HIPAA Meeting Recording Policy: Recordings, Transcripts, AI Notes

A HIPAA meeting recording policy should treat every recording, transcript, AI summary, and meeting chat log that discusses a patient as protected health information (PHI) until someone with authority decides otherwise. HIPAA does not ban recording meetings. It governs what happens to the files afterward: who can open them, where copies land, how long they stay, and whether a patient can request them.

Write the policy around the files a meeting produces, not the meeting itself. A ten-minute case review can leave behind a cloud video, an auto-generated transcript, an AI summary emailed to every attendee, and a chat log with a patient’s name in it.

When does a meeting recording contain PHI?

PHI is individually identifiable health information transmitted or maintained in any form or medium, with limited exclusions. See the definitions in 45 CFR 160.103. A recording does not need to show a chart to qualify. A clinician saying a patient’s name and diagnosis out loud is enough.

Common meetings that produce PHI:

• Telehealth visits and patient intake calls
• Case conferences, care coordination huddles, and utilization reviews
• Billing or claims meetings that discuss specific accounts
• Vendor support calls where someone screen-shares a patient record

AI note-takers deserve the same treatment. A summary that lists “follow up with J. Rivera about the A1C result” contains PHI even if the full recording is deleted.

Is a meeting recording part of the designated record set?

It depends on how the organization uses it. The HIPAA Privacy Rule defines the designated record set as medical and billing records maintained by or for a provider, certain health plan record systems, and any records “used, in whole or in part, by or for the covered entity to make decisions about individuals.” See 45 CFR 164.501.

A recorded telehealth visit that a clinician relies on to document care may fall into that set. A recorded staff training that happens to mention a patient probably serves a different purpose, though it still contains PHI that must be protected.

Covered entities must document which designated record sets are subject to patient access. See 45 CFR 164.524(e). Suggested step: add each meeting type to that documentation with a yes, no, or “decided case by case” answer, and name who decides.

Can you record telehealth meetings under HIPAA?

Yes, if the recording is protected like any other ePHI. The COVID-19 telehealth enforcement discretion, which let providers use some video tools without a business associate agreement (BAA), expired on May 11, 2023, followed by a 90-day transition period that ended August 9, 2023. See the HHS announcement on the expiration.

HHS audio-only telehealth guidance lists “technologies that electronically record or transcribe a telehealth session” among the communication technologies subject to the Security Rule. See HHS guidance on remote communication technologies. The HHS telehealth site also directs providers to use vendors that will enter into BAAs. See HIPAA rules for telehealth technology.

HHS cloud guidance adds that a cloud service storing ePHI is a business associate even when it holds only encrypted data and lacks the key. See HHS guidance on HIPAA and cloud computing. For what to ask before signing, use the BAA questions for cloud vendors.

Check the AI add-on separately. Transcription and summary features may run on a different service or subprocessor than the video platform. Ask the vendor in writing whether the BAA covers recording, transcription, AI summaries, and any connected note-taker apps.

Where do copies of a recorded meeting land?

Most recording risk comes from copies nobody planned for. Run one test meeting with fictional patient details, then look for every artifact it left behind.

Add each confirmed location to your ePHI inventory. Treat shared recordings like any other shared file and apply the same tests from the HIPAA file-sharing review.

Who should be able to open a recording?

The Security Rule’s technical safeguards require access controls that limit ePHI to people and software granted access, unique user identification, audit controls, and person or entity authentication. Encryption and automatic logoff are addressable specifications. See 45 CFR 164.312.

Suggested steps for recordings:

• Assign each recording to a role or team owner, not only the person who clicked record.
• Require sign-in to view. Disable public or “anyone with the link” sharing for meetings that may contain PHI.
• Confirm that views, downloads, and deletions appear in an audit log you can export.
• Remove access as part of employee offboarding, including recordings stored in a departing host’s personal account.

How long should meeting recordings be kept?

HIPAA does not set a single retention period for recordings. A recording that belongs in the medical record follows the applicable medical-record schedule, which state law generally governs. Policies and required documentation follow the Security Rule’s six-year rule in 45 CFR 164.316(b)(2). See HIPAA retention requirements for how to separate those categories.

Many routine recordings have no reason to exist after the meeting summary is filed. A short default retention for operational recordings, with longer schedules only for categories the records owner approves, keeps fewer copies in circulation. Confirm that deletion also removes transcripts, AI notes, and downloaded copies, and that a legal hold can override automatic deletion.

How do patient access requests reach recordings?

Individuals have a right to inspect and obtain a copy of PHI about them in a designated record set, for as long as it is maintained there. A covered entity must act on a request within 30 days, with one possible 30-day extension. If the individual asks for an electronic copy, the entity must provide it in the requested form and format if readily producible. See 45 CFR 164.524.

If recordings are in the designated record set, staff handling access requests need to know where to find them and how to export one patient’s portion. Business associates should check their BAAs: the Privacy Rule requires BAAs to obligate the business associate to make PHI available for access requests. See 45 CFR 164.504(e)(2)(ii)(E).

Do state recording-consent laws apply?

Yes, separately from HIPAA. Federal law generally permits recording when one party to the conversation consents. See 18 U.S.C. 2511(2)(d). Some states require the consent of every party, and participants in a single video call may sit in different states.

This is not legal advice. Ask counsel which laws apply to your patients, staff, and locations, then build the answer into your scripts: a spoken notice at the start, a visible recording indicator, and a documented way for a patient to decline.

Sample HIPAA meeting recording policy outline

Adapt this outline with your privacy officer, security lead, and counsel.

If your recordings, transcripts, and AI notes currently live in different services with different owners, request a healthcare pilot for your meeting recording workflow. IRONKEEP MEETINGS writes cloud recordings to encrypted, tenant-scoped storage, screens meeting chat with sensitive data rules, audits meeting actions, and applies retention and legal hold. It does not offer transcription. The workspace is in private beta, and IRONKEEP signs a BAA during onboarding when it will handle ePHI.

Next step

Pick one recurring meeting that discusses patients. Record a test session with fictional details, find every copy it creates, and fill in the outline above for that meeting type first.

Keep the test results with the policy and record who approved each setting. Repeat the exercise when you add a meeting tool, turn on an AI feature, or change retention settings.