# Recording Policy — Client Communications (v1.0 — verified 2026-05-02) **Status:** DRAFT. Statutory references verified against Perplexity Sonar Deep Research 2026-05-02. **Lawyer review still required before client use.** --- ## Why this matters Kelly's recording was the pivot in the Erin welfare check — police were about to leave without acting until Kelly produced evidence of Erin's escalating threats. Without the recording, the welfare check would have failed and Erin would not have been on the 72-hour psych hold by morning. **But:** in 12 US jurisdictions, recording without all-party consent is a criminal offense (felony in some states). Avina cannot operate the same way Kelly operated with Erin in every state — the recording legality is jurisdiction-specific. This policy defines the operating rules so case managers never have to make a real-time judgement call. --- ## Federal baseline **18 USC §2511** establishes one-party consent at the federal level: a person who is a party to a conversation may record without other parties' consent **unless** state law is stricter. Federal law sets a floor; states can stack additional restrictions. Recording for unlawful purposes (extortion, blackmail, harassment) is illegal everywhere regardless. --- ## US state-by-state matrix (verified 2025-2026 statutes) ### One-party consent (38 states + DC) — case manager who is party to the conversation may record without notifying other party Alabama, Alaska, Arizona, Arkansas, Colorado, **DC**, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Mississippi, Missouri, Nebraska, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming. (Plus: South Dakota, with a participant-exception nuance — same effective outcome.) **Operating rule in these states:** Kelly may record any conversation she is part of, without telling the client in advance. Best-practice ethical default is still to disclose, because professional licensing boards treat secret recording by a provider as grounds for license discipline regardless of legality. ### All-party (two-party) consent — recording without explicit consent of every participant is criminal | State | Statute | Penalty | Notes | |---|---|---|---| | **California** | Penal Code §632, §632.5 | $2,500/violation, up to 1 yr jail; $10K for repeat | Most aggressive enforcement. Applies to confidential communications including face-to-face. AB 2905 (eff 2025) adds AI-voice disclosure requirement. | | **Connecticut** | CGS §53a-187 (telephone), §52-570d (civil) | Criminal + civil + attorney fees | **Telephone calls only** require all-party. In-person conversations = one-party (different statute). | | **Delaware** | 11 Del. C. §1335(a)(4) | Criminal | All-party consent for all communications | | **Florida** | Fla. Stat. §934.03 | Felony, fines, civil damages | Carve-out: minors recording disclosures of abuse/violence may use without consent | | **Illinois** | 720 ILCS 5/14-2 | Class 4 felony minimum | **HB 1806 (eff 2025):** AI transcription requires SEPARATE written consent — general intake consent is insufficient. | | **Maryland** | MD Cts & Jud Pro §10-402 | Felony, $10K, up to 5 yrs | Strict; even public-place private conversations protected | | **Massachusetts** | MGL c.272 §99 | Up to $10K, 5 yrs prison | Also prohibits editing/altering recordings before judicial use | | **Michigan** | MCL §750.539c | Felony | **Participant exception** — recording your own conversation = effectively one-party. Recording conversations between OTHERS still needs all-party. | | **Montana** | MCA §45-8-213 | Criminal | **Notification suffices** — verbal warning + continued participation = implied consent. Effective one-party with disclosure. | | **Nevada** | NRS §200.650 + *Lane v. Allstate* | Criminal | **Statute reads one-party but Nevada Supreme Court held all-party for telephone calls.** Treat as all-party. | | **New Hampshire** | RSA 570-A | Class B felony | One of the strictest in the nation | | **Pennsylvania** | 18 Pa. C.S. §5702 et seq. | Felony | Strict; no professional carve-out for treatment providers | | **Washington** | RCW 9.73.030 | Criminal | Exceptions for emergency communications (fires, threats, hostage situations); journalists with consent | ### Mixed-consent states — distinct rules per medium - **Connecticut** — telephone all-party / in-person one-party (see above) - **Hawaii** — HRS §803-42 one-party for telephone & electronic; **HRS §711-1110.9 all-party for recording in private places** (clinical office sessions). Case manager office sessions = all-party. - **Oregon** — ORS §165.450 **in-person all-party / electronic one-party**. Telehealth call = one-party; in-person session = all-party. - **Michigan** — participant exception (above) — effectively one-party for case manager's own conversations - **Nevada** — statute one-party but courts have held all-party --- ## The choice-of-law trap (telehealth + cross-state) **The most restrictive applicable law applies.** When recorder and recorded party are in different states, courts (especially California courts) have held that the **recorded party's state law governs**. Concrete example: Kelly is physically in NY (one-party), client is in California (all-party). **California law applies.** Recording without explicit California-style consent = criminal liability for Kelly. **ABA-endorsed rule:** when recording any cross-state conversation, comply with the strictest applicable state OR get explicit consent from all parties. **Operational implication for Avina:** - Map every client to their state of residence at intake - Default to all-party consent for any client in or potentially in: CA, FL, IL, MD, MA, NV, NH, PA, WA, MT (notification), DE, MI (recording others), CT (phone), OR (in-person), HI (private places) - When in doubt: get explicit consent from all parties, signed, dated, before any recording --- ## Operating rules for Avina case managers ### Rule 1 — Recording is the default for all client engagements Every case manager session, phone call, or video call begins with the recording-consent disclosure scripted below. Consent is obtained in writing at intake AND verbally at the start of each recorded interaction. ### Rule 2 — Disclosure script (read at start of every recorded interaction) > *"Hi [client], this is Kelly from Avina. As we discussed in your intake, this call is being recorded for our case-management records and for your safety. The recording is stored securely and used only for our work together and any safety scenario that may come up. Are you OK to continue?"* The verbal "Are you OK to continue?" + the audible "yes" = the start of the recorded chain of consent. Without that, do not start recording. ### Rule 3 — Crisis recordings (welfare check scenarios) - **In one-party states:** existing recording of the client (started lawfully under consent) continues. Crisis events captured in flight are admissible. - **In all-party states:** a recording started under consent continues. **A NEW recording without prior consent is illegal even in an emergency.** The Avina case manager must rely on contemporaneous written notes if no prior consent exists. Florida's minor-disclosing-abuse exception is the only common carve-out and does not apply to standard adult case management. - **Emergency exception (Washington only):** RCW 9.73.030 permits recording of emergency communications (reports of fires, threats, hostage situations) without consent — but this is narrowly defined and does not apply to clinical or admin contexts. ### Rule 4 — Storage and access - **Encryption at rest:** AES-256 minimum. AWS S3 with object lock + KMS, or equivalent. - **Retention:** 7 years for clinical records, longer if litigation reasonably anticipated. Destroy thereafter under documented procedure. - **Access:** logged. Only authorized clinical / supervisory personnel. - **No consumer cloud:** Dropbox, iCloud, Google Drive (personal) are insufficient. Business-tier with BAA where HIPAA applies. - **Original recordings never edited or deleted.** Massachusetts criminalises tampering with recordings before judicial use; this is a good universal default. ### Rule 5 — Use of recordings (purpose limitation) Authorized: case-management decisions, supervision review, safety evidence (welfare check, hospital handoff, family briefing per ROI scope), legal proceedings if Avina/case manager subpoenaed, protocol training (with re-anonymisation). NOT authorized without separate written consent: marketing, public-facing content, sharing with anyone outside the safety/legal scope, AI transcription in Illinois (separate consent required per HB 1806). ### Rule 6 — Edge cases - **Discovery calls before contract signing:** NO RECORDING unless prospect verbally consents at start. Default = no recording until contract. - **Recording client + family on same call:** All parties' consent needed. The client signing intake consent is NOT enough — the family member must consent separately when they join a call. - **Cross-state telehealth:** apply the recorded-party's state law. Document the client's state of residence at intake. - **AI transcription tools (Otter, PLAUD AutoFlow, Gemini):** in Illinois, separate written consent specifically authorising AI processing is required. In all other all-party states, the general recording consent must explicitly mention "AI transcription / processing" — generic recording consent may not cover it. ### Rule 7 — HIPAA and 42 CFR Part 2 overlay - **If Avina is a HIPAA covered entity** (likely if billing insurance, providing healthcare, or a designated business associate of a covered entity): recordings = PHI. Subject to Privacy Rule (TPO authorisation), Security Rule (encryption), Breach Notification. - **If Avina is NOT a covered entity** (independent case management, self-pay): HIPAA does NOT apply directly. State recording law and professional ethics govern. - **Substance use disorder treatment recordings:** ALWAYS subject to **42 CFR Part 2** — even stricter than HIPAA. Most disclosures require written consent specifically for the disclosure; no TPO carve-out. - **Psychotherapy notes:** heightened HIPAA protection. Recordings that contain provider's personal observations and analysis are psychotherapy notes — cannot be disclosed even for TPO without specific authorisation. ### Rule 8 — Consent forms must be SEPARATE documents Best practice (and legally required in IL for AI transcription): 1. **Intake / engagement letter** — general engagement scope, fees, terms 2. **HIPAA notice / authorisation** — if Avina is a covered entity 3. **Recording consent form** — distinct, specifies: purpose, storage, who may access, retention, AI processing if applicable, revocation right 4. **Release of Information (ROI)** — for sharing existing records with third parties (separate from #3 because ROI governs disclosure of records that already exist; recording consent governs whether the record is created in the first place) A single combined "consent for everything" form is not adequate. ### Rule 9 — Duty-to-report does not authorise recording Mandatory reporting (suicide threats, child abuse, elder abuse) requires the case manager to notify authorities. It does NOT authorise creating a new recording without consent in an all-party state. The duty-to-report applies to the *information* (which can be captured in written notes), not to the *recording* (which requires consent). This is a critical distinction Kelly should understand: in the Erin case (state TBC), Kelly recorded under existing consent. If Erin had been in California and Kelly had not had recording consent, Kelly's police-evidence value would have come from contemporaneous written notes, not a new unauthorised recording. --- ## Implementation checklist (per client at intake) - [ ] Client's state of residence documented in case file - [ ] Recording-policy variant selected based on state - [ ] Recording consent form signed and stored - [ ] HIPAA authorisation (if applicable) - [ ] ROI scope agreed and signed - [ ] If AI transcription tools will be used: explicit AI-processing consent obtained (Illinois mandatory; recommended everywhere) - [ ] If client is in 42 CFR Part 2 substance use disorder treatment: applicable Part 2 consents obtained - [ ] Consent disclosure script tested with this client (verbal + recorded) --- ## Open items for lawyer review 1. **Avina's HIPAA status:** confirm whether Avina is a covered entity, business associate of a covered entity, or neither. This determines the entire compliance overlay. 2. **42 CFR Part 2 applicability:** does Avina's services trigger Part 2 obligations? If yes, recording protocols need additional layers. 3. **Cross-state telehealth liability:** specifically the California-aggressively-asserts-jurisdiction principle — does Avina need a California-specific standing posture? 4. **Recording consent form template:** lawyer to draft per-state variants if needed. 5. **AB 2905 (CA AI voice disclosure):** if Kelly uses any AI voice agents (e.g., voicemail bots), separate disclosure rules apply. 6. **HB 1806 (IL AI transcription):** specifically addresses PLAUD/Otter/Gemini-style transcription. Avina's consent forms must be IL-compliant if any IL clients. --- ## Sources Statutory matrix verified 2026-05-02 via Perplexity Sonar Deep Research (full research output saved at `_full_research_recording_law.md`, citations at `_sources_recording_law.md`). Primary references include MWL state-by-state recording chart, RCFP Reporters Committee state guides, Justia statutes, ABA ethics guidance, HHS HIPAA Q&A. ## Revision log - v1.0 — 2026-05-02 — Verified state matrix replacing v0.1 placeholder. Lawyer review pending. - v0.1 — 2026-05-02 — Initial draft from debrief call (placeholder state list).