AI for Therapy Notes: What HIPAA Requires

AI note tools can listen to a session or take your shorthand and draft a note. They may save real time. But if the tool handles protected health information (PHI) for a practice or facility, HIPAA requires a business associate agreement (BAA) with the vendor first. Pasting patient details into a general chatbot without one can be a HIPAA violation.

By the Best Therapy Productivity Calculator team · Last updated October 2026

What is a business associate agreement?

Under HIPAA, a business associate is a person or company that creates, receives, keeps or sends PHI on behalf of a covered entity, such as a clinic, hospital or home health agency. Before sharing PHI, the covered entity must have a written contract (the BAA) in which the vendor agrees to protect the information as HIPAA requires.

An AI documentation vendor that processes session audio or patient details for your practice is generally a business associate.

A five-item checklist before using an AI note tool: signed BAA, employer approval, patient informed or consenting as required, data retention known, clinician reviews and signs every note
Before you use an AI note tool

Checklist before you use an AI note tool

CheckWhy it matters
Is there a signed BAA?Required before the vendor handles PHI for a covered entity
Has your employer approved it?Most facilities have IT and compliance review; using an unapproved tool can break policy even with a BAA
Do patients need to be told or asked?Some states require consent from everyone before a conversation is recorded; employers may also require it
Where does the data go, and for how long?Ask about storage, retention, deletion and whether data trains the vendor’s models
Who signs the note?You do. You’re responsible for its accuracy

Can I use a general AI chatbot for notes?

Not with patient information, unless your organization has a BAA covering that tool and has approved it. Even “removing the name” may not be enough: HIPAA de-identification is a specific standard, and dates, small towns and rare details can still identify someone.

What you can do without PHI:

  • Draft a template for a type of note
  • Rewrite a home exercise handout in plainer language
  • Practice wording for goals using made-up examples

What are the clinical risks?

  • Made-up details. AI can add things that didn’t happen. Read every line.
  • Missing skilled-care language. Payers look for why your skills were needed. Generic drafts can miss it.
  • Copy-forward sameness. Notes that read alike from visit to visit can raise questions in an audit.

Will AI notes raise my productivity?

They may cut documentation time, which frees non-billable minutes. They don’t change your billable minutes. Track it: time a week of notes before and after with the documentation time calculator.

Frequently asked questions

Is an AI scribe HIPAA compliant?

No tool is “HIPAA compliant” on its own. Compliance depends on a BAA, your organization’s safeguards and how the tool is used.

Do I need patient consent to record a session for AI notes?

It depends on your state’s recording laws and your employer’s policy. Some states require all parties to consent. Ask your compliance team.

Can my employer require me to use an AI scribe?

Employers set their own documentation tools. You’re still responsible for checking and signing your notes.

Related: Documentation time calculator · Concurrent documentation · Productivity vs efficiency

General information, not legal advice. Talk to your compliance officer or a health care attorney.

Sources