Is AI Scribing Legal in Oregon? (2026 Compliance Guide for Healthcare Providers)

Quick Answer

Yes, AI scribing is legal in Oregon when implemented with proper consent protocols and HIPAA-compliant technology. Oregon is a one-party consent state under ORS 165.540, meaning that only one participant in a conversation needs to consent to the recording. However, mental health professionals face additional ethical and regulatory obligations that go beyond Oregon's baseline recording statute. This guide explains what you need to know to use AI scribing compliantly in therapy settings.

Practice in Oregon? Scribing.io is fully compliant with Oregon recording laws. Try it free.

Recording Consent Laws in Oregon

Oregon's wiretapping and recording laws are governed primarily by ORS 165.540, which addresses the unlawful recording of conversations. Under this statute:

• ORS 165.540(1)(c) makes it unlawful to obtain or attempt to obtain the whole or any part of a telecommunication or conversation by means of any device if not all participants in the conversation are informed that the communication is being recorded.

• However, ORS 165.540(5)(a) provides a key exception: it is not unlawful for a person to record a conversation if the person is a participant in the conversation and has not obtained the recording for the purpose of committing a criminal or tortious act.

This makes Oregon a one-party consent state. As the clinician, if you are a participant in the therapy session and you are initiating the AI scribe recording, you are legally the consenting party under this statute. The recording itself does not violate ORS 165.540 when you, as a participant, consent to it.

Important Nuance for Mental Health Professionals

While Oregon law technically allows one-party consent recordings, mental health professionals must consider additional layers of obligation:

• Oregon Administrative Rules (OARs) governing licensed mental health professionals — including Licensed Professional Counselors (LPCs), Licensed Clinical Social Workers (LCSWs), and Licensed Psychologists — impose ethical duties of informed consent and transparency that go beyond the minimum requirements of ORS 165.540.

• The Oregon Board of Licensed Professional Counselors and Therapists (governed under ORS 675.715–675.835) requires practitioners to inform clients about the methods used to document treatment.

• The Oregon Board of Psychology (governed under ORS 675.010–675.150) similarly requires psychologists to obtain informed consent regarding procedures that affect the therapeutic relationship.

In practical terms, even though one-party consent is the legal baseline, best practice — and arguably ethical obligation — for mental health professionals in Oregon is to obtain explicit, informed patient consent before activating any AI scribing tool.

One-Party vs Two-Party Consent: What It Means for Your Practice

Understanding the difference is critical, particularly because many mental health professionals mistakenly believe Oregon requires two-party consent.

Why This Matters for Therapy Settings

Mental health professionals often express concern about two-party consent because of the sensitive nature of therapy conversations. While Oregon law does not require your patient's consent for the recording to be legal, the therapeutic relationship introduces important considerations:

1. Trust and Therapeutic Alliance: Recording a therapy session without informing the patient — even if legally permissible — can seriously damage the therapeutic relationship if discovered.

2. Ethical Codes: The American Psychological Association (APA) Ethical Principles, the NASW Code of Ethics, and the American Counseling Association (ACA) Code of Ethics all emphasize informed consent and transparency as foundational ethical obligations.

3. Licensing Board Expectations: Oregon licensing boards may view undisclosed recording as a violation of professional standards, regardless of the state's one-party consent law.

Bottom line: Oregon's one-party consent law means you won't face criminal liability under ORS 165.540 for recording a session you participate in. But operating without patient consent exposes you to potential ethical complaints, licensing board actions, and civil liability. Always obtain informed consent.

HIPAA Requirements on Top of State Law

State recording law is only one layer of the compliance framework. Any AI scribing tool used in a clinical setting also falls under the Health Insurance Portability and Accountability Act (HIPAA), specifically the Privacy Rule (45 CFR Part 164, Subpart E) and the Security Rule (45 CFR Part 164, Subpart C).

Key HIPAA Considerations for AI Scribing

• Business Associate Agreement (BAA): Under 45 CFR § 164.502(e) and 45 CFR § 164.504(e), any AI scribing vendor that creates, receives, maintains, or transmits protected health information (PHI) on your behalf is a business associate. You must have a signed BAA in place before using the tool. Without a BAA, you are in violation of HIPAA regardless of state law compliance.

• Minimum Necessary Standard: Under 45 CFR § 164.502(b), you should ensure the AI scribing tool only accesses and processes the minimum PHI necessary to accomplish its intended purpose (generating clinical notes).

• Encryption and Data Security: The HIPAA Security Rule requires administrative, physical, and technical safeguards. Ensure your AI scribing vendor encrypts data both in transit and at rest, and has documented security policies.

• Patient Rights: Under 45 CFR § 164.524, patients retain the right to access their health records. Notes generated by AI scribes are part of the medical record and must be made available upon request.

• Psychotherapy Notes Exception: Under 45 CFR § 164.508(a)(2), psychotherapy notes — as specifically defined by HIPAA — receive additional protections. If your AI scribe generates content that meets HIPAA's definition of psychotherapy notes (notes recorded by a mental health professional documenting the contents of a counseling session, maintained separately from the medical record), additional authorization requirements may apply for disclosure.

Oregon-Specific Health Information Privacy

Oregon has its own health information privacy provisions under ORS 192.553–192.581 (Oregon Health Information Privacy). These provisions may impose additional requirements beyond HIPAA, including restrictions on the use and disclosure of certain health information. Mental health records may receive heightened protections under Oregon law. Review these provisions in conjunction with HIPAA to ensure full compliance.

Patient Consent Best Practices for Oregon

Given the intersection of Oregon recording law, HIPAA, professional ethics codes, and licensing board requirements, the following best practices are recommended for mental health professionals using AI scribing tools:

1. Obtain Written Informed Consent

Create a dedicated AI scribing consent form — separate from your general treatment consent — that includes:

• A clear explanation that an AI-powered tool will be used to assist with clinical documentation

• A description of what the tool does (e.g., records audio, generates draft clinical notes)

• How the audio and data are processed, stored, and protected

• Whether audio recordings are retained or deleted after note generation

• The patient's right to opt out without any impact on treatment

• The name of the AI scribing vendor and confirmation that a BAA is in place

2. Provide Verbal Explanation at the Start of Each Session

Even with written consent on file, briefly confirm at the beginning of each session that the AI scribe will be active. This reinforces transparency and gives the patient an opportunity to decline for that session.

3. Document Consent in the Clinical Record

Note in the patient's chart that informed consent for AI scribing was obtained, the date it was signed, and any patient questions or concerns that were addressed.

4. Offer an Opt-Out Without Penalty

Make clear — in writing and verbally — that declining AI scribing will not affect the quality or availability of care. This is both an ethical obligation and a practical safeguard against coercion claims.

5. Review and Sign All AI-Generated Notes

AI scribes generate draft documentation. The clinician is ultimately responsible for the accuracy and completeness of the clinical record. Review every note, make corrections, and sign off before finalizing. Under Oregon law, the treating provider remains the author of record.

6. Address Telehealth Sessions Separately

If you provide telehealth services to patients located in other states, you must comply with the recording consent laws of the patient's state, which may be a two-party consent jurisdiction. Oregon's one-party consent law only governs recordings made within Oregon.

What Happens if You Don't Comply?

Non-compliance with recording laws, HIPAA, or professional ethics standards can result in multiple categories of consequences:

Criminal Penalties Under Oregon Law

Violation of ORS 165.540 is a Class A misdemeanor under Oregon law, punishable by up to 364 days in jail and fines up to $6,250. However, as noted above, one-party consent means a participant recording their own conversation is generally not in violation.

HIPAA Penalties

HIPAA violations are enforced by the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Penalties under 42 USC § 1320d-5 and 42 USC § 1320d-6 are tiered:

Note: Penalty amounts are adjusted annually for inflation. The figures above reflect approximate 2026 ranges.

Licensing Board Consequences

Oregon licensing boards — including the Board of Licensed Professional Counselors and Therapists, the Board of Psychology, and the Board of Licensed Social Workers — may impose disciplinary actions including:

• Formal reprimands

• Required continuing education

• Supervised practice requirements

• License suspension or revocation

Civil Liability

Patients may bring civil claims for invasion of privacy, breach of fiduciary duty, or negligence. Oregon courts recognize claims for invasion of privacy, and undisclosed recording of therapy sessions could form the basis of such a claim regardless of the one-party consent statute.

Implementation Checklist

Use this checklist before deploying AI scribing in your Oregon mental health practice:

1. ☐ Verify vendor HIPAA compliance: Confirm the AI scribing vendor offers a signed Business Associate Agreement (BAA)

2. ☐ Review data handling practices: Understand where audio and text data are stored, how they are encrypted, and retention/deletion policies

3. ☐ Create a dedicated AI scribing consent form: Include purpose, process, data handling, and opt-out provisions

4. ☐ Integrate consent into intake workflow: Add the AI scribing consent form to your new patient onboarding process

5. ☐ Establish verbal check-in protocol: Confirm AI scribe use at the start of each session

6. ☐ Document consent in the clinical record: Record that informed consent was obtained, including the date

7. ☐ Review all AI-generated notes: Read, edit, and sign every note before it becomes part of the permanent record

8. ☐ Address telehealth scenarios: Identify patients in two-party consent states and obtain all-party consent for those sessions

9. ☐ Update your Notice of Privacy Practices (NPP): Disclose the use of AI-assisted documentation tools as required under HIPAA

10. ☐ Train staff: Ensure all clinical and administrative staff understand the consent protocol and can answer patient questions

11. ☐ Review Oregon health information privacy laws: Confirm compliance with ORS 192.553–192.581 in addition to HIPAA

12. ☐ Consult legal counsel: Have a healthcare attorney licensed in Oregon review your consent forms and AI scribing workflow before launch

This guide is provided for informational purposes only and does not constitute legal advice. Mental health professionals should consult with a qualified healthcare attorney licensed in Oregon to address their specific circumstances. Laws and regulations are subject to change; verify all cited statutes for current applicability.