Is AI Scribing Legal in Massachusetts? (2026 Compliance Guide for Healthcare Providers)

Quick Answer

AI scribing is legal in Massachusetts, but only when used in full compliance with the state's strict wiretapping statute and federal HIPAA regulations. Massachusetts is a two-party (all-party) consent state, which means that every party to a conversation — including the patient — must consent before any oral communication can be recorded or intercepted. For psychotherapists, this carries heightened significance due to the sensitive and privileged nature of therapy sessions. When proper informed consent is obtained and the AI scribing platform meets HIPAA technical safeguards, AI-assisted clinical documentation can be used lawfully.

Practice in Massachusetts? Scribing.io is fully compliant with Massachusetts recording laws. Try it free.

Recording Consent Laws in Massachusetts

Massachusetts has one of the most stringent wiretapping statutes in the United States. The governing law is Massachusetts General Laws Chapter 272, Section 99 (M.G.L. c. 272, § 99), often referred to as the Massachusetts Wiretap Act.

Key Provisions of M.G.L. c. 272, § 99

• Criminal offense: Section 99(C)(1) makes it a crime to "willfully commit an interception, attempt to commit an interception, or procure any other person to commit an interception" of any wire or oral communication without the consent of all parties.

• Definition of interception: The statute defines "interception" broadly to include the secret recording or capture of the contents of any oral or wire communication through the use of any device. Under § 99(B)(4), "interception" means "to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication."

• Penalties: Violations carry serious consequences — a conviction can result in imprisonment in state prison for up to five years, or in a jail or house of correction for up to two and a half years, along with fines of up to $10,000 under § 99(C)(1).

• Civil liability: Under § 99(Q), aggrieved persons may also bring civil actions for damages, including actual damages, punitive damages, and attorney's fees.

Because AI scribing tools process audio from clinical sessions to generate documentation, the act of capturing that audio constitutes an "interception" under Massachusetts law. Therefore, explicit, informed consent from all parties must be obtained before any AI scribe is activated during a session.

One-Party vs Two-Party Consent: What It Means for Your Practice

States across the U.S. fall into two broad categories regarding recording consent:

Why This Matters More for Psychotherapists

For psychotherapists in Massachusetts, the two-party consent requirement intersects with additional layers of legal protection for therapy communications:

• Psychotherapist-patient privilege (M.G.L. c. 233, § 20B): Massachusetts law recognizes a statutory psychotherapist-patient privilege that protects communications made between a patient and a psychotherapist in the course of diagnosis or treatment. While this privilege governs the admissibility and disclosure of communications rather than recording per se, it underscores the heightened expectation of privacy that patients bring to therapy.

• Ethical obligations: Psychotherapists licensed in Massachusetts are bound by the ethical codes of their respective licensing boards and professional organizations (such as the American Psychological Association's Ethical Principles or the NASW Code of Ethics), which require informed consent for any recording of sessions and prioritize client autonomy and confidentiality.

• Trust and therapeutic alliance: Beyond legal requirements, the undisclosed use of an AI scribe could fundamentally undermine the therapeutic relationship. Patients must know and agree that their words are being processed by technology.

Bottom line: You cannot secretly activate an AI scribe during a therapy session in Massachusetts. Doing so is a criminal offense under M.G.L. c. 272, § 99, regardless of your intent to use the recording solely for documentation purposes.

HIPAA Requirements on Top of State Law

Compliance with Massachusetts wiretapping law is necessary but not sufficient. As a psychotherapist, you are a HIPAA-covered entity (or operate under one), and any AI scribing tool you use must also satisfy federal privacy and security requirements.

HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E)

• Psychotherapy notes receive special protection: Under 45 C.F.R. § 164.508(a)(2), the use or disclosure of psychotherapy notes generally requires specific patient authorization separate from general consent for treatment, payment, and health care operations. If your AI scribe generates or processes psychotherapy notes as defined under 45 C.F.R. § 164.501, additional authorization may be required.

• Minimum necessary standard: Under 45 C.F.R. § 164.502(b), covered entities must make reasonable efforts to limit protected health information (PHI) to the minimum necessary to accomplish the intended purpose. Ensure your AI scribe is configured to capture and retain only the information necessary for clinical documentation.

HIPAA Security Rule (45 C.F.R. Part 164, Subpart C)

• Business Associate Agreement (BAA): Any AI scribing vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate under 45 C.F.R. § 160.103. You must have a signed BAA in place before using the service. The BAA must address how the vendor will safeguard PHI, report breaches, and return or destroy data upon termination.

• Technical safeguards: Under 45 C.F.R. § 164.312, required safeguards include access controls, audit controls, integrity controls, and transmission security (encryption). Verify that your AI scribing platform encrypts data both in transit and at rest, provides role-based access, and maintains audit logs.

• Risk analysis: Under 45 C.F.R. § 164.308(a)(1), you must conduct a risk analysis assessing the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI processed by the AI scribe.

HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D)

If an AI scribing vendor experiences a data breach involving your patients' PHI, you have notification obligations under 45 C.F.R. §§ 164.404–164.408, including notifying affected individuals, the Secretary of HHS, and in some cases, the media. Your BAA should clearly define the vendor's obligations to notify you promptly of any breach.

Massachusetts State Data Breach Law

Massachusetts also has its own data breach notification statute, M.G.L. c. 93H, which requires notification to the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation in the event of a breach of personal information. Additionally, 201 CMR 17.00 (Standards for the Protection of Personal Information of Residents of the Commonwealth) requires businesses that own or license personal information of Massachusetts residents to develop, implement, and maintain a comprehensive written information security program (WISP).

Patient Consent Best Practices for Massachusetts

Given the two-party consent requirement and the sensitive nature of psychotherapy, Massachusetts psychotherapists should implement a robust, multi-layered consent process before using any AI scribing tool.

1. Written Informed Consent Form

Create a standalone consent form specific to AI scribing that is separate from your general treatment consent. The form should include:

• A clear, plain-language explanation of what AI scribing is and how it works

• What is being recorded (audio of the session) and what is generated (clinical notes)

• Whether audio recordings are stored, and if so, for how long and where

• Whether audio is deleted after transcription

• The name of the AI scribing vendor and confirmation that a BAA is in place

• How generated notes are stored, who has access, and how they are protected

• The patient's right to refuse AI scribing without any impact on treatment

• The patient's right to withdraw consent at any time

• A signature line with date for the patient (and guardian, if applicable)

2. Verbal Confirmation at Session Start

Even with a signed written consent form, best practice is to verbally confirm consent at the beginning of each session where AI scribing will be used. A simple statement such as: "As we discussed, I'll be using an AI documentation tool during our session today. It will process our conversation to help me create clinical notes. Are you still comfortable with that?"

3. Document the Consent in the Clinical Record

Note in your clinical documentation that AI scribing consent was obtained, including the date of the written consent and verbal confirmation at the session.

4. Offer Opt-Out Without Penalty

Make it unambiguously clear that patients can opt out at any time without affecting their access to care. If a patient declines, be prepared to take notes manually or by other means.

5. Special Considerations for Minors and Vulnerable Populations

When treating minors, obtain consent from the parent or legal guardian in addition to age-appropriate assent from the minor. For patients under guardianship or with diminished capacity, follow applicable Massachusetts guardianship law (M.G.L. c. 190B, Article V) to ensure the appropriate party is providing consent.

What Happens if You Don't Comply?

Failure to comply with Massachusetts recording laws and HIPAA requirements when using AI scribing can result in severe consequences across multiple domains:

Criminal Penalties

Under M.G.L. c. 272, § 99(C)(1), secretly recording a therapy session — even with an AI scribe — is a felony. Penalties include:

• Up to 5 years imprisonment in state prison

• Up to 2.5 years in a jail or house of correction

• Fines up to $10,000

Civil Liability

Under M.G.L. c. 272, § 99(Q), patients whose communications are intercepted without consent may bring civil suits seeking actual damages, punitive damages, and reasonable attorney's fees and costs.

HIPAA Penalties

The HHS Office for Civil Rights (OCR) enforces HIPAA and may impose civil monetary penalties under 42 U.S.C. § 1320d-5 and 42 U.S.C. § 1320d-6. Penalty tiers range from $137 to over $2 million per violation category per year (adjusted annually for inflation). Willful neglect violations that are not corrected carry the highest penalties. Criminal violations under 42 U.S.C. § 1320d-6 can result in fines up to $250,000 and up to 10 years imprisonment.

Licensing Board Discipline

The Massachusetts Board of Registration of Psychologists, the Board of Registration of Social Workers, or the Board of Registration of Allied Mental Health and Human Services Professionals (depending on your license type) may take disciplinary action — including license suspension or revocation — for violations of patient confidentiality or ethical standards.

Malpractice Exposure

Unauthorized recording of therapy sessions could serve as evidence of a breach of the standard of care in a malpractice action, particularly given the fiduciary nature of the psychotherapist-patient relationship.

Reputational Harm

A wiretapping charge or HIPAA breach involving psychotherapy sessions would likely cause significant and lasting damage to your professional reputation and practice.

Implementation Checklist

Use this checklist before deploying any AI scribing tool in your Massachusetts psychotherapy practice:

1. ☐ Verify two-party consent compliance: Confirm that your workflow obtains explicit consent from all parties before any audio capture begins, consistent with M.G.L. c. 272, § 99.

2. ☐ Execute a HIPAA Business Associate Agreement: Ensure a signed BAA is in place with your AI scribing vendor before processing any patient data.

3. ☐ Review psychotherapy notes handling: Determine whether the AI scribe generates psychotherapy notes as defined under 45 C.F.R. § 164.501 and obtain any additional required HIPAA authorization.

4. ☐ Confirm encryption and security standards: Verify the AI scribing platform uses encryption in transit and at rest, role-based access controls, and maintains audit logs per 45 C.F.R. § 164.312.

5. ☐ Create a standalone AI scribing consent form: Draft a clear, plain-language written consent form specific to AI scribing, separate from your general treatment consent.

6. ☐ Implement verbal consent confirmation: Establish a workflow to verbally confirm consent at the start of each session where AI scribing is used.

7. ☐ Document consent in the clinical record: Record the date and method of consent in the patient's chart for each session.

8. ☐ Establish opt-out procedures: Have a clear process for patients who decline AI scribing, ensuring no disruption to care.

9. ☐ Conduct a HIPAA risk analysis: Perform and document a risk assessment that includes the AI scribing tool, per 45 C.F.R. § 164.308(a)(1).

10. ☐ Develop or update your WISP: Ensure your Written Information Security Program under 201 CMR 17.00 accounts for the AI scribing platform.

11. ☐ Review data retention and deletion policies: Know how long audio and transcription data are retained by the vendor and ensure policies align with your legal and ethical obligations.

12. ☐ Plan for breach notification: Confirm that your BAA includes prompt breach notification provisions and that you have a response plan addressing both M.G.L. c. 93H and HIPAA breach notification requirements.

13. ☐ Consult legal counsel: Before implementation, have a healthcare attorney licensed in Massachusetts review your consent forms, BAA, and overall AI scribing workflow.

This guide is provided for informational purposes only and does not constitute legal advice. Laws and regulations are subject to change. Psychotherapists should consult with a qualified attorney licensed in Massachusetts to address their specific circumstances.