A client pulling out a phone and saying "I'm recording this for my own notes" is not covered by the consent they signed at intake. As of August 2025, Illinois became the first state to require a separate, specific consent before AI transcribes a therapy session, with civil penalties of up to $10,000 per violation enforced by the state regulator (Holland & Knight, August 2025). The general "I consent to treatment" form most practices use was written before any of this existed. It does not stretch to cover an AI listening in.
This is happening more, not less. In May 2026, NPR reported on the trust questions piling up as AI note-takers move into mental health work (NPR, May 2026). Most of that coverage is about the clinician's scribe. The newer, stranger version is the client's. Here is how to think about it without panicking and without pretending it's nothing.
The client's recording is the client's — until it touches your record
Start with the boring true thing: a client can record their own session in most of the country, and the recording belongs to them. They can replay it, share it, paste the transcript into ChatGPT, lose it in a Notes app. None of that is your clinical record. Your progress note is still the document you write, sign, and store.
So far, so simple. The complication is that the recording doesn't stay in the client's lane. Once it exists, three things change at once.
First, consent law may apply to you, not just the client. New York is a one-party consent state under N.Y. Penal Law § 250.05, so a New York client can lawfully record a conversation they're part of without your sign-off. New Jersey is also one-party. Connecticut is the outlier that trips people up: it requires all-party consent for electronic recordings, even though it's one-party for in-person conversation (Justia 50-State Survey). For a telehealth session with a Connecticut client, that distinction is not academic. The point isn't to memorize statutes. It's that "the client is recording" can quietly become a question about your compliance depending on where you both sit.
Second, the intake form you have doesn't cover this. A consent-to-treatment form authorizes treatment. It does not say anything about a generative-AI vendor receiving a recording of the session, processing it on servers you've never reviewed, and possibly retaining it. The gap is the whole problem.
Third, a third party is now in the room. Whatever app the client is using has terms of service, a retention policy, and — this is the part that matters — a possible practice of training its models on the audio it ingests.
"Complies with HIPAA" is a marketing claim. The BAA is the real line.
Here's the distinction that does the actual work: a tool does not "comply with HIPAA" the way a bottle is gluten-free. Compliance is a relationship, governed by a contract called a Business Associate Agreement (BAA).
Under HIPAA, any vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity is a business associate — and an AI scribe that records and transcribes a clinical encounter is squarely that (PrivaPlan, 2026). If you, the clinician, use an AI scribe, you need a signed BAA with that vendor before any PHI touches it. No BAA, no lawful use. A vendor that won't sign one is telling you something.
Most consumer AI note-takers don't sign BAAs with individual therapists, and a number of them reserve the right to use ingested audio to train their models (Jane / Front Desk, 2026). That's fine for a sales meeting. It's a problem when the audio is a trauma history.
Now apply that to the client's app. When the client records, they are not your business associate, and HIPAA doesn't reach their personal recording the way it reaches yours — they're allowed to do whatever they want with their own health information. But the clinical content of that session is still leaving the room through a vendor neither of you evaluated. You can't sign a BAA on the client's behalf. What you can do is name what's happening so the client is choosing it with open eyes instead of by default.
The Otter case is why "it just sits there quietly" stopped being reassuring
If you want the concrete version of the risk, look at what's in front of a federal judge right now.
In August 2025, Otter.ai was hit with a class action — now consolidated as In re Otter.AI Privacy Litigation in the Northern District of California — alleging the company recorded private conversations and used them to train its transcription models without the participants' consent (NPR, August 2025). The motion-to-dismiss hearing was set for May 20, 2026, and it is, as one legal outlet put it, the first real test of whether decades-old wiretap statutes reach an AI bot sitting silently in a meeting (National Law Review, 2025). No court has ruled the practice illegal. The case is unresolved.
But you don't need a verdict to take the lesson. The complaint is about a general-purpose business tool, the kind a client is most likely to already have on their phone from work. If that's the tool capturing a therapy session, the same unsettled questions — secret retention, model training, consent that nobody clearly gave — are now wrapped around your client's most private hour.
What to actually do when a client brings their own AI
You don't get to forbid it, and you probably shouldn't want to. A client wanting to remember the session is a good instinct. The job is to make it a chosen, informed thing instead of an ambient default. Practically:
- Name it out loud the first time you see it. "I noticed you're recording — let's talk about that for a second" is a clinical move, not a confrontation. It models the consent conversation you want them having with every app in their life.
- Separate the two documents in your own head and theirs. Your progress note is the clinical record. Their recording is a personal artifact. Tell them plainly: their transcript is theirs, it's not part of their official chart, and it lives wherever their app lives.
- Check the consent question for your state. If you practice across the tri-state, know the split: New York and New Jersey one-party, Connecticut all-party for electronic recordings. For a recorded telehealth session, get clear agreement on the record.
- Update your own consent form. A short, specific clause about AI tools — yours and theirs — is the cheapest insurance there is. Illinois made it mandatory; the rest of the field is heading the same direction, and a separate AI-consent acknowledgment is fast becoming standard practice (Taft Law, 2025).
- Flag the model-training question gently. Most clients have no idea their note-taker might keep the audio. You're not their IT department, but one sentence — "some of these apps train on what they record, so just be choosy" — respects them more than silence.
The throughline: you stay the author. AI drafts, summarizes, transcribes; a licensed human reads it, decides what's true, and signs it. That's the line that doesn't move, whether the AI belongs to you or to the person across from you.
Where a clinician-built tool fits
If you're sorting out your own documentation while this shakes out, the question worth asking any tool is narrow: will the vendor sign a BAA, and will it keep your data out of its training set? VibeCheck is built by a clinician who writes these notes, so it's designed for the part that actually matters here — the AI handles the drafting, the human signs, and the underlying platform is built HIPAA-eligible with an executed BAA rather than sold to you with a "compliant" sticker. (We've written separately about why your real clinical note still lives in a Word doc, and what AI progress notes actually save you.) The client's app is their call. Your tools should clear a higher bar than theirs.
FAQ
If my client records our session with an AI app, is that a HIPAA violation?
Not on the client's side — HIPAA governs how you and your business associates handle protected health information, not what a client does with a recording of their own session. The exposure for you is different: your intake consent likely doesn't cover AI processing, and in all-party-consent states like Connecticut, an electronic recording may require your agreement before it's lawful. Name it in the room and document the consent.
Do I need a separate consent form for AI note-taking?
In Illinois, yes — the Wellness and Oversight for Psychological Resources Act (signed August 2025) requires written consent specifically for AI involvement in a session, with penalties up to $10,000 per violation. Other states haven't mandated it yet, but a distinct AI-consent clause is becoming standard, and it's cheap protection against the gap a general consent form leaves.
What's the difference between a vendor that "complies with HIPAA" and a signed BAA?
"Complies with HIPAA" is a marketing claim with no fixed legal meaning. A Business Associate Agreement is the actual contract that makes a vendor's handling of your clients' data lawful. If an AI scribe vendor processes PHI for you and won't sign a BAA, you can't use it for clinical work — regardless of what its website says.
Whose note is it — mine or the AI's?
Yours. AI tools draft, transcribe, and summarize, but the clinical record is the note a licensed clinician reviews and signs. A client's personal recording is a separate document they own and you don't control; it isn't part of their official chart. The author of the record is always the human who signs it.
---