Are AI Note Takers HIPAA Compliant? A Therapist's Guide to BAAs and Consent (2026)

By The Professions Cloud Editors Updated October 13, 2026 · 7 sources · 3 min read

Prices and facts checked October 13, 2026. We don't accept payment for rankings.

Short answer: an AI note taker isn't "HIPAA compliant" on its own. You use it compliantly, and that requires three things: a signed business associate agreement (BAA) with the vendor, informed consent from your client, and compliance with your state's recording-consent law if sessions are recorded. Get all three before the first session.

1. The business associate agreement (BAA)

An AI note-taking vendor that receives session audio or notes on your behalf is a business associate under HIPAA, so you need a written contract with it. Federal rules require that contract to (45 CFR §164.504(e)):

• limit what the vendor may do with the information to what the contract allows
• require appropriate safeguards, including the HIPAA Security Rule for electronic records
• require the vendor to report any improper use or disclosure, including breaches
• flow the same terms down to any subcontractor (often the AI model provider)
• return or destroy the information when the contract ends, where feasible
• let you terminate the contract if the vendor materially violates it

What to check in practice: does the BAA cover the AI model provider as a subcontractor? Does the vendor train models on your session data? (Look for a contractual "no"). How long is audio retained? Some vendors are explicit. Mentalyc and Twofold both say a BAA is included on every plan (Mentalyc; Twofold). Others only say "HIPAA compliant" on their pricing page (Upheal), so ask for the BAA in writing.

2. Client consent

HIPAA permits sharing information with a business associate for treatment and operations without separate patient authorization. But professional ethics go further. Summaries of the American Psychological Association's 2025 ethical guidance on AI describe transparency with clients, human oversight of AI-generated content, privacy protection and bias testing as core expectations (Videra Health summary). The clinician stays accountable for every AI-assisted note.

A good consent covers:

• that sessions are recorded or transcribed and AI drafts the notes
• the vendor's name, and that a BAA is in place
• how long audio is kept, and that you review and edit every note
• that the client can say no without it affecting their care, with a non-AI alternative

3. Recording-consent laws

If you record sessions (in person or telehealth), state wiretap and eavesdropping laws apply. Some states require all parties to consent to a recording, and many carry criminal penalties. Check your state, and the client's state for telehealth, in the Reporters Committee's state-by-state recording guide. The simplest safe practice is written consent from every participant in every session, including couples and family sessions.

4. Progress notes vs psychotherapy notes

HIPAA gives psychotherapy notes (your private notes analyzing session content, kept separate from the chart) extra protection. The definition excludes medication records, session start and stop times, treatment types and frequency, test results, and summaries of diagnosis, symptoms, treatment plan and progress (45 CFR §164.501).

Most AI tools produce progress notes for the medical record (SOAP, DAP, BIRP). If you also keep process notes, don't let an AI tool merge them into the chart, and think carefully before sending that material to any vendor.

Checklist before your first AI-assisted session

1. Signed BAA on file, covering subcontractors
2. Written vendor answer on training and audio retention
3. Updated informed consent form, with an opt-out
4. Recording consent that meets your state's (and the client's state's) law
5. You review and edit every note before signing
6. Add the vendor to your HIPAA risk analysis and policies

Comparing tools? See our guide to the best AI progress note tools.

FAQ

Is ChatGPT HIPAA compliant for therapy notes?

Not by default. Consumer chatbots don't come with a BAA. Don't enter identifiable client information unless you have a business plan with a signed BAA.

Do I need consent if I only dictate a summary after the session?

No session recording happens, so recording laws don't apply. But your summary is still health information going to a vendor, so you still need a BAA. Telling clients is good practice.

What if a client says no?

Write the note yourself for that client. Consent should be genuinely optional.

Changelog: Oct 13, 2026: first published.