Compliance & Telehealth
Recording Client Sessions Legally: Consent Rules Dietitians Need to Know
One-party vs. all-party consent states, telehealth wrinkles, HIPAA rules for session recordings, and a consent workflow dietitians can use with AI charting.
AI charting has changed the math on recording sessions. A tool that listens to your session and drafts the note can hand you back several hours a week — for many RDs it's the single biggest time win in AI charting for dietitians. But the moment you hit record, you've stepped into two bodies of law at once: state recording statutes and HIPAA.
The good news: the compliant version costs you one intake-form clause and one sentence at the start of each session. The risk lives entirely in skipping that sentence — recording statutes carry civil and, in some states, criminal penalties, and "I didn't know my patient was in Florida" is not a defense.
Here's the legal landscape, the telehealth wrinkle, and a consent workflow you can implement today.
The two consent regimes
US recording law splits by state into two models:
| Regime | Rule | Practical meaning |
|---|---|---|
| One-party consent | Recording is lawful if one participant consents | You, as a participant, can consent for yourself |
| All-party consent | Every participant must consent | Your patient must agree before you record |
The majority of states are one-party. The commonly cited all-party (two-party) states are:
- California
- Florida
- Illinois
- Maryland
- Massachusetts
- Montana
- New Hampshire
- Pennsylvania
- Washington
Two caveats, both important. First, laws change — statutes get amended, courts reinterpret "consent" and "expectation of privacy," and some states have hybrid rules that don't fit cleanly in either column. Treat any list, including this one, as a snapshot to verify, not settled truth. Second, and more decisive for your workflow: telehealth crosses state lines, which brings us to the wrinkle that makes the state-by-state question mostly moot.
Telehealth: the patient's state matters
When you're in Texas and your patient joins from Miami, which law applies? The uncomfortable answer is: possibly both, and you should assume the stricter one governs. Recording statutes are generally written around where the parties are located, and a Florida patient doesn't lose Florida's protection because her dietitian sits in a one-party state.
This is the same logic that governs your license — in telehealth, the patient's location at the time of service drives the rules, which is why multi-state caseloads also raise licensure questions across state lines. If you're tracking patient location per session for licensure anyway (you should be), you already have the data point that matters for recording law too.
Which leads to the only rule that scales:
Get everyone's consent, always, in every state. Universal consent satisfies one-party states, all-party states, hybrid states, and whatever a legislature amends next year. It costs nothing, removes the map from your workflow, and — not incidentally — it's also the ethically right standard for a clinical relationship.
The HIPAA layer on top
State law decides whether you may record. HIPAA governs what happens to the recording afterward, because a recording of an identifiable patient discussing their health is PHI:
- BAA required with every tool that touches the audio — the recording app, the AI scribe processing it, the cloud storage holding it. A scribe without a BAA is off the table regardless of how good its notes are.
- Storage follows the same rules as any clinical record: encrypted, access controlled, not sitting in a personal downloads folder.
- Retention and deletion: decide upfront whether recordings are transient processing artifacts (deleted once the note is finalized — the cleaner default) or part of the record (then your state's retention rules apply). Write the policy down; it belongs in the compliance folder from your solo-practice HIPAA checklist.
- Access requests: if you retain recordings, patients can request copies like any other record.
The practical consent workflow
Three layers, each cheap, together audit-proof:
- Intake form clause. A recording-consent section in your intake paperwork, signed once, explaining what's recorded, why, what tool processes it, and that consent is revocable. This is your durable documentation.
- Verbal confirmation each session. One sentence before you hit record: "Quick reminder — I record our sessions so software can draft my notes; is that still okay today?" Thirty seconds, and it catches the patient who signed the form without reading it, the new household member on camera, and the revoked consent. In all-party states, a "yes" captured at the top of the recording itself is the strongest evidence you can have.
- Note it in the chart. One line in each session note: consent confirmed verbally, recording made (or declined).
Template consent language
A starting point for your intake form — adapt it to your practice and have your attorney review it; this is not legal advice:
Session Recording Consent
To support accurate clinical documentation, [Practice Name] records
counseling sessions (audio and/or video). Recordings are processed by
HIPAA-compliant software under a business associate agreement to
generate my session notes, are stored securely, and are [deleted once
the note is finalized / retained as part of your clinical record for
X years].
Recordings are never used for marketing or shared outside your care
without separate written authorization.
Consent is voluntary and not a condition of receiving care. You may
decline or withdraw consent at any time, for any session, by telling
me — your care will not be affected.
[ ] I consent to the recording of my sessions as described above.
Signature: ____________________ Date: __________
When a client says no
Some will, and the answer is simply: don't record. Document the refusal in the chart, chart that session manually or by dictation immediately afterward, and never frame recording as a requirement for care — conditioning treatment on recording consent is both an ethical problem and, in some states, a legal one. A refusal today also isn't permanent; clients who see that you handle the question respectfully often opt in later.
The pattern worth internalizing: recording is an efficiency tool layered on top of consent, not the other way around. Get the consent architecture right once, and the time savings run on autopilot.
How Alva helps: Alva's AI charting is built consent-first — recording happens only with documented client consent, audio is processed under a BAA on HIPAA-compliant infrastructure, and your note is drafted before you've finished your post-session coffee. Charting, codes, and claims in one platform for $99/month. Start a 7-day free trial.
Frequently asked questions
Do I need my client's consent to record a nutrition counseling session?
Legally it depends on the state: one-party consent states allow recording if one participant (you) consents, while all-party states require everyone's consent. But because telehealth crosses state lines and laws change, the professional standard is simpler — always get every participant's documented consent before recording, in every state.
Which states require all-party consent for recording?
Commonly cited all-party (two-party) consent states include California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington. Statutes are amended and interpreted by courts over time, so treat any list as a starting point and verify current law — or sidestep the question by always obtaining everyone's consent.
Whose state law applies when I record a telehealth session?
Potentially both yours and the patient's, and the safe assumption is that the stricter law governs. If you're in a one-party state but your patient joins from an all-party state like Florida or California, get their explicit consent. Universal consent is the only rule that scales across a multi-state caseload.
Are session recordings protected health information under HIPAA?
Yes. A recording of an identifiable patient discussing their health is PHI. It must be stored on a platform that will sign a business associate agreement, protected like any clinical record, and covered by your retention and access policies. Any AI scribe processing the audio needs a BAA too.
What if a client refuses to be recorded?
Proceed without recording and document the refusal. Recording should never be a condition of care. Chart manually or from memory immediately after the session, and note in the record that the client declined recording. Many AI charting tools also work from a typed or dictated summary instead of audio.