Can You Record Telehealth Visits? Consent, HIPAA Rules, and Software

Introduction

A patient finishes a video visit, closes her laptop, and realizes she can’t remember whether the new dose starts tomorrow or next week. A recording would have answered that in thirty seconds. That’s the simplest case for recording telehealth visits.

Recording itself is usually easy. Many telehealth platforms offer it as a setting you can switch on. What happens to the file afterward is the hard part: where it’s stored, who can open it, how long it’s kept, and whether everyone on the call agreed to it in the first place.

Those questions matter more now that recordings feed AI transcription and visit summaries. What was once an occasional training aid is becoming a routine part of the clinical workflow.

This guide answers the question patients ask first, then covers why providers record, what consent rules apply, what HIPAA requires, how long to keep recordings, and what to look for in recording software.

Are Telehealth Visits Recorded?

Only if the provider chooses to record it. Whether a telehealth or telemedicine visit is recorded is the practice’s decision; it doesn’t happen just because the visit is on video. When a practice does record, it should tell you beforehand, explain why, and ask for your agreement. In some states, it is legally required to.

If you’re not sure, ask at the start of the visit. You’re entitled to know whether the session is being recorded, why, and who will be able to see it. If the recording is used to make decisions about your care, HIPAA also gives you the right to request a copy.

Why Record Telehealth Sessions?

Recording earns its place when it serves a specific purpose. These are the ones that come up most often.

Patient recall. Anxious patients miss details, and the details that slip are usually the ones that matter: a dose change, a warning sign to watch for, when to book the next test. A recording or summary lets them check at home instead of guessing or calling the clinic.

Family and caregiver support. An adult son manages his father’s medications but couldn’t join the afternoon call. With his father’s permission, he can watch the part where the new plan was agreed, rather than relying on a secondhand account.

Continuity of care. A physical therapist reviewing last month’s session can see how a patient’s range of motion has changed, not just read a note that says “improving.” The same applies in therapy and chronic care, where progress shows over weeks rather than in a single visit.

Documentation. A recording or transcript can support clinical notes and, increasingly, feeds AI-generated visit summaries that the clinician reviews and signs.

Training and quality assurance. Supervisors can review sessions for coaching, peer review and quality improvement, after checking whether that use needs any additional permission.

Dispute resolution. When a patient and provider later remember a conversation differently, a record of what was actually said can settle it quickly.

The purpose shapes everything that follows. A recording kept for patient recall can sit in the patient portal. One used for training may need extra consent and de-identification. One used to make clinical decisions becomes part of the medical record.

Consent: Who Has to Agree to a Recording?

HIPAA itself doesn’t require patient consent to record a session. Consent comes from state recording laws and, for some professions, ethics codes.

What do state recording laws require?

Federal law and most states follow one-party consent: one person on the call can agree to the recording. About a dozen states require all-party consent, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, according to the Reporters Committee for Freedom of the Press. Telehealth often crosses state lines, so when the provider and patient are in different states, the safest approach is to follow the stricter law.

Can you record a therapy session?

Yes, but professional codes set a higher bar than state law. The APA Ethics Code (Standard 4.03) requires psychologists to get permission from the people they serve before recording their voices or images. Therapy recordings are also more sensitive in practice, so many practices offering telehealth for mental health don’t record sessions by default.

Can patients record their own doctor appointments?

The same state laws apply in reverse. In a one-party consent state, a patient can usually record their own visit without asking. Many practices set a policy on this and talk about it openly, rather than discovering a recording later.

What about calls with several participants?

Every extra person is someone else whose consent counts. In telehealth video calls with multiple participants, such as a caregiver, an interpreter or a consulting specialist, ask everyone on the call, not just the patient.

Our recommended practice

Get explicit consent from everyone on every recorded call, whatever the state:

1. Tell the patient before the session that it will be recorded, why, and who will have access.
2. Get and log everyone’s consent before the recording starts. Once it’s running, you can reconfirm it on camera.
3. Give a real choice. Recording should be optional unless it’s essential to the service.
4. Before using a recording for training or research, check whether that use needs additional permission. HIPAA allows some internal training and quality improvement without a separate authorization, but research has its own rules.

What HIPAA Requires of Telehealth Recordings

A recording of a patient consultation is protected health information (PHI). Once it’s stored, it falls under the HIPAA Security Rule, just like the live call. (For the live-call side, see our guide to HIPAA-compliant video conferencing.)

The Security Rule’s five technical safeguard standards (45 CFR 164.312) translate into practical controls for recordings, such as these:

Encryption, both at rest and in transit, is an “addressable” specification. Addressable doesn’t mean optional: you must assess it, then either implement it or document why an equivalent alternative is reasonable. In practice, encryption is the expected standard for any recording stored in the cloud.

Business associate agreements. Any vendor that stores or processes recordings on your behalf is a business associate and must sign a business associate agreement (BAA). HHS’s cloud computing guidance is clear that this applies even when the cloud provider holds only encrypted files and can’t decrypt them. The same goes for transcription and AI summary services.

Patient access. A recording used to make decisions about a patient’s care can fall within the designated record set, which HIPAA defines to include records “used, in whole or in part, by or for the covered entity to make decisions about individuals” (45 CFR 164.501). Patients then have a right to access it, so you need a way to find and export a specific recording on request.

Storage, Retention, and Deletion

HIPAA doesn’t set a retention period for medical records. According to HHS, state law decides how long records must be kept. HIPAA does require you to protect them for as long as you hold them, including when you dispose of them.

That leaves each practice to answer three questions:

1. Is the recording part of the medical record? If clinicians rely on it, it likely follows your state’s medical-record retention period. If it’s only a source for a written note, many practices keep the note and delete the recording after a short, defined period.
2. Where is it stored? Keep recordings in a HIPAA-eligible environment covered by a BAA, not on unmanaged devices such as personal phones or unencrypted laptops, or in unapproved cloud services. A BAA and encryption are necessary but not enough on their own: access controls, staff policies and the other safeguards above apply too.
3. How is it deleted? Set automatic deletion based on your retention policy, and make sure deleted recordings are removed from backups on a known schedule. Before deleting, confirm that no legal hold or pending records request applies.

A written retention policy that names recordings explicitly is the single most useful step. Without one, recordings pile up indefinitely, and every stored file adds to your breach risk.

Compliance Questions for AI Transcription and Visit Summaries

Many telehealth platforms now use AI to turn recordings into transcripts and draft clinical notes, which has made recording far more routine. (Our guide to AI telehealth in 2026 covers which of these AI capabilities are production-ready.) AI also adds four compliance questions:

• Does the AI vendor sign a BAA? The audio and the transcript are both PHI. If a third-party model processes them, that provider must be covered.
• Is patient data used to train models? Check the contract. Prefer vendors that contractually prohibit using identifiable patient data to train their models. Any other reuse of the data needs its own legal review.
• Do you keep the audio or only the transcript? Some practices delete the recording once the note is approved. Writing in the AMA Journal of Ethics, Gerke and Simon note this reduces risk but warn that transcripts should be validated first, because errors become harder to catch once the audio is gone. Deletion also has to fit your retention policy, with no legal hold or pending records request in the way.
• Is the patient told? The same authors argue that the ethical duty to disclose AI documentation tools is likely broader than the legal one. Tell patients plainly that AI is used, and don’t present consent as the default.

Whatever the tool, a clinician should review and sign AI-generated notes before they enter the medical record.

What to Look For in Video Recording Software for Healthcare

General-purpose meeting tools can record, but recording settings, storage, and BAA coverage vary by plan. Use this checklist when you compare recording platforms for healthcare:

• Phone and video recording under the same safeguards, if you offer audio-only visits. An audio recording of a consultation is PHI too.
• A signed BAA that explicitly covers recording storage, transcription, and any AI features
• Encryption of recordings in transit and at rest
• Role-based access, so only the treating clinician and authorized staff can view recordings
• Audit logs for every view, download, share, and deletion
• Consent capture, such as an in-call prompt or a logged consent record
• Configurable retention, with automatic deletion by policy
• Patient access and export, so you can respond to records requests
• EHR integration, so recordings or approved notes attach to the right patient record
• Data location options, if you need storage in a specific country or region

If you’re still choosing a platform, our comparison of the best telemedicine software covers the wider feature set beyond recording.

Conclusion

Recording telehealth sessions can help patients remember their care, keep caregivers in the loop, and give clinicians a clearer view of progress. It only pays off when the recording is handled like the rest of the patient record. Get explicit consent from everyone on the call, store recordings in a BAA-covered environment, set a retention policy, and make sure every AI tool that touches the audio is covered too.

Q-Consultation for Healthcare records consultations, generates AI transcripts and summaries, and runs on HIPAA-compliant hosting with a signed BAA. Recordings can also be written directly to the patient’s EHR record, as one Florida provider does with its Q-Consultation deployment. Contact our team to see how recording would work in your workflow.