State-by-State Telehealth Privacy Laws

Telehealth privacy is governed by a patchwork of federal law (HIPAA), state medical practice law, state-specific telehealth regulations, and recording consent statutes. An AI scribe used in telehealth is subject to all of them.

The good news: most states have no special restrictions on AI-generated notes. The catch: a few states have specific telehealth privacy requirements that affect how you capture and process audio.

Federal baseline: HIPAA

HIPAA applies to all telehealth regardless of state. It requires:

Encryption of data in transit and at rest.
Business Associate Agreements with vendors processing patient data.
Audit logging of all access.
Patient rights to access and request correction of their records.

If you use an AI scribe, the vendor must sign a HIPAA BAA with you. Scriber does this at signup.

Everything below assumes HIPAA compliance is in place.

Recording consent laws by state

The biggest variable state-to-state is recording consent. Do you need the patient's explicit consent to record a telehealth visit?

The answer depends on whether your state is:

All-party consent state: Patient consent required to record.
One-party consent state: Only the clinician (or someone on the call) needs to consent.

See Recording consent laws by state for the full state-by-state breakdown. For AI scribes, the principle is simple: if recording is required to be disclosed to the patient, then AI processing of that recording must also be disclosed.

State-specific telehealth privacy laws

Most states piggyback on HIPAA and have no separate telehealth-specific privacy law. A few states have added restrictions worth noting:

States with specific telehealth data residency or encryption requirements

California

Telehealth providers must use encrypted, secure platforms.
Patient data must be stored in compliance with CCPA (California Consumer Privacy Act) if the patient is California-resident.
CCPA gives patients the right to know what data is collected and how it is used — be transparent about AI processing.
AI scribe implication: Scriber's AES-256 encryption and HIPAA BAA satisfy California requirements. If processing California residents' data, Scriber's privacy practices should be disclosed in your privacy notice.

Texas

Telehealth must use platforms with encryption and access controls.
No specific AI-restriction, but clinician must be licensed in Texas.
AI scribe implication: No additional concern. Use encrypted platform (Doxy.me or similar), use Scriber with BAA in place.

Florida

Telehealth platform must be HIPAA-compliant.
No specific AI restriction.
AI scribe implication: Standard HIPAA compliance applies.

New York

Telehealth platform must be HIPAA-compliant and meet New York State Department of Health requirements.
No specific AI-restriction.
AI scribe implication: Use HIPAA-compliant platform and AI scribe with BAA.

States with specific platform or vendor restrictions

Illinois

No specific state restriction on telehealth platforms or AI.
All-party recording consent state (see recording consent laws).

Virginia

No specific state restriction on telehealth platforms or AI.
Recording consent is more permissive (one-party consent).

Washington

No specific state restriction on telehealth platforms or AI.
All-party recording consent state (see recording consent laws).

Important note: Cross-state and cross-border telehealth

If you are a clinician treating patients across multiple states, you must comply with:

The state where you are licensed. If you are licensed in Oregon and treating an Oregon patient, Oregon law applies.
The state where the patient is located. Some states apply their own laws to patients in their state, regardless of the clinician's licensure.
HIPAA federal baseline. All of it.

If you are treating a Texas patient from a California practice:

You must be licensed in Texas (or comply with Texas telemedicine reciprocity rules).
Texas telehealth privacy laws apply.
HIPAA applies.
Recording consent may differ (Texas is one-party consent; California is generally one-party consent with exceptions).

AI scribe implication: Scriber's encryption and BAA satisfy all states. Your responsibility is to disclose the AI process to patients and comply with recording consent laws in each state.

Disclosures to the patient about AI use

Many states do not explicitly require you to disclose that you use AI, but best practice (and transparency) suggest you should:

In your privacy notice: "We use AI-assisted documentation tools to generate clinical notes from visit recordings. These tools are HIPAA-compliant and covered under a Business Associate Agreement. The AI generates a draft note, which is reviewed and signed by the treating clinician."

At the start of the telehealth visit: "I'll be using an AI transcription tool to help generate your clinical note. The audio will be recorded, the note will be reviewed by me, and the recording will be deleted. You can decline if you prefer I take notes manually."

This is transparent, reassuring, and demonstrates your compliance posture.

Data residency and international patients

If you ever treat a patient outside the US (or a non-US citizen), be aware:

HIPAA applies if the patient is a US-based patient, regardless of citizenship.
GDPR and other regulations apply if the patient is EU-based, even if you are US-based. Processing EU patients' data requires specific caution.
Data residency laws may require patient data stay in certain geographies.

Scriber processes data on Microsoft Azure US data centers. For EU patients, you may need alternative arrangements. For most US-based practices, Azure US infrastructure is appropriate.

Licensing and clinician requirements

Telehealth clinician licensure is a separate (but important) issue from AI scribe compliance:

You must be licensed in the state where the patient is located (or have a reciprocal arrangement).
Telehealth does not change your licensing requirement or scope of practice.
AI scribes do not change your licensing requirement.

This is not a privacy issue per se, but it is part of the legal framework for telehealth. Make sure you are licensed in all the states where you are treating patients.

Practical checklist for telehealth + AI scribe compliance

Here is what you need in place:

Before you start using an AI scribe for telehealth:

Confirm recording consent laws in your state and patient states. (See Recording consent laws by state.)
Review your telehealth platform's encryption and HIPAA compliance. (Doxy.me, Zoom HIPAA, Google Meet for Healthcare are all HIPAA-compliant.)
Ensure the AI scribe vendor has a signed BAA. (Scriber does at signup.)
Update your privacy notice to disclose AI use.
At the start of each telehealth visit, inform the patient about recording and AI processing. (Can be verbal or documented in the note.)
If the patient declines AI recording, have a manual documentation process ready.

After you deploy:

Monitor state law changes. Telehealth law evolves quickly.
Train staff on your specific state requirements. A clinician in New York may have different recording consent requirements than a clinician in California.
Keep audit logs and compliance documentation. If a state board or HIPAA investigator asks, show that you have a compliant process in place.

Bottom line

Telehealth + AI scribes are legal and compliant in all 50 states as long as you:

Comply with HIPAA (encryption, BAA, audit logging).
Comply with state recording consent laws.
Are licensed in the state(s) where you treat patients.
Disclose AI use to patients.

Scriber handles requirement 1 (HIPAA compliance). You handle 2-4 (state law, licensing, disclosure). If you cover those bases, your telehealth AI scribe workflow is legally sound.

State-by-State Telehealth Privacy Laws | Scriber Wiki