Telehealth recording privacy: the platform isn't the only risk
A client logs off the video call, you close the telehealth window, and the session feels over. But the question of telehealth recording privacy doesn’t stop at the platform you used for the call. The video software is only one layer. If you recorded the session, or used a scribe, or jotted notes into a tool, each of those is a separate decision about where a client’s words travel and who can read them. Treating “is the platform HIPAA-eligible?” as the whole answer is how clinicians end up with a privacy gap they never chose.
The useful move is to stop thinking about “my telehealth setup” as one thing and start seeing it as a stack of independent layers, each with its own data path, vendor, and risk.
The three layers most people collapse into one
A remote session actually involves at least three distinct systems, and they rarely come from the same vendor:
- The video platform carries the live conversation: audio and video, in real time, between you and the client.
- The recording or scribe layer captures the session for documentation: a screen recording, an audio file, or an AI scribe listening to produce a transcript or note draft.
- The storage and notes layer is where the finished documentation lives: your EHR, a notes app, a folder, a cloud drive.
Each layer can be private or leaky independently. A platform with a signed Business Associate Agreement (BAA) that routes your recording through a third-party transcription service has quietly handed the most sensitive artifact — a verbatim record of a therapy hour — to a vendor you may never have evaluated. Conversely, you can hold a session on a perfectly ordinary video tool and still document it in a way that never leaves your own machine. The layers are separable. That is the whole point.
Why telehealth recording privacy lives in the recording layer
The live video stream is transient. The recording is durable, and it is the richest possible record: tone, pauses, exact words, sometimes a client’s face. If you use any AI scribe or transcription service, ask a blunt question before anything else — does the audio leave the device?
Most cloud scribes work by uploading audio (or a transcript) to a server to do the heavy processing, then sending text back. That upload is the moment the data leaves your control, regardless of how strong the encryption-in-transit is. A BAA governs what the vendor is contractually allowed to do; it does not change the fact that the recording now exists on someone else’s infrastructure, subject to their breaches, subpoenas, retention defaults, and model-training policies.
On-device processing changes the question entirely. If transcription and the note draft are generated locally, there is no upload to govern, no retention policy to read, no breach surface beyond your own laptop. That is the design choice behind CouchNotes: a remote session can be captured and documented on your Mac without the audio or transcript ever traveling to a server. The clinical question shifts from “do I trust this vendor with the recording?” to “is the recording ever leaving my device at all?”
It is also worth deciding whether you need a recording at all. Dictating a structured summary right after the session produces less sensitive data than capturing the full audio — a tradeoff worth weighing deliberately, which we cover in dictation vs. recording for therapy sessions.
Questions to ask of each layer
You can audit your own stack in a few minutes. For each layer, ask the same core questions and notice where the answers differ:
| Layer | Key question | Red flag |
|---|---|---|
| Video platform | Is there a signed BAA, and is recording on or off by default? | Recording silently saved to vendor cloud |
| Recording / scribe | Does audio or transcript leave the device? | ”Encrypted upload” framed as if it means local |
| Storage / notes | Where does the final note live, and who can access it? | Notes synced to a personal consumer cloud |
A few specifics worth pressing on:
- Default settings. Many platforms default recording to the cloud. “Off unless I turn it on” is safer than “on unless I find the toggle.”
- Sub-processors. A vendor with a BAA may still route your data through transcription or analytics sub-processors. Ask for the list.
- Retention and deletion. Can you set audio to auto-delete after you finalize the note? Who can recover it after that?
- Training. Confirm in writing that your sessions are not used to train models. Vague language here is a no.
The clinician is still the author
Whatever the layer, one thing does not change: the documentation is yours. An AI scribe produces a draft — a starting point you read, correct, and sign. It is not the clinician, and a note is not finished because software generated text. Reviewing the draft against your own memory of the session is both a quality step and a privacy step, because it is the moment you decide what actually belongs in the record.
Framing the record this way also keeps “HIPAA compliant” in its proper place. Compliance is necessary, not sufficient. A signed BAA tells you a vendor accepts certain legal obligations; it tells you nothing about whether the most sensitive artifact of the session ever needed to leave your office in the first place. On-device documentation makes the safer answer the default rather than something you negotiate contract by contract.
If you want to see what a privately documented remote session looks like in practice, our telehealth SOAP note examples walk through drafts built from a session that never left the clinician’s device.
Rules on recording consent, retention, and what counts as part of the legal record vary by state, board, and payer, and none of this is legal advice, so confirm the specifics with your own board or attorney before you change your workflow. But the underlying habit travels everywhere: stop asking whether your telehealth is private and start asking which layer you mean. Map the three layers, find the one where the recording lives, and you will usually find that the platform was never the riskiest part of the call.