Posted on
Feb 15, 2026
Is AI Scribing Legal in Washington? (2026 Compliance Guide for Healthcare Providers)
Quick Answer
Yes, AI scribing is legal in Washington State — but Washington is a two-party (all-party) consent state, which means you must obtain consent from all participants before recording any conversation, including telehealth sessions. This requirement applies to both in-person and remote encounters. Failure to obtain proper consent before using an AI scribe that records or captures audio can result in criminal penalties and civil liability under Washington law.
Practice in Washington? Scribing.io is fully compliant with Washington recording laws. Try it free.
Recording Consent Laws in Washington
Washington's wiretapping and recording law is codified at RCW 9.73.030, which makes it unlawful to intercept or record any private conversation without the consent of all participants. The statute applies broadly to any private communication transmitted by telephone, telegraph, radio, or other device — which courts have interpreted to include internet-based communications such as video conferencing and telehealth platforms.
The key statutory language from RCW 9.73.030(1) states that it is unlawful to "intercept, or record any: (a) Private communication transmitted by telephone, telegraph, radio, or other device between two or more individuals" without the consent of all parties to the communication.
Additionally, RCW 9.73.050 provides that any information obtained in violation of RCW 9.73.030 is inadmissible in civil or criminal proceedings. RCW 9.73.060 establishes a civil cause of action for violations, allowing the injured party to recover actual damages, statutory damages, and attorneys' fees.
There is a narrow exception under RCW 9.73.030(2) for certain situations involving an announced recording — for example, if a recorded message at the start of a call announces that recording is occurring. However, healthcare providers should not rely on this exception alone and should obtain explicit, documented consent.
One-Party vs Two-Party Consent: What It Means for Your Practice
Understanding the distinction between one-party and two-party consent is critical for healthcare providers considering AI scribing tools:
One-party consent states allow a participant in a conversation to record it without notifying or obtaining consent from the other participants. In these states, a provider could theoretically activate an AI scribe without informing the patient.
Two-party (all-party) consent states like Washington require that every person involved in the conversation consent to the recording before it begins. This means you cannot use an AI scribe that captures audio, processes speech, or creates transcripts without first obtaining informed consent from the patient (and any other participants such as interpreters, family members, or other clinicians on the call).
For telehealth sessions specifically, this has significant implications:
Every participant must consent. If a patient's family member is present during a telehealth visit, that person must also consent to the recording or AI transcription.
Interstate telehealth encounters add complexity. If a provider in Washington conducts a telehealth session with a patient in another state, the provider should apply the more restrictive consent law — which in most cases will be Washington's two-party consent requirement.
Consent must be obtained before the AI scribe begins capturing any audio. Activating the tool before receiving consent, even momentarily, could constitute a violation of RCW 9.73.030.
HIPAA Requirements on Top of State Law
Compliance with Washington's recording laws does not eliminate the separate obligation to comply with the federal Health Insurance Portability and Accountability Act (HIPAA), specifically the Privacy Rule (45 CFR Part 164, Subpart E) and the Security Rule (45 CFR Part 164, Subpart C).
Key HIPAA considerations when using AI scribing tools include:
Business Associate Agreement (BAA): Any AI scribing vendor that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity is a business associate under 45 CFR § 160.103. A signed BAA must be in place before the vendor processes any patient data. Confirm that your AI scribe vendor will execute a BAA.
Minimum Necessary Standard: Under 45 CFR § 164.502(b), covered entities must make reasonable efforts to limit PHI to the minimum necessary for the intended purpose. Ensure your AI scribe is configured to capture only clinically relevant information.
Data Security: Under the Security Rule, PHI must be protected with appropriate administrative, physical, and technical safeguards. This includes encryption of audio data in transit and at rest, access controls, and audit logging. Verify that your AI scribe vendor employs encryption standards such as AES-256 for stored data and TLS 1.2 or higher for data in transit.
Patient Rights: Under 45 CFR § 164.524, patients have the right to access their medical records, which may include AI-generated clinical notes. Your practice should have a clear policy for handling these requests.
Notice of Privacy Practices (NPP): Under 45 CFR § 164.520, your NPP should be updated to disclose the use of AI scribing technology and explain how PHI generated by the tool is used, stored, and protected.
Remember: HIPAA sets a federal floor for privacy protections. Washington's stricter consent requirements operate on top of — not instead of — HIPAA obligations.
Patient Consent Best Practices for Washington
To comply with both RCW 9.73.030 and HIPAA, Washington healthcare providers should implement the following consent practices:
Obtain written or verifiable electronic consent before using an AI scribe. The consent form should clearly state that audio from the encounter will be captured and processed by an AI-powered documentation tool. For telehealth, a verbal consent captured on video before the AI scribe is activated — combined with documentation in the medical record — can serve as evidence of consent, though written or electronic consent is preferable.
Use plain language. The consent form should explain in accessible terms: what the AI scribe does, what data it captures, how the data is stored and protected, who has access to it, and the patient's right to decline.
Clearly state that consent is optional. Patients must understand that declining AI scribing will not affect the quality of their care. Document refusals in the medical record.
Obtain consent from all participants. In telehealth sessions where multiple parties are present (e.g., interpreters, caregivers, consulting providers), each participant must consent to the recording.
Renew consent periodically. Best practice is to reaffirm consent at regular intervals (e.g., annually) or whenever there are material changes to how the AI scribe operates or how data is handled.
Document everything. Maintain consent records in the patient's chart. For telehealth, consider timestamping the moment consent was obtained and the moment the AI scribe was activated.
Integrate consent into your intake workflow. Add AI scribe consent to your existing patient intake process — whether paper-based, through your patient portal, or via your telehealth platform — to minimize disruption to clinical workflows.
What Happens if You Don't Comply?
Non-compliance with Washington's recording consent laws and HIPAA carries serious consequences:
Under Washington State Law
Criminal penalties: Violating RCW 9.73.030 is a gross misdemeanor under Washington law, punishable by up to 364 days in jail and/or a fine of up to $5,000 (per RCW 9.92.020).
Civil liability: Under RCW 9.73.060, any person injured by a violation may bring a civil action and recover actual damages (with a minimum of liquidated damages as specified in the statute), plus reasonable attorneys' fees and costs.
Evidence exclusion: Under RCW 9.73.050, any recording obtained without proper consent is inadmissible in court proceedings, which could undermine malpractice defense or other legal matters.
Under HIPAA
Civil monetary penalties: The HHS Office for Civil Rights (OCR) can impose penalties ranging from $141 to $2,134,831 per violation (adjusted annually for inflation), depending on the level of culpability, under 42 USC § 1320d-5 and 45 CFR § 160.404.
Criminal penalties: Knowing violations of HIPAA can result in criminal penalties under 42 USC § 1320d-6, including fines of up to $250,000 and imprisonment of up to 10 years for offenses committed with intent to sell or use PHI for commercial advantage, personal gain, or malicious harm.
Reputational damage: HIPAA breach notifications (required under 45 CFR §§ 164.404–164.408) can result in significant reputational harm, particularly for breaches affecting 500 or more individuals, which are publicly posted on the OCR breach portal.
Professional Licensing Risks
Washington's Department of Health may investigate complaints related to recording patients without consent. Depending on the circumstances, a provider could face disciplinary action under the Uniform Disciplinary Act (RCW 18.130), including license suspension or revocation.
Implementation Checklist
Use this checklist to ensure your practice is compliant when deploying AI scribing in Washington:
☐ Confirm your AI scribe vendor will sign a HIPAA-compliant Business Associate Agreement (BAA).
☐ Verify the vendor uses end-to-end encryption (TLS 1.2+ in transit; AES-256 at rest) and does not retain audio longer than necessary for processing.
☐ Create a patient consent form specific to AI scribing that complies with RCW 9.73.030's all-party consent requirement. Include plain-language descriptions of data capture, storage, and use.
☐ Update your Notice of Privacy Practices (NPP) to disclose the use of AI scribing technology.
☐ Train clinical and administrative staff on consent procedures, including how to handle patient refusals and how to document consent in the EHR.
☐ Establish a workflow to obtain consent before activating the AI scribe in every encounter — in-person and telehealth.
☐ Implement a process for multi-party telehealth sessions to ensure all participants consent before recording begins.
☐ Create a refusal protocol so providers can seamlessly continue care without AI scribing when a patient declines.
☐ Set a periodic review schedule (at least annually) to reaffirm patient consent and review vendor compliance.
☐ Consult with a healthcare attorney licensed in Washington to review your consent forms, policies, and vendor agreements before deployment.
This guide is for informational purposes only and does not constitute legal advice. Healthcare providers should consult with a qualified attorney licensed in Washington State to address their specific compliance needs. Laws and regulations are subject to change; verify all citations against current statutes.
