Who has to agree before you press record

A BCBA is about to start a telehealth supervision call. The RBT is in the client’s living room, a grandparent is on the couch within earshot, and the parent is in the next room on her own phone, half listening in. Everyone knows the session is being recorded for supervision review. Does everyone have to agree to that first, and does it matter that three different people, possibly in two different states, are all part of the conversation at once?

HIPAA does not answer that question. State law does, and it answers it differently depending on where each person is.

The federal floor

Federal law sets a baseline rule for intercepting a wire, oral, or electronic communication: it is lawful if the person doing the recording is a party to the conversation, or if one of the parties has given prior consent, unless the recording is made to commit a crime or a civil wrong. That is a one-party consent rule, and it is a floor, not a ceiling. A state is free to require more than one party’s consent. It cannot require less, because the federal rule is the minimum that applies everywhere.

Where states diverge

Among the states verified so far, two patterns show up repeatedly.

One-party consent. A participant in the conversation, or someone that participant has authorized, can lawfully record it without telling anyone else. A supervisor who is herself on the call does not need separate permission to record her own supervision session. Most of the verified states fall here.

All-party consent. Every participant has to agree before anyone records. A handful of verified states take this position, and for a clinic, the practical effect is the same no matter which of them a client happens to be in: get the agreement in writing before the device is on, not after.

Three verified states resist either label. Connecticut’s criminal eavesdropping statute barely restricts a participant at all, but a separate civil statute requires all-party consent, specific recorded notice, or an audible warning tone, for telephone calls specifically. Montana does not ask for consent in the usual sense; it prohibits only a hidden recording made without any party’s knowledge, so one party announcing that the call is being recorded is enough to make it lawful for either side to record. Delaware has two statutes that answer the question differently: its wiretapping chapter sets a one-party rule, but a separate, older privacy statute requires all parties’ consent to intercept a private conversation and separately restricts installing a recording device, audio or video, in a private place like a home. None of these three is accurately described as simply one-party or all-party, which is why the table below gives each of them its own note rather than forcing a label that does not fit.

Audio and video are not the same question

The wiretapping or eavesdropping statute checked for each state below is, in nearly every case, written around a conversation, communication, or interception of speech. That specific statute is audio-scoped, and a device that captures video with no audio is often not clearly covered by it. That is a gap in that one statute, not a finding that video recording is unrestricted in that state: a state can reach video or in-home recording through a separate law that was not written as a wiretapping statute at all, and Delaware is a documented example of exactly that, covered in its note below. This article checked each state’s primary wiretapping or eavesdropping statute; it did not systematically check every state for a separate privacy-in-a-private-place statute the way it did for Delaware, so the audio-only description in the table is a statement about the statute cited for that state, not a conclusion that no other state law could reach video.

A few verified states complicate this further in their own right. Kansas has a separate statute aimed specifically at secretly filming someone under their clothing or while nude, which is a narrow video-specific crime that has nothing to do with ordinary supervision recording one way or the other. California’s statute covers a confidential communication captured by a recording device, language that is built around audio and leaves video-only capture in an unclear position. Neither of these fills the general gap; they just show that a state’s silence on video in its wiretapping statute is not the same as silence across all of that state’s law.

What HIPAA adds once the recording exists

Assume the recording is lawfully made. HIPAA now treats it the way it treats any other clinical material: it is protected health information, the most identifiable kind a clinic produces, because a recording carries a face and a voice rather than a data point. A separate article in this cluster covers where that recording has to live, who can store it, and how long to keep it; this page will not repeat that ground.

What belongs here instead is the access question. HIPAA’s minimum necessary standard requires a covered entity to limit use of protected health information to what a given purpose actually needs, and to identify which workforce members need access to which category of information for their role. Applied to a session recording, that means a BCBA reviewing a recording for supervision should generally have access to her own supervisees’ recordings, not the full caseload, and the access should be tied to the supervision purpose, not left open-ended because the file happens to exist.

There is also a quieter question: is the recording part of the client’s designated record set? HIPAA defines that set by use, not by file type. A recording that the clinic actually uses to make decisions about the client, for treatment planning, for example, functions as part of the record and carries the access and retention obligations that come with it. A recording made only for a passing supervision check and never referenced again sits in a greyer area. This is a fact-specific question for each clinic’s own practice, not one this page can answer categorically. Treat it as a question for counsel, the same way the rest of this cluster treats anything that turns on how a specific file is actually used.

Because it crosses state lines without anyone deciding that

A telehealth session can put a clinician in one state, a client’s home in another, and a remote reviewer in a third, all on the same call. Which state’s consent-to-record rule governs a call like that is not a settled question, and courts that have ruled on it do not all agree with each other. What is reasonably clear is the direction of the risk: a stricter state’s rule, typically an all-party consent requirement, may apply because one participant was physically there, even if the clinic itself is based in a one-party state and never intended that state’s law to reach it. A clinic operating in several states cannot adopt one recording-consent policy and assume it is safe everywhere; it needs a policy that accounts for the possibility that the most protective state in the call controls, the same way the hub article for this cluster describes for breach notice and minor consent. Confirm with counsel, for every state a participant might be in, how that state’s courts actually treat a multi-state call, rather than assuming either the clinic’s home state or a single state’s law automatically applies.

State consent rules, verified so far

This table covers only the states verified from a primary source so far. A blank row does not mean the state has no rule. It means the rule has not been checked yet, and it should be treated as an open question, not assumed to match a neighboring state or the federal floor.

“The question is not whether the session was worth recording. It is whether everyone in the room, or on the call, had already agreed to it.”

Notes on specific states

Connecticut. The criminal eavesdropping statute only restricts someone who is not a party to the call and not present for it; a participant recording their own conversation is not reached by it at all. A separate civil statute requires all-party consent for recording a telephone call specifically, or in place of consent, a recorded verbal notice at the start of the call or an audible tone repeated throughout it. That civil rule does not extend to in-person conversations. A clinic recording a phone or telehealth call with a Connecticut participant should treat it as effectively all-party; an in-person Connecticut session is a different, less restricted question.

Delaware. The wiretapping chapter (11 Del. C. § 2402) sets a one-party consent rule for intercepting a wire, oral, or electronic communication. A separate, older statute in the same title, the violation of privacy section (11 Del. C. § 1335), also reaches recording, with different and in places stricter terms: it makes it unlawful to intercept a private conversation without the consent of all parties, and separately, to install in a private place, which includes a home, a device that observes, photographs, or records sounds or events there without the consent of the person or persons entitled to privacy in that place, or to use outside a private place a device that records sounds originating inside it without that same consent. Unlike the wiretapping chapter, those two private-place provisions are not limited to audio; a device used for observing or recording events, not just sound, is covered, which reaches video capture in a home directly. The text of neither statute says which one controls, or whether both apply to the same conduct at once. A clinic recording inside a Delaware home should treat this as an open question for counsel, not rely on the one-party answer from the wiretapping chapter alone.

Montana. This is a notice requirement, not a consent requirement in the usual sense. The statute only prohibits a hidden device recording a conversation without the knowledge of every party. Once one person discloses that the call is being recorded, either side may record it. A clinic operating in Montana should still disclose recording openly as a matter of practice, but the legal trigger is knowledge, not an affirmative yes from everyone.

South Carolina and Virginia. Both states’ statutes make it lawful for an ordinary citizen to intercept a communication where they are a party, or where one party has consented, without repeating the limit found in most other states checked, that the recording cannot be made to commit a crime or a civil wrong. That absence does not mean anything is actually permitted in either state that would otherwise be illegal; it is a textual difference worth knowing rather than assuming the usual federal-style carve-out applies.

Vermont. No wiretapping or eavesdropping statute was found in the Vermont Statutes as of October 2026. The state’s own official full-text statute search returned no results for either term, and the only interception-related statute located restricts law enforcement’s real-time location tracking, not private recording. This is an absence in the statutes checked, not a finding that recording is unrestricted in Vermont: the state could still regulate recording through a statute this search did not surface, through case law, or through a civil tort theory, none of which were verified from a primary source here. A commonly repeated explanation is that Vermont case law treats a participant’s recording as unrestricted in the absence of a statute; that case was not fetched from a primary source for this batch, so it is not stated here as settled. Do not treat the absence of a statute as permission to record. Confirm the current rule with counsel before recording a Vermont participant.

Kansas. Alongside its general one-party interception rule, Kansas has a separate, narrow statute criminalizing secretly filming someone under their clothing or while nude or partly undressed. That statute addresses a specific voyeurism scenario and has no bearing on ordinary video supervision recording.

California. The statute reaches a confidential communication captured by an amplifying or recording device, language built around audio. Whether video captured with no accompanying audio falls under this section at all was not resolved from the text itself; a clinic should not assume video-only recording is either covered or exempt in California without asking counsel directly.

Iowa. A separate exemption covers digital video or audio devices placed outside a dwelling for security purposes. That exemption is scoped to outdoor home-security use and does not extend to a clinic’s in-session recording.

What a clinic should have in writing

The written consent itself needs to answer the question the state’s rule actually asks, not a generic version of it. In a one-party state, the clinic’s own staff member being on the call is enough to make recording lawful, but getting a parent’s or client’s written agreement anyway is still good practice and is often required by other parts of a clinic’s own policy or payer agreements. In an all-party state, or in Connecticut on a phone call, every participant who will be audible or visible in the recording, not just the client’s parent, has to agree before the device is on. That can include a grandparent in the next room or a second clinician joining a supervision call.

What the form should say, at minimum: what is being recorded (audio, video, or both), the specific purpose (supervision review, treatment documentation, training), who will have access, how long it will be kept, and how someone can withdraw consent going forward. Where the recording is stored once it exists, and how it is kept out of a personal phone or a consumer cloud account, is covered in the storage article; this page is only about who has to agree and when.

Refusal needs a real answer, not a workaround. If a required participant in an all-party state declines, that session cannot lawfully be recorded as planned, and the honest options are limited: take notes instead, reschedule for a session where the person who declined is not present, or ask whether a different, non-recorded form of supervision review will do. Muting the camera but leaving audio running, or recording anyway and hoping no one asks, are not alternatives. This is exactly the kind of judgment call that belongs in a written policy agreed with counsel before the first refusal happens in the field, not improvised by an RBT in a client’s living room.

None of this is legal advice, and nothing here is a compliance guarantee. State recording-consent law is unsettled in parts and changes by statute and by court decision. Confirm the current rule, for every state a clinic serves, with a lawyer licensed there.