Recording therapy sessions: privacy questions to answer first

Before recording, a therapist needs answers to four questions: has the client genuinely agreed, what does my professional code say, which data protection or health privacy law applies, and where will every copy of the session go?

This guide goes through those questions. It makes no clinical claims and does not tell you whether recording is good practice for your clients; that is your judgement.

Start with why you want the recording

The purpose drives everything else: what you tell the client, how long you keep it, and who can see it. Common reasons are:

• Writing accurate notes after the session instead of during it.
• Supervision or training, where a supervisor listens to the session.
• The client's own use, such as listening back to a session.
• Research, which usually needs ethics approval and a separate consent process.

Each is a different purpose, and consent for one does not cover the others. A client who agreed to a recording "so I can write my notes" has not agreed to it being played to a training group.

If your purpose is only better notes, ask whether a transcript is needed at all or whether notes written straight after the session would do. Every recording is a new copy of highly sensitive data that has to be protected and eventually destroyed.

Consent from the client

Most professional codes treat recording as something the client must agree to in advance. For psychologists in the US, the APA's Ethics Code, standard 4.03, says that before recording the voices or images of people they provide services to, psychologists obtain permission from all such persons or their legal representatives. Counselling, social work and psychotherapy bodies elsewhere have their own wording; check the current code of the body you are registered with.

Good consent for a session recording usually covers:

• what will be recorded (audio only, or a transcript too);
• why, and for which purpose only;
• where it is stored and which services, if any, receive it;
• how long it is kept, and when it is deleted;
• that the client can say no, and can change their mind later, without affecting their care;
• who else could hear or read it, such as a supervisor.

Get it in writing before the first recorded session and confirm it out loud at the start of each one. In couples, family and group work, everyone present needs to agree. How to ask for consent to record has wording you can adapt.

Recording law is a separate layer. In places that require everyone's agreement to record a conversation, the client's consent also satisfies that rule; see is it legal to record a meeting? for how those rules work.

Health data law

In the US: HIPAA

If you are a HIPAA covered entity, a session recording and its transcript are protected health information. Any service that receives, stores or transmits them for you is usually a business associate that needs a business associate agreement. AI notetakers and HIPAA covers what that means for each kind of tool.

HIPAA also has a special category called psychotherapy notes. 45 CFR 164.501 defines them as notes recorded by a mental health professional documenting or analysing the contents of a counselling session, kept separate from the rest of the medical record, and excluding things like medication, session times, diagnosis and progress summaries. They get extra protection, including limits on the client's right of access. Whether a recording or transcript falls into that category, or into the ordinary record, depends on how you keep it. Ask your compliance adviser rather than assuming.

In the UK and EU: GDPR

Information about someone's mental health is special category data under Article 9 of the GDPR and the UK GDPR. Processing it needs both a lawful basis under Article 6 and a condition under Article 9, and it raises the bar on security, retention and transparency. For a practice that records sessions as a matter of routine, a data protection impact assessment may be required. Recording meetings under GDPR goes through each step.

Where the session goes

This is the question tools answer very differently. For each recorded session, list every place a copy could end up:

• The recording — on your computer, on a vendor's server, on a video platform?
• The transcript — produced on your device, or by a cloud speech service?
• AI-written notes — which AI service reads the transcript, under what agreement, and does it keep or train on it?
• Backups — is your computer backed up, and where to?
• Email and messaging — do summaries get emailed to you, or pasted into another system?

A notetaker that joins the call as a participant, or uploads the audio to be transcribed, puts the whole session on a vendor's servers. A tool that transcribes on the device keeps the audio on your computer, which removes one vendor but makes that computer's security your responsibility: disk encryption, a strong login password, screen lock, and no shared user accounts.

Two things should usually never leave the device, whatever tool you use: the raw audio of a session, and any voice recognition data about the client. A voiceprint is biometric data; recognising voices across meetings explains why that needs its own decision.

AI notes need a clinician's review

AI summaries can misattribute a statement, turn a hypothetical into a fact, or drop a disclosure that matters. In therapy those are not small errors. If you use AI to draft a note, treat it as a draft: read it against the transcript or your memory of the session, correct it, and only then put it in the record. Keep the label that says the AI wrote it until you have.

How Notey fits into this

Notey makes no HIPAA or other compliance claim and is not approved for clinical use by any professional body. What it does:

• The audio is recorded to your Mac and transcribed there by Apple's on-device speech recognition. No transcription service receives it.
• With no account, nothing about a session leaves the Mac. Recording, transcription and search need no network.
• AI notes send transcript text only when you ask, or when a meeting ends with automatic write-ups turned on. The text goes to Notey's service and on to OpenAI as a processor, which does not train on it; Notey does not keep it. If a session transcript should not go to any outside service, leave AI notes off.
• Voice recognition is off by default. If you never switch it on, no voiceprint of the client is made.
• Sync between your own Macs is optional and encrypted on the Mac with a key only your Macs hold. Recordings stay on the Mac that made them and are never uploaded, not even encrypted.
• Deleting a meeting removes the recording, transcript and notes, from every one of your Macs if sync is on, which makes a retention rule practical to follow.
• The red dot and timer show you when audio is being kept. The client does not see them, which is why the consent conversation has to happen out loud.

A checklist before the first recorded session

1. Write down the purpose, and keep the recording to that purpose.
2. Check your professional body's current code on recording.
3. Get written, specific consent, and confirm it at the start of each session.
4. Confirm which health data law applies, and whether a DPIA or BAA is needed.
5. List every place the recording, transcript and notes will go.
6. Set a retention period and a date to delete the recording.
7. Review every AI-drafted note before it enters the record.

Frequently asked questions

Can a therapist record a session?

In many places, yes, with the client's informed agreement, a clear purpose and proper safeguards. Professional codes add their own requirements; the APA's Ethics Code, for example, requires psychologists to get permission before recording the people they serve. Check your own licensing body's code and your local law.

Should a client be able to say no?

Yes. Consent that the client cannot refuse without losing the service is weak consent under most ethics codes and under data protection law. Offer the session unrecorded and mean it.

Is a session transcript a psychotherapy note under HIPAA?

Not automatically. HIPAA's psychotherapy notes category has a specific definition, including being kept separate from the rest of the record. How a transcript is treated is a question for your compliance adviser.

Is it safe to use AI to write therapy notes?

That depends on where the session text goes, what agreements you have with those services, and whether you check every word before it enters the record. The AI does not know the client; you do.