Posted on
Feb 28, 2026
Is AI Scribing Legal in Connecticut? (2026 Compliance Guide for Healthcare Providers)
Quick Answer
Yes, AI scribing is legal in Connecticut when implemented with proper consent and HIPAA-compliant safeguards. Connecticut is a one-party consent state for recording communications under Connecticut General Statutes § 52-570d, which means that only one party to a conversation needs to consent to its recording. However, for psychotherapists, ethical obligations, HIPAA regulations, and the heightened sensitivity of psychotherapy notes create additional compliance layers that go well beyond the baseline of state wiretapping law.
Practice in Connecticut? Scribing.io is fully compliant with Connecticut recording laws. Try it free.
Recording Consent Laws in Connecticut
Connecticut's wiretapping and electronic surveillance laws are primarily governed by two statutes:
Connecticut General Statutes § 53a-187 through § 53a-189 — These are the criminal statutes that address eavesdropping and illegal interception of communications. Under § 53a-189, it is a class D felony to unlawfully intercept wire, electronic, or oral communications. However, the statute provides an exception when one party to the communication consents to the interception.
Connecticut General Statutes § 52-570d — This is the civil statute that provides a private right of action for individuals whose communications are intercepted without the consent of at least one party. This statute confirms Connecticut's one-party consent framework on the civil side.
Under these statutes, if you — the psychotherapist — are a party to the conversation and you consent to the AI scribing tool processing the audio, you have satisfied Connecticut's minimum legal threshold for lawful recording or interception. The patient does not need to separately consent under state wiretapping law alone.
Important caveat: While state wiretapping law sets the floor, it does not set the ceiling. Psychotherapists are bound by additional federal regulations (HIPAA), professional ethical codes, and licensing board standards that effectively require informed patient consent regardless of what wiretapping law permits.
One-Party vs Two-Party Consent: What It Means for Your Practice
In a one-party consent state like Connecticut, only one participant in a conversation must agree to the recording or electronic processing of that conversation. This contrasts with two-party (or all-party) consent states — such as California or Florida — where every participant must consent.
What This Means Practically for Psychotherapists
As the clinician, you are a party to the therapeutic conversation. Your decision to use an AI scribing tool constitutes your consent to the processing of the session audio. Under Connecticut law, this satisfies the wiretapping statute.
However, relying solely on one-party consent is strongly inadvisable for psychotherapists for several reasons:
HIPAA requires transparency. The use of AI scribing tools involves the creation, processing, and potentially the transmission of protected health information (PHI). Patients have a right to know how their PHI is being handled.
Psychotherapy notes receive special HIPAA protection. Under 45 CFR § 164.508(a)(2), the use or disclosure of psychotherapy notes generally requires specific patient authorization — a higher standard than general consent.
Professional ethics demand informed consent. The American Psychological Association (APA) Ethical Principles of Psychologists and Code of Conduct (Standard 4.02 — Discussing the Limits of Confidentiality, and Standard 10.01 — Informed Consent to Therapy) require that clinicians inform patients about the nature of the therapeutic process, including how records are created and maintained. Similarly, the National Association of Social Workers (NASW) Code of Ethics § 1.03 requires informed consent regarding the nature of services and any relevant technology use.
Connecticut licensing boards may view failure to disclose AI documentation tools as a breach of professional standards, even if state wiretapping law is technically satisfied.
In practice, you should always obtain explicit, informed patient consent before using any AI scribing tool in a psychotherapy session.
HIPAA Requirements on Top of State Law
HIPAA compliance is mandatory for all covered entities and their business associates. When a psychotherapist uses an AI scribing tool, the following federal requirements apply in addition to Connecticut state law:
Business Associate Agreement (BAA)
Under 45 CFR § 164.502(e) and 45 CFR § 164.504(e), any vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate. Your AI scribing vendor must sign a BAA before you process any patient data through their platform. A BAA that does not exist — or exists but is inadequate — exposes you to significant HIPAA liability.
Psychotherapy Notes — A Higher Standard
Under 45 CFR § 164.501, psychotherapy notes are defined as notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a counseling session, maintained separately from the medical record. These notes receive heightened protection under HIPAA:
45 CFR § 164.508(a)(2) requires a specific, written authorization from the patient before psychotherapy notes can be used or disclosed, with limited exceptions (e.g., for the provider's own treatment purposes, certain law enforcement situations, or to avert a serious threat).
This authorization requirement is separate from and in addition to general consent for treatment, payment, and healthcare operations.
If your AI scribing tool is processing session audio that contains psychotherapy note content, you must ensure that your consent and authorization framework specifically addresses this category of PHI.
Minimum Necessary Standard
Under 45 CFR § 164.502(b), covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose. Configure your AI scribing tool to capture and retain only the information necessary for clinical documentation. Avoid storing raw audio longer than necessary for transcription processing.
Security Rule Compliance
Under 45 CFR §§ 164.302–164.318 (the HIPAA Security Rule), you must ensure that your AI scribing vendor implements appropriate administrative, physical, and technical safeguards for electronic PHI (ePHI). This includes encryption in transit and at rest, access controls, audit logging, and workforce training.
Patient Consent Best Practices for Connecticut
Given Connecticut's one-party consent framework and the layered requirements of HIPAA and professional ethics, the following best practices are recommended for psychotherapists:
Create a dedicated AI scribing consent form. This form should be separate from your general consent for treatment. It should clearly describe:
What the AI scribing tool does (records and/or processes session audio to generate clinical notes)
Whether audio is stored, and if so, for how long and where
Who the vendor is and that a BAA is in place
How the generated notes will be used and stored
The patient's right to decline AI scribing without any impact on their treatment
Obtain written, signed authorization specifically addressing psychotherapy notes if the AI tool will process content that falls within the HIPAA definition of psychotherapy notes under 45 CFR § 164.501.
Document consent in the medical record. Note that the patient was informed about the AI scribing tool, understood its function, and provided consent. If a patient declines, document that as well and have a manual documentation workflow available.
Verbally confirm at each session. Especially for new implementations, briefly confirm at the start of each session that the patient is aware the AI tool is active. This reinforces transparency and trust.
Provide an opt-out mechanism. Patients should be able to revoke consent at any time. Ensure your workflow can accommodate sessions without AI scribing.
Review your consent annually. Laws, vendor terms, and technology capabilities change. Update your consent documents at least once per year.
What Happens if You Don't Comply?
Non-compliance with recording consent and HIPAA requirements can result in serious consequences:
Under Connecticut Law
Criminal liability: Unlawful interception of communications under Conn. Gen. Stat. § 53a-189 is a class D felony, punishable by up to five years in prison, a fine of up to $5,000, or both.
Civil liability: Under Conn. Gen. Stat. § 52-570d, a person whose communications are unlawfully intercepted may bring a civil action for damages, including punitive damages and attorney's fees.
Under HIPAA
Civil monetary penalties: The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) can impose penalties ranging from $141 to $2,134,831 per violation (as adjusted for inflation), depending on the level of culpability, under 42 USC § 1320d-5 and 45 CFR § 160.404.
Criminal penalties: Under 42 USC § 1320d-6, knowing violations of HIPAA can result in fines up to $250,000 and imprisonment up to 10 years.
Professional Licensing Consequences
The Connecticut Department of Public Health oversees the licensing of psychologists, licensed clinical social workers, licensed professional counselors, and marriage and family therapists. Complaints related to failure to obtain informed consent, improper handling of confidential information, or unprofessional conduct can result in license suspension, revocation, probation, or other disciplinary action.
Malpractice and Reputational Risk
Failure to properly inform patients about AI documentation tools could be raised in malpractice litigation as evidence of a breach of the standard of care, particularly if a patient alleges harm resulting from the undisclosed recording or processing of their therapy sessions.
Implementation Checklist
Use this checklist before deploying any AI scribing tool in your Connecticut psychotherapy practice:
Step | Action | Status |
|---|---|---|
1 | Confirm your AI scribing vendor will sign a HIPAA-compliant Business Associate Agreement (BAA) | ☐ |
2 | Verify the vendor uses encryption in transit and at rest for all ePHI | ☐ |
3 | Review the vendor's data retention and deletion policies | ☐ |
4 | Create a dedicated patient consent form for AI scribing, separate from general treatment consent | ☐ |
5 | If applicable, create a separate HIPAA authorization form for psychotherapy notes processed by AI | ☐ |
6 | Establish a clear opt-out process for patients who decline AI scribing | ☐ |
7 | Prepare an alternative manual documentation workflow for opted-out patients | ☐ |
8 | Train all staff members on proper AI scribing consent procedures | ☐ |
9 | Document consent (or refusal) in each patient's medical record | ☐ |
10 | Schedule annual review of consent forms, vendor agreements, and compliance procedures | ☐ |
This guide is for informational purposes only and does not constitute legal advice. Psychotherapists should consult with a qualified healthcare attorney licensed in Connecticut to address their specific practice circumstances. Laws and regulations are subject to change; verify all cited statutes for current applicability as of 2026.
