Posted on
Jun 2, 2026
Is AI Scribing Legal in Vermont? (2026 Compliance Guide for Healthcare Providers)
Quick Answer
Yes, AI scribing is legal in Vermont when implemented in compliance with state recording consent laws, HIPAA, and applicable mental health confidentiality regulations. Vermont is a one-party consent state for recording communications, meaning that only one party to a conversation must consent to its recording. However, for mental health professionals, ethical obligations and HIPAA requirements establish a higher standard that effectively requires patient consent in virtually all clinical scenarios.
Practice in Vermont? Scribing.io is fully compliant with Vermont recording laws. Try it free.
Recording Consent Laws in Vermont
Vermont's wiretapping and electronic surveillance law is codified under 13 V.S.A. § 1051 et seq. (Title 13, Chapter 29 of the Vermont Statutes Annotated). This statute governs the interception of wire, oral, and electronic communications in the state.
Under 13 V.S.A. § 1052, it is unlawful to intentionally intercept or attempt to intercept any wire, oral, or electronic communication. However, 13 V.S.A. § 1052(b) provides a key exception: it is not unlawful for a person who is a party to the communication, or who has received prior consent from one party to the communication, to intercept, record, or disclose the contents of that communication.
This makes Vermont a one-party consent state. As the clinician conducting a therapy session, you are a party to the conversation and may legally record it under state law without the other party's knowledge or consent. However, as detailed below, ethical standards and federal law create additional obligations that go well beyond this statutory minimum.
Mental Health-Specific Considerations
Vermont has specific protections for mental health records and communications. Under 18 V.S.A. § 7103, information obtained in the course of providing mental health services is confidential. Additionally, Vermont's rules governing licensed mental health professionals — including psychologists regulated under 26 V.S.A. Chapter 55, clinical mental health counselors under 26 V.S.A. Chapter 65, and clinical social workers under 26 V.S.A. Chapter 61 — impose duties of confidentiality that necessitate informed patient awareness of how session information is captured, processed, and stored.
Psychotherapy notes also receive heightened protection under HIPAA (discussed below), which adds a federal layer of compliance requirements specifically relevant to mental health practitioners.
One-Party vs Two-Party Consent: What It Means for Your Practice
Understanding the distinction between one-party and two-party consent is critical for mental health professionals considering AI scribing tools.
Consent Type | Definition | Vermont Status |
|---|---|---|
One-Party Consent | Only one participant in a conversation needs to consent to its recording. The person doing the recording can be that one party. | This is Vermont's law under 13 V.S.A. § 1052(b). |
Two-Party (All-Party) Consent | All parties to a conversation must consent before it can be recorded. | Not required under Vermont statute. |
Important caveat for therapists: While Vermont's one-party consent law technically allows you to record sessions without informing your patient, doing so would likely violate:
HIPAA Privacy Rule requirements regarding the use and disclosure of protected health information (PHI), particularly psychotherapy notes under 45 C.F.R. § 164.508(a)(2)
Professional ethical codes — the APA Ethical Principles of Psychologists and Code of Conduct (Standard 4.03), the ACA Code of Ethics (Section B.6), and the NASW Code of Ethics all require informed consent for recording sessions
Vermont professional licensing board standards which incorporate ethical obligations into licensure requirements
For these reasons, best practice — and effectively the legal standard for mental health professionals — is to obtain explicit, informed patient consent before using any AI scribing tool during therapy sessions, regardless of Vermont's one-party consent statute.
HIPAA Requirements on Top of State Law
HIPAA establishes a federal baseline for privacy and security of protected health information (PHI) that applies to all covered entities and their business associates. When using an AI scribing tool, mental health professionals must address several HIPAA requirements:
1. Business Associate Agreement (BAA)
Under 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.504(e), any AI scribing vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate. You must execute a Business Associate Agreement (BAA) before sharing any patient data with the AI scribing service. A BAA must specify:
Permitted and required uses of PHI
Safeguards the vendor will implement
Breach notification obligations
Return or destruction of PHI upon contract termination
2. Psychotherapy Notes — Heightened Protection
Under 45 C.F.R. § 164.501, psychotherapy notes are defined as notes recorded by a mental health professional documenting or analyzing the contents of a counseling session, maintained separately from the medical record. These notes receive heightened protection under 45 C.F.R. § 164.508(a)(2), which requires specific patient authorization for most uses and disclosures — above and beyond general consent for treatment, payment, and healthcare operations.
If your AI scribing tool captures session content that constitutes psychotherapy notes, you must carefully consider:
Whether captured audio or transcripts qualify as psychotherapy notes under HIPAA's definition
How these notes are stored, who has access, and whether they are maintained separately from the general medical record
Whether proper patient authorization has been obtained for processing this content
3. Security Rule Compliance
The HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) requires administrative, physical, and technical safeguards for electronic PHI (ePHI). When evaluating an AI scribing vendor, verify:
Encryption — data must be encrypted in transit and at rest (per 45 C.F.R. § 164.312(a)(2)(iv) and § 164.312(e)(1))
Access controls — only authorized users should access ePHI
Audit controls — the system must log access to ePHI
Data retention and deletion policies — audio recordings should be deleted after transcription unless there is a specific, documented need to retain them
4. Minimum Necessary Standard
Under 45 C.F.R. § 164.502(b), covered entities must limit PHI use and disclosure to the minimum necessary to accomplish the intended purpose. Consider whether your AI scribe needs access to the full audio recording or whether processing can be limited to generate only the clinical note content required.
Patient Consent Best Practices for Vermont
Given the intersection of Vermont state law, HIPAA, and professional ethics, the following consent best practices are strongly recommended for mental health professionals using AI scribing tools:
Written Informed Consent
Develop a dedicated AI scribing consent form — separate from your general treatment consent — that includes:
Plain-language explanation of what AI scribing is and how it works (e.g., audio is captured, processed by AI to generate a clinical note, then deleted)
What data is collected — audio recording, transcript, clinical notes
How data is processed and stored — where data is transmitted, encryption methods, storage duration
Who has access — the vendor's role as a business associate, any subprocessors
Data retention and deletion policies — when audio is deleted, how long transcripts are maintained
Patient's right to refuse — patients must be informed that they can decline AI scribing without impact on their care
Patient's right to revoke consent — the process for withdrawing consent in the future
Verbal Confirmation at Each Session
Even with signed written consent on file, best practice is to verbally confirm at the start of each session that the patient is aware AI scribing is active. This is especially important in mental health settings where therapeutic rapport and trust are foundational to treatment.
Special Populations
Exercise heightened caution with:
Minors — consent from a parent or legal guardian is typically required, though Vermont law (18 V.S.A. § 7503) allows minors to consent to their own mental health treatment in certain circumstances; evaluate whether this extends to consent for recording
Patients under guardianship — obtain consent from the legal guardian
Patients in crisis — consider whether a patient in acute distress can provide meaningful informed consent; err on the side of turning off AI scribing during crisis interventions
Group therapy — all participants must consent, as each is a party to the communication
Documentation
Maintain signed consent forms in the patient's record. Document any verbal confirmations or refusals. If a patient declines AI scribing, document that manual note-taking was used for that session.
What Happens if You Don't Comply?
Non-compliance with recording and privacy laws can result in serious consequences for mental health professionals in Vermont:
Vermont Criminal Penalties
Under 13 V.S.A. § 1052, unlawful interception of communications is a criminal offense. While Vermont's one-party consent law makes it unlikely a therapist would face criminal liability for recording their own session, violations in other scenarios (such as recording a conversation to which you are not a party) can result in criminal penalties.
HIPAA Penalties
The HITECH Act (enacted as part of the American Recovery and Reinvestment Act of 2009) strengthened HIPAA enforcement. Civil penalties under 42 U.S.C. § 1320d-5 are tiered:
Violation Tier | Penalty Range Per Violation |
|---|---|
Did not know (and would not have known) | $137 – $68,928 |
Reasonable cause, not willful neglect | $1,379 – $68,928 |
Willful neglect, corrected within 30 days | $13,785 – $68,928 |
Willful neglect, not corrected | $68,928 – $2,067,813 |
Note: Penalty amounts are adjusted annually for inflation. The figures above reflect approximate 2026 ranges. Consult the HHS Office for Civil Rights for current amounts.
Criminal penalties under 42 U.S.C. § 1320d-6 can include fines up to $250,000 and imprisonment up to 10 years for obtaining or disclosing PHI with intent to sell, transfer, or use for personal gain or malicious harm.
Professional Licensing Consequences
Vermont licensing boards — including the Board of Psychological Examiners, the Board of Allied Mental Health Practitioners, and others — may take disciplinary action including license suspension or revocation for violations of patient confidentiality or failure to meet ethical standards. Complaints can be filed through the Vermont Office of Professional Regulation.
Civil Liability
Patients whose privacy is breached may pursue civil claims for damages, including claims for negligence, breach of fiduciary duty, or violation of Vermont's consumer protection statutes (9 V.S.A. Chapter 63, the Vermont Consumer Protection Act).
Reputational Harm
For mental health professionals, trust is the foundation of the therapeutic relationship. A privacy breach or consent violation — even one that does not result in formal penalties — can cause irreparable damage to your practice and professional reputation.
Implementation Checklist
Use this checklist to ensure your AI scribing implementation is compliant in Vermont:
☐ Verify the AI scribing vendor will sign a HIPAA-compliant Business Associate Agreement (BAA) — Do not use any tool that refuses to execute a BAA.
☐ Confirm encryption standards — Ensure data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
☐ Review data retention and deletion policies — Verify that audio recordings are deleted promptly after note generation and that the vendor's retention policies align with your obligations.
☐ Develop a dedicated AI scribing informed consent form — Include all elements listed in the Patient Consent Best Practices section above.
☐ Obtain signed written consent from every patient before using AI scribing — File the signed form in the patient's record.
☐ Establish a verbal confirmation protocol — Remind patients at the start of each session that AI scribing is in use.
☐ Create a process for patients who decline — Have a workflow for manual note-taking when patients opt out.
☐ Address psychotherapy notes — Determine whether AI-generated content constitutes psychotherapy notes under HIPAA and implement appropriate protections and authorizations.
☐ Evaluate special populations — Develop specific protocols for minors, patients under guardianship, group therapy, and crisis situations.
☐ Review your Notice of Privacy Practices (NPP) — Update your NPP to reflect the use of AI scribing technology, as required under 45 C.F.R. § 164.520.
☐ Train all staff — Ensure anyone involved in your practice understands the AI scribing workflow, consent requirements, and how to handle patient questions or concerns.
☐ Conduct a HIPAA Security Risk Assessment — As required under 45 C.F.R. § 164.308(a)(1)(ii)(A), assess the risks that AI scribing introduces to your practice and document mitigation measures.
☐ Establish a breach response plan — Know your obligations under both HIPAA (45 C.F.R. Part 164, Subpart D) and Vermont's data breach notification law (9 V.S.A. § 2435) if patient data is compromised.
☐ Consult with a healthcare attorney — This guide is for informational purposes only and does not constitute legal advice. Consult with a qualified attorney licensed in Vermont to review your specific implementation.
This guide is provided for informational purposes only and does not constitute legal advice. Laws and regulations may change. Mental health professionals should consult with a qualified healthcare attorney in Vermont to ensure full compliance with all applicable federal, state, and professional requirements. Last reviewed: 2026.
