Can I use an AI note-taker in sessions?

Only with a signed BAA, documented informed consent from the client, and compliance with your state's recording-consent law. The policy should also require that generated notes are reviewed by the clinician and that psychotherapy notes are kept separate and never processed by AI.

What about an AI chatbot for clients between sessions?

Treat it as a clinical service, not a convenience. The policy should require clear disclosure that the client is talking to AI, crisis-escalation paths to a human, and a scope limit so the tool never gives treatment advice it was not configured for.

AI Policy Template for Mental Health & Counseling Practices

Therapists and counselors are being pitched AI note-takers, session summarizers, and client-facing chatbots every week, and the confidentiality stakes are higher here than anywhere else in healthcare. Psychotherapy notes carry extra HIPAA protection, substance use records fall under 42 CFR Part 2, and clients disclose things they would never want near a third-party server. A mental health AI policy draws those lines explicitly: what may never enter an AI tool, what consent is required before recording, and how AI-assisted documentation is reviewed before it becomes part of the record.

Generate a policy customized for mental health practices in about 3 minutes:

Generate an AI policy for mental health practices

Free preview · $49 one-time to download

AI risks specific to mental health practices

Psychotherapy notes have stronger protection than ordinary PHI and must stay out of every AI tool, approved or not
Session recording and AI note-taking require informed client consent — and some states require two-party consent to record at all
Substance use treatment records under 42 CFR Part 2 cannot be shared with an AI vendor without specific written consent
AI chat assistants offered to clients between sessions can give harmful advice in a crisis and blur the line on who is providing care

Compliance requirements your policy must address

HIPAA

Protected health information (PHI) as defined by HIPAA must never be entered into any AI tool unless the Company has a signed Business Associate Agreement (BAA) with the tool vendor and the tool has been explicitly approved for PHI by management. Employees must treat any patient or health-related information as PHI unless told otherwise.

AI Governance and Billing Integrity

AI tools that create, receive, maintain, or transmit PHI must be included in the Company's HIPAA security risk analysis and technology asset inventory; a vendor's own security or compliance claims do not substitute for the Company's own risk assessment. Decision-support or predictive tools used in patient care, including those built into certified electronic health record systems, are subject to the Section 1557 prohibition on discrimination on the basis of race, color, national origin, sex, age, or disability, and the Company will make reasonable efforts to identify and mitigate that risk before and during their use. Any AI-generated clinical note, code, diagnosis prompt, or billing suggestion, including prompts to add risk-adjusting diagnoses, must be reviewed and confirmed by the treating clinician before it affects a medical record or a submitted claim; federal enforcement authorities have identified AI-influenced documentation and coding as an active enforcement priority, and accepting an AI-generated suggestion without independent clinical verification is not a defense in a billing integrity review.

Psychotherapy Notes / 42 CFR Part 2

Psychotherapy notes receive heightened protection under HIPAA and must never be entered into any AI tool, including tools otherwise approved for PHI. Records of substance use disorder treatment covered by 42 CFR Part 2 may not be disclosed to an AI vendor without the specific written consent that regulation requires. Session recordings, AI note-taking, and transcription in a clinical setting require the client's informed consent and a signed BAA before first use.

What a complete AI policy for mental health practices includes

Purpose, scope, and who the policy covers (employees, contractors, volunteers)
Approved AI tools and the process for approving new ones
Acceptable uses — and the prohibited list, including data that must never enter prompts
Privacy-law clauses for your jurisdictions (GDPR, EU AI Act, CCPA, PIPEDA) plus HIPAA and AI Governance and Billing Integrity and Psychotherapy Notes / 42 CFR Part 2 requirements
Human review and accountability rules for AI output
Incident reporting, enforcement, and annual review

Frequently asked questions

Can I use an AI note-taker in sessions?: Only with a signed BAA, documented informed consent from the client, and compliance with your state's recording-consent law. The policy should also require that generated notes are reviewed by the clinician and that psychotherapy notes are kept separate and never processed by AI.
What about an AI chatbot for clients between sessions?: Treat it as a clinical service, not a convenience. The policy should require clear disclosure that the client is talking to AI, crisis-escalation paths to a human, and a scope limit so the tool never gives treatment advice it was not configured for.

Get your AI policy for mental health practices

Answer a few questions, preview the full document free, and download it as editable Word for a one-time $49.

Start the generator

DraftAIPolicy is not a law firm; documents are self-help templates, not legal advice.

Related guides

Other industries

Accounting & Bookkeeping Legal Services Healthcare & Medical Practices Dental Practices Physical Therapy & Rehab Clinics Home Health & Hospice Agencies Veterinary Clinics Financial Services & Advisory