA, and APTA each expect informed consent as part of respecting the client, whatever the statutory minimum happens to be. A consent process that only thinks about one of the three — usually HIPAA, because that is the compliance vocabulary practices already have — leaves the other two unexamined.

The recording-law layer is the one with the sharpest edges. The federal Wiretap Act, at 18 U.S.C. § 2511(2)(d), makes it lawful for a private person to record a conversation they are a party to — so under federal law, your own consent as the clinician in the room is enough. But that is a floor, not the rule you practice under. States are free to require more, and a number of them require the consent of every party to the conversation before it may be recorded. Which category your state falls into, and how it treats a call that crosses state lines, is a question to answer from your state statute or qualified counsel — not from a vendor’s onboarding guide, and not from a chart on the internet, because these laws get amended and litigated. For telehealth, the careful practice verifies both sides: the state where the clinician sits and the state where the patient sits.

HIPAA’s role is narrower than most consent checkboxes imply. It does not authorize or prohibit the act of recording; that is the state-law question above. What it governs is the recording as data. A session recording made by the practice is protected health information the moment it exists: it must be safeguarded like the rest of the record, a vendor that receives it to produce transcripts or draft notes is a business associate who needs a signed agreement before real audio flows, and any use or disclosure outside treatment, payment, and health care operations needs the patient’s written HIPAA authorization. If a vendor wants to use recordings to improve its models, or you want to use a session clip for teaching, you are in authorization territory — that is a separate, specific document, not a line in the intake packet. The vendor side of this — the business associate agreement, training-data clauses, retention — is its own due-diligence exercise, and we cover it in the AI scribe HIPAA checklist article.

Even where HIPAA does not require an authorization, its authorization rules are worth borrowing as a design pattern, because they describe what informed permission looks like: a specific description of what is being used, who may receive it, a purpose, an expiration, and a statement of the right to revoke. The revocation rule at 45 CFR 164.508(b)(5) is the piece most consent forms forget — an individual may revoke a HIPAA authorization at any time in writing, except to the extent the practice has already acted in reliance on it. Build your recording consent the same way: revocable at any time, effective going forward, with the honest caveat that it does not reach back and un-process the sessions already recorded. Saying that plainly up front is what makes the revocation right real instead of decorative.

The professional associations have all reached the same position from slightly different directions: informed consent is owed because of what the client is entitled to understand, not because a statute forces it. ASHA’s guidance on generative AI tells clinicians to inform clients when AI tools are used in sessions, to obtain and document consent — with signed permission on file where state or local law, payers, or the facility require it — and it flags squarely that whether families must be informed can depend on state law. It also gives practical advice for the employed clinician: if your employer mandates the tool, direct your consent questions to the employer or to an attorney who knows local health-care privacy law, rather than improvising. AOTA’s Code of Ethics grounds the same obligation in the principle of autonomy — the client’s right to make choices about their own care — and its communication standards name informed consent explicitly, across written, verbal, electronic, and virtual channels. APTA’s Code of Ethics requires physical therapists to give patients or their surrogates the information necessary to make informed decisions about their care; a recording that feeds a documentation pipeline is part of how care is delivered, and it belongs in that conversation.

Notice what the ethics layer adds that the legal layers do not: a quality bar for the explanation itself. A signature obtained from a form the family skimmed in a waiting room meets the paperwork standard and fails the informed one. The test worth holding yourself to is whether the patient or parent could, a week later, tell someone else what is being recorded and what happens to it. That is a two-minute conversation, and it is the part of this process that builds trust rather than merely documenting it.

Have the conversation before the form appears, at evaluation or whenever the tool is introduced, and keep it to five plain answers: what is captured (audio of the session, including anyone who speaks), what it produces (a transcript and a draft note that the clinician reviews and signs), who handles it (your documentation vendor, under a signed agreement, listed by name), how long it exists (the retention period you actually confirmed with the vendor — say the number), and what saying no means (nothing about access to therapy changes; the clinician writes notes the ordinary way). Every one of those answers should be true in the specific, checkable sense — if you cannot say the retention number, that is a vendor question to resolve before the consent process launches, not a blank to paper over. Then the form below records what was explained.

For most pediatric caseloads, the consenting party is the parent or legal guardian. HIPAA’s personal-representative rule at 45 CFR 164.502(g) generally requires practices to treat a parent, guardian, or person acting in loco parentis as the decision-maker for an unemancipated minor — but the rule defers to state law at the edges, and the exceptions matter: where a minor may lawfully consent to a health care service themselves and no other consent is required, the parent is not automatically the personal representative for that service. Those boundaries are drawn state by state, so a practice serving adolescents should know its own state’s answer rather than assume. Custody adds a second wrinkle worth handling in the workflow rather than in the moment: when parents are separated, know which parent holds health care decision authority, and get the consent from the right one.

Two further habits keep the pediatric version of this honest. First, assent: a teenager is not the legal decision-maker, but recording a session over a fourteen-year-old’s objection is a clinical decision as much as a legal one, and telling the teen what the recorder does — in one sentence, at their level — costs nothing and models the respect the ethics codes are pointing at. Second, the roster of voices: pediatric sessions are porous. A grandparent brings the child one week; an interpreter joins the next; a sibling narrates from under the table. The all-party assumption from earlier does the legal work, but operationally it means the clinician needs a habit — a glance at who is in the room, against who has signed — before recording starts, and a one-tap way to skip recording for a session where the answer is "someone new."

A revocation right that exists only on the form is decorative. The test of a real one is mechanical: when a parent says "actually, please stop recording," how many humans and systems have to act, and what happens if any of them forget? Walk the path once before launch and make each step someone’s explicit job.

1. 01

   Capture the no, in writing, wherever it lands

   A revocation arrives as a hallway comment, a portal message, or an email. Whoever receives it converts it to writing the same day — forwarding the message or noting the verbal request with date and name — because your form promised that writing is the trigger, and because the date fixes which sessions are covered going forward.

2. 02

   Flag the chart and the schedule, not just the file

   The consent status has to be visible where the decision is made: on the appointment, before the session starts. A flag buried in a scanned PDF protects nobody at 9:00 a.m. on a Tuesday. Whatever your EHR offers — an appointment banner, a chart alert, a recording toggle per client — the standard is that the clinician cannot start a recorded session without passing the flag.

3. 03

   Tell the vendor side of the pipeline

   If the tool auto-starts recording for scheduled sessions, revocation means turning that off for this client, and confirming the change took effect rather than assuming it. This is also the moment to exercise what you learned in vendor due diligence: whether you can request deletion of existing audio, and what deletion actually removes.

4. 04

   Confirm back to the family, and note what it does not undo

   Close the loop with one message: recording stops as of this date, therapy is unaffected, and — matching the form’s honesty — notes already produced from earlier recordings remain part of the record. A confirmation message is also your documentation that the revocation was honored promptly.

5. 05

   Re-consent deliberately, if ever

   If the family later wants the tool back on, that is a new consent conversation and a new signature, not a quiet toggle. Treating re-consent with the same weight as consent is what makes the no feel safe to say — which, in the long run, is what makes the yes trustworthy.