Is AI Scribing Legal in Montana? (2026 Compliance Guide for Healthcare Providers)

Quick Answer

Yes, AI scribing is legal in Montana when implemented in compliance with state recording consent laws and federal HIPAA regulations. Montana is a one-party consent state for recording conversations, which means that only one party to a conversation needs to consent to the recording. However, healthcare providers must also satisfy HIPAA's privacy and security requirements when using any AI tool that processes protected health information (PHI). Rural Montana practices, in particular, should pay close attention to data transmission security given the reliance on telehealth and remote connectivity in underserved areas.

Practice in Montana? Scribing.io is fully compliant with Montana recording laws. Try it free.

Recording Consent Laws in Montana

Montana's wiretapping and electronic surveillance statute is codified at Montana Code Annotated (MCA) § 45-8-213. This law makes it illegal to knowingly or purposely record or intercept a conversation without the consent of at least one party to that conversation. The statute applies to both in-person and electronic communications.

Under MCA § 45-8-213, a person commits the offense of privacy in communications if they knowingly or purposely intercept any wire, electronic, or oral communication without the consent of a party to the communication. Violations are classified as a felony offense under Montana law.

For healthcare providers, this means that as long as you — the physician or a member of your care team — are a party to the patient encounter and you consent to the AI scribe recording or processing the conversation, the recording itself does not violate Montana state law.

It is important to note that Montana's Constitution, under Article II, Section 10, provides an explicit right to privacy. Montana courts have historically interpreted this constitutional right broadly. While one-party consent satisfies the criminal wiretapping statute, the constitutional privacy right means that transparency with patients is strongly advisable from both an ethical and legal risk-management standpoint.

One-Party vs Two-Party Consent: What It Means for Your Practice

In one-party consent states like Montana, only one participant in the conversation needs to agree to the recording. This contrasts with two-party (or all-party) consent states, where every person involved in the conversation must give permission before a recording can occur.

What This Means Practically for Montana Physicians

• You are the consenting party. As the physician conducting the encounter, your decision to use an AI scribing tool constitutes one-party consent under MCA § 45-8-213.

• Patient consent is not strictly required under state wiretapping law. However, HIPAA, medical ethics obligations, and Montana's constitutional privacy protections create strong reasons to inform and obtain patient consent regardless.

• Telehealth considerations for rural practices: If you are treating patients across state lines via telehealth, you must also comply with the recording laws of the state where the patient is physically located. Some states are two-party consent jurisdictions (e.g., California, Washington, Florida). Always verify the patient's location.

• Multi-party encounters: In group visits or consultations involving multiple clinicians and patients, ensure that at least one consenting party is present under Montana law — though best practice remains obtaining informed consent from all participants.

HIPAA Requirements on Top of State Law

Even though Montana's one-party consent law permits the recording, federal HIPAA regulations impose additional obligations whenever PHI is involved. AI scribing tools process, transmit, and may store PHI, which triggers the following requirements:

Business Associate Agreement (BAA)

Under 45 CFR § 164.502(e) and 45 CFR § 164.504(e), any AI scribing vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate. You must execute a Business Associate Agreement (BAA) with the vendor before using the tool. The BAA must specify:

• Permitted uses and disclosures of PHI

• Safeguards the vendor will implement

• Breach notification procedures

• Terms for return or destruction of PHI upon termination

Security Rule Compliance

Under the HIPAA Security Rule (45 CFR Part 164, Subpart C), you must ensure the AI scribing platform implements appropriate administrative, physical, and technical safeguards, including:

• Encryption in transit and at rest — particularly critical for rural Montana practices relying on satellite internet, cellular hotspots, or other less secure connections

• Access controls — only authorized personnel should access AI-generated notes

• Audit logs — the system must maintain records of who accessed PHI and when

• Automatic session termination — to prevent unauthorized access on shared or portable devices

Privacy Rule Compliance

Under the HIPAA Privacy Rule (45 CFR Part 164, Subpart E), patients have the right to:

• Be informed about how their health information is used (Notice of Privacy Practices)

• Request restrictions on certain uses of their PHI

• Access their medical records, including AI-generated documentation

Your Notice of Privacy Practices should be updated to reflect the use of AI scribing technology, including how audio data is processed and whether it is stored or deleted after transcription.

Minimum Necessary Standard

Under 45 CFR § 164.502(b), only the minimum necessary PHI should be used or disclosed. Ensure your AI scribing tool is configured to capture only what is clinically relevant and does not record conversations outside the clinical encounter (e.g., hallway conversations, personal discussions).

Patient Consent Best Practices for Montana

While Montana's one-party consent law does not legally require patient permission for recording, healthcare providers should adopt robust consent practices for the following reasons:

1. Montana's constitutional right to privacy (Article II, Section 10) is among the broadest in the nation and could expose providers to civil liability if patients are not informed.

2. Medical ethics obligations under the AMA Code of Medical Ethics (Opinion 1.2.12 on ethical practice in telemedicine, and general principles of informed consent) encourage transparency.

3. Patient trust and rural community dynamics: In small rural Montana communities, trust between patient and physician is paramount. Undisclosed recording — even if legal — can severely damage that trust and your practice reputation.

4. Risk mitigation: Documented informed consent protects against malpractice claims or complaints to the Montana Board of Medical Examiners.

Recommended Consent Workflow

• Written consent at intake: Include an AI scribing disclosure and consent form as part of your new patient paperwork. Clearly explain what AI scribing is, how the audio is processed, whether audio is retained, and how the generated notes are used.

• Verbal confirmation at each visit: At the start of each encounter, briefly inform the patient: "I use an AI-assisted documentation tool that listens to our conversation to help me create accurate clinical notes. Is that okay with you?"

• Document the consent: Note in the patient's chart that AI scribing consent was obtained, including the date and method (written, verbal, or both).

• Offer an opt-out: Allow patients to decline. If a patient opts out, be prepared to document the encounter manually or through traditional methods.

• Telehealth-specific disclosure: For telehealth visits, include AI scribing consent language in your telehealth consent form and reiterate it verbally at the start of the session.

What Happens if You Don't Comply?

Montana State Law Violations

Violating MCA § 45-8-213 (recording without any party's consent) is a felony in Montana. However, as a one-party consent state, if you as the physician consent to the recording, you are unlikely to violate this statute during a clinical encounter you are participating in. The greater risk is civil liability under Montana's constitutional privacy provisions if a patient successfully argues their privacy rights were violated by undisclosed recording.

HIPAA Violations

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces HIPAA. Penalties under 42 USC § 1320d-5 and 42 USC § 1320d-6 are tiered:

Note: Penalty amounts are adjusted annually for inflation. The figures above reflect recent adjusted amounts; verify current amounts with HHS OCR.

State Licensing Consequences

The Montana Board of Medical Examiners, operating under MCA Title 37, Chapter 3, has authority to investigate complaints and take disciplinary action against physicians for unprofessional conduct. Failure to maintain patient confidentiality or obtain appropriate consent could result in investigation, reprimand, license suspension, or revocation.

Civil Liability

Patients may bring civil suits under Montana tort law for invasion of privacy or breach of the physician-patient relationship. Montana's broad constitutional privacy right strengthens such claims. Damages could include compensatory and, in egregious cases, punitive damages.

Implementation Checklist

Use this checklist to ensure your Montana practice is fully compliant when implementing AI scribing:

• ☐ Verify your AI scribing vendor will execute a HIPAA-compliant BAA — do not use any tool that refuses to sign one

• ☐ Confirm end-to-end encryption for all audio and text data, especially critical for rural practices with variable internet connectivity

• ☐ Review the vendor's data retention and deletion policies — understand how long audio recordings are stored and whether they are deleted after transcription

• ☐ Update your Notice of Privacy Practices to disclose the use of AI-assisted documentation tools

• ☐ Create a patient consent form for AI scribing that includes plain-language explanation of the technology

• ☐ Train all clinical staff on how to introduce AI scribing to patients and handle opt-outs

• ☐ Establish a verbal consent protocol for confirming AI scribing consent at the start of each encounter

• ☐ Document consent in the patient chart for every encounter where AI scribing is used

• ☐ Audit access controls — ensure only authorized providers and staff can access AI-generated notes

• ☐ Configure the tool to record only during clinical encounters — prevent accidental capture of non-clinical conversations

• ☐ Review cross-state telehealth implications — if treating out-of-state patients, verify the recording consent laws in the patient's state

• ☐ Establish a breach response plan that includes your AI scribing vendor per your BAA terms

• ☐ Conduct periodic compliance reviews — reassess at least annually as technology and regulations evolve

• ☐ Consult with a Montana healthcare attorney before deployment to address any practice-specific concerns

This guide is provided for informational purposes only and does not constitute legal advice. Healthcare providers should consult with a qualified Montana healthcare attorney for guidance specific to their practice. Laws and regulations may change; verify all cited statutes and regulations for current applicability.