Ambient recording consent index

Evidence & sources

Federal privacy and professional-guidance references. Jurisdiction-level classifications derive from each state's own publicly published statutes as of the compile date.

1. [1]HIPAA Privacy Rule, 45 CFR Parts 160 and 164

   U.S. Department of Health & Human Services · Regulation · Tier A — primary documentation

   Supports: What a covered entity and its business associates may do with PHI, and why a signed BAA is a precondition rather than a feature.

2. [2]HIPAA Security Rule

   U.S. Department of Health & Human Services · Regulation · Tier A — primary documentation

   Supports: Administrative, physical and technical safeguards a vendor handling recorded encounter audio must implement.

3. [3]AMA policy on augmented intelligence in medicine

   American Medical Association · Research · Tier B — published methodology

   Supports: Professional expectations for oversight and transparency of AI-generated clinical content.

4. [4]CMS documentation and signature requirements (Medicare Program Integrity Manual)

   Centers for Medicare & Medicaid Services · Regulation · Tier A — primary documentation

   Supports: Authentication and attestation requirements that make clinician review of an AI-generated note non-optional.

Source tiers are defined on the methodology page. Outbound links are unaffiliated and carry no commercial relationship.

Frequently asked questions

Do I need patient consent to record a clinical encounter?

Practically, yes. 10 US jurisdictions require all-party consent to record a private conversation and 5 more are contested enough to treat identically, so a defensible ambient product captures consent everywhere and records that it did.

What is the difference between one-party and all-party consent?

One-party consent requires only one participant — typically the clinician — to consent to the recording. All-party consent requires every participant, including the patient and anyone else in the room or on the call.

Which rule applies to a telehealth visit across state lines?

Potentially both. When participants are in different jurisdictions, the conservative and common approach is to apply the stricter rule, which in practice means capturing all-party consent for every recorded telehealth encounter.

Is a consent checkbox enough?

A checkbox with no audit record is weak evidence. Capture who consented, when, in what jurisdiction, and under which disclosure wording, and retain that record for as long as the audio or note exists. Compliance checklist.