HIPAA compliant AI therapy notes are session records drafted with artificial intelligence and finalized by a licensed clinician under HIPAA safeguards for Protected Health Information (PHI). Compliance depends on a Business Associate Agreement (BAA) with the AI vendor, documented safeguards, and clinician sign-off. Tools like Echo, Alleva’s HIPAA-compliant ambient AI, follow that model.
TL;DR: AI can draft your therapy notes, but HIPAA compliance comes from the setup around it: a signed BAA, documented safeguards on PHI, and a clinician who reviews and signs every note.
Key Takeaways
- BAA first: Never share PHI with an AI vendor until a BAA is signed.
- Clinician signs off: AI drafts the note; a licensed clinician reviews and signs it.
- 60-day breach clock: Notify affected clients within 60 days of discovering a breach.
- Check state and Part 2 rules: Consent and SUD record rules can go beyond HIPAA.
Therapy notes are among the most time-consuming, compliance-sensitive parts of a clinician’s job. AI tools can lighten that load when they’re built with HIPAA compliance at their core. The guidance below covers federal rules (HIPAA and 42 CFR Part 2); state rules can add more.
Want to see an AI-drafted note your clinicians can review and sign?
How HIPAA Applies to AI-Drafted Therapy Notes
An AI-drafted therapy note is HIPAA compliant when the tool handles PHI under a signed BAA, the minimum necessary standard, and Security Rule safeguards, and a clinician attests to the final record. For how these notes fit a full charting workflow, see our behavioral health clinical documentation guide.
In practice, the AI vendor must sign a BAA, store and transmit data through encrypted, HIPAA-compliant infrastructure, and limit PHI to what’s clinically necessary. Session audio and transcripts should exist only as long as your documented purpose requires.
Well-configured, clinician-reviewed notes can support insurance submission, audits, and legal review. Compliant AI documentation is one of the EMR features behavioral health teams need.
Progress Notes vs. Psychotherapy Notes
HIPAA treats psychotherapy notes as their own category: a mental health professional’s separate notes analyzing what was said in a session, kept apart from the medical record. Most uses of those notes require the client’s written authorization.
Most AI-drafted session notes are progress notes, not psychotherapy notes. Session times, modalities, diagnoses, symptoms, treatment plans, and progress are excluded from the psychotherapy-notes category, so SOAP, DAP, group, and UR notes belong in the chart.
Our guide to writing therapy notes covers how to store each type.
Why are HIPAA Compliant AI Therapy Notes Important?
HIPAA compliant AI therapy notes sit at the intersection of clinical quality, legal obligation, and operational efficiency. Here’s why they matter for every behavioral health practice:
- Protects client privacy: Sensitive mental health and substance use information stays under federal safeguards against unauthorized disclosure.
- Reduces liability exposure: Compliant documentation helps protect clinicians and organizations during investigations, audits, and legal review.
- Supports reimbursement: Payers expect complete, timely, properly formatted notes, and consistent AI-drafted structure can help reduce documentation-related denials and delays.
- Frees up clinician time: Less time on paperwork means more time with clients, which can ease documentation-related burnout.
Risks of Non-HIPAA Compliant AI Therapy Notes
Using an AI tool that isn’t HIPAA compliant to draft or store therapy notes is a federal compliance risk, with financial, legal, and reputational consequences.
HHS adjusts HIPAA civil monetary penalties for inflation. Under the adjustment published in the Federal Register in January 2026, penalties range from $145 per violation up to a calendar-year cap of $2,190,294 for identical violations, depending on culpability. HHS has announced no further adjustment for 2026.
Knowing, wrongful disclosures of PHI can also be referred to the Department of Justice for criminal investigation.
A reportable breach also triggers notification duties. The HHS Breach Notification Rule requires notice to affected individuals without unreasonable delay and within 60 days of discovery, a report to HHS, and media notice when more than 500 residents of a state or jurisdiction are affected.
Those deadlines run from discovery, not from the end of your investigation. Audit logs and a rehearsed incident response plan determine how quickly you can establish what happened, whose PHI was involved, and which notices you owe.
| Scenario | Who must be notified | Deadline | Notes |
|---|---|---|---|
| Any breach of unsecured PHI | Affected individuals | Without unreasonable delay, no later than 60 days after discovery | Written notice by first-class mail, or email if the individual agreed |
| Breach affecting fewer than 500 individuals | HHS | Within 60 days after the end of the calendar year it was discovered | Can be logged and submitted annually |
| Breach affecting 500 or more individuals | HHS | Without unreasonable delay, no later than 60 days after discovery | Listed on HHS’s public breach portal |
| More than 500 residents of one state or jurisdiction | Prominent media outlets serving the area | No later than 60 days after discovery | Often a press release |
| Business associate discovers a breach | The covered entity | Without unreasonable delay, no later than 60 days after discovery | Your BAA can set a shorter window |
For more real-world scenarios, review these common HIPAA violation examples.
Related read: using EMR software to optimize your processes.
AI Vendor Checklist for HIPAA Compliant Therapy Notes
Use these AI-specific checks when you evaluate or audit an AI note tool. For the broader platform review, pair them with our EMR HIPAA compliance checklist.
Vendor and contract
- BAA signed first: The agreement covers the AI features, hosting, and support access, and requires the vendor to flow the same obligations down to its subcontractors.
- Model training terms in writing: Confirm whether PHI or de-identified data is used to train or improve models, and how to opt out.
- Audio and transcript retention: Know how long session audio exists, where it’s stored, and when it’s deleted.
HHS guidance on business associate contracts lists what the agreement must cover, including permitted uses of PHI, required safeguards, breach reporting, and return or destruction of PHI when the contract ends. Hold your AI vendor’s agreement against that list, paying close attention to model training and subcontractor terms.
Technical safeguards
- Encryption in transit and at rest
- Unique logins, multi-factor authentication (MFA), role-based access, and automatic logoff
- Audit logs that record user, timestamp, action, and whether text was AI-suggested or clinician-entered. See how an EMR audit trail works.
Workflow and documentation
- Clinician attestation: No AI draft becomes final without review and signature.
- Minimum necessary templates: Identifiers live in structured fields, not the free-text narrative.
- Individualized group notes: Other members’ names stay out of each client’s note.
- Telehealth fields captured: Modality, client location, consent, and duration (see Example 7).
- Policies documented and retained: Keep AI-related policies, risk analyses, and training records at least six years, ideally in behavioral health GRC software.
| Record | Minimum retention | Governed by | Notes |
|---|---|---|---|
| HIPAA policies and procedures | 6 years | 45 CFR 164.316(b), 164.530(j) | From creation or last effective date, whichever is later |
| Security risk analyses and risk management plans | 6 years | 45 CFR 164.316(b) | Include AI tools in scope |
| Business associate agreements | 6 years | 45 CFR 164.530(j) | Keep amendments and subcontractor terms |
| Breach risk assessments and notices | 6 years | 45 CFR 164.414, 164.530(j) | You carry the burden of proof |
| Audit logs | No fixed HIPAA period | 45 CFR 164.312(b) | Set by policy and risk analysis |
| Clinical records, including therapy notes | Not set by HIPAA | State law, payers, accreditors | Can run longer for minors |
7 Examples of HIPAA Compliant AI Therapy Notes
Every example below is a clinician-reviewed draft, not a final note. Names and identifiers stay in secured fields, and the licensed clinician signs each note before it enters the record.
Example 1: SOAP Note for an Individual Therapy Session
A SOAP note (Subjective, Objective, Assessment, Plan) is one of the most common behavioral health formats. AI drafts each section from the session for the clinician to review and sign.
AI-Generated SOAP Note Example:
Subjective: Client reports improved mood over the past week and states they have been practicing the breathing exercises discussed in the prior session. Client expressed mild anxiety about an upcoming family gathering but denied any depressive symptoms or suicidal ideation.
Objective: Client appeared calm and engaged throughout the session. Eye contact was appropriate. Speech was clear and goal-directed. No psychomotor abnormalities noted.
Assessment: Client demonstrates continued progress toward treatment goals related to anxiety management. Current coping strategies appear effective. No acute safety concerns.
Plan: Continue weekly individual therapy sessions. Introduce grounding techniques for use during the upcoming family event. Review anxiety log at next session.
Key Learnings:
- SOAP notes are ideal for tracking progress across sessions and are commonly required by payers
- PHI such as the client’s name should only appear in designated, secured fields, not within the free-text note body
Example 2: DAP Note for a Substance Use Counseling Session
A DAP note (Data, Assessment, Plan) is common in substance use treatment for its streamlined format.
AI-Generated DAP Note Example:
Data: Client attended scheduled individual counseling session. Client reported completing seven days of sobriety and expressed pride in the milestone. Discussed triggers encountered at a social event over the weekend and strategies used to maintain sobriety. Client denied cravings in the past 48 hours.
Assessment: Client is making measurable progress toward sobriety goals. Demonstrated improved insight into personal triggers and applied relapse prevention strategies effectively. Risk for relapse appears low at this time.
Plan: Continue weekly counseling. Assign journaling exercise to track trigger patterns. Coordinate with group facilitator to reinforce peer support strategies.
Key Learnings:
- Ensure AI-generated notes are reviewed and signed by the licensed clinician to meet HIPAA and payer requirements
- SUD counseling notes may also be Part 2 records; see how 42 CFR Part 2 shapes progress notes.
Example 3: Utilization Review (UR) Note for Inpatient Behavioral Health
Utilization review (UR) notes justify ongoing levels of care to payers, so they must be specific, clinically grounded, and matched to payer criteria.
AI-Generated UR Note Example:
Level of Care Justification: Client currently meets medical necessity criteria for continued residential treatment based on the following: persistent suicidal ideation with a recent attempt within the past 30 days, inability to maintain safety in a less restrictive environment, and need for 24-hour clinical monitoring and medication management.
Clinical Summary: Client has been in residential treatment for 14 days with diagnoses of Major Depressive Disorder, recurrent, severe, and Alcohol Use Disorder, moderate. Client is stabilizing on medication and engaging in daily individual and group therapy.
Recommendation: Continued residential stay recommended for an additional 7 days pending clinical reassessment.
Key Learnings:
- UR notes must align precisely with diagnostic criteria and payer-specific language to avoid denials
- UR notes often go to payers, so send them through encrypted channels and include only the minimum necessary PHI
Example 4: Group Therapy Progress Note
Group notes must document each participant individually. AI can draft a separate note for every client from a single session input.
AI-Generated Group Note Example (Individual Client Within Group):
Session Type: Group therapy, Cognitive Behavioral Therapy skills group (8 participants)
Client Participation: Client was present for the full 60-minute session. Actively participated in discussion around cognitive distortions, offering two personal examples. Demonstrated appropriate interpersonal boundaries and showed empathy toward peers. No disruptive behavior noted.
Clinical Observations: Client appears to be applying CBT concepts with increasing fluency. Affect was euthymic. No safety concerns observed during session.
Plan: Continue participation in weekly CBT group. Encourage client to practice thought records between sessions as discussed.
Key Learnings:
- Group notes must be individualized, a single blanket note falls short of most payer standards and can place other members’ PHI in each client’s record
- Session attendance and participation level should always be explicitly documented
For a full walkthrough, see how to document group therapy.
Example 5: Shift Handoff Note for Residential Treatment
In residential settings, AI can draft structured handoff summaries so the incoming shift has what it needs.
AI-Generated Shift Handoff Note Example:
Shift Summary (3PM–11PM): Client expressed increased anxiety during the afternoon programming block and required 15 minutes of one-on-one support from the floor counselor. Medication administered as scheduled at 6PM with no adverse reactions reported. Client participated in dinner and evening group session. Declined recreation activity citing fatigue.
Safety Status: No safety concerns during this shift. Client denied SI/HI at last check-in at 10:30PM.
Handoff Items for Incoming Shift: Monitor client’s anxiety levels during morning programming. Client has a scheduled phone call with family at 9AM. Coordinate with counselor to provide support as needed. Medication due at 7AM per MAR.
Key Learnings:
- Shift handoff notes must be time-stamped, attributed to the documenting staff member, and stored securely within the EHR
- Any safety-related observations from the prior shift should be prominently flagged at the top of the handoff note
Example 6: Treatment Plan Progress Note
Treatment plan progress notes track movement toward each goal at the review intervals your payers and accreditors require. AI can pull in existing goals and prefill progress for the clinician to confirm.
AI-Generated Treatment Plan Progress Note Example:
Review Period: 30-day treatment plan review
Goal 1 (Reduce anxiety symptoms): Client has made moderate progress. Reports a reduction in panic episodes from 4–5 per week to 1–2 per week. Continues to practice diaphragmatic breathing daily. Goal remains active.
Goal 2 (Medication adherence): Client has maintained 100% medication adherence during the review period. Goal met. Recommend transitioning to maintenance monitoring.
Updated Plan: Revise Goal 2 to reflect maintenance phase. Add new goal focused on relapse prevention education. Next review scheduled in 30 days.
Key Learnings:
- Treatment plan progress notes should map directly to the original goals documented at intake, AI tools that link notes to the treatment plan template ensure consistency
- Notes should always reflect the clinician’s clinical judgment, even when AI-generated drafts are used as a starting point
Example 7: Telehealth Session Note
Telehealth notes add the virtual-session details payers and licensing boards expect: modality, platform, client location, duration, and technical issues. AI can prefill these fields for clinician review.
AI-Generated Telehealth Session Note Example:
Session Format: Individual telehealth session conducted via HIPAA-compliant video platform. Client connected from home (confirmed within licensed state). No significant technical disruptions. Session duration: 50 minutes.
Session Summary: Client presented as calm and engaged. Discussed ongoing challenges with work-related stress and explored cognitive reframing strategies. Client expressed interest in trying mindfulness-based techniques and was provided with two guided exercises to practice before the next session.
Clinical Observations: Client’s affect appeared appropriate via video. No concerning behavioral indicators noted. Client denied SI/HI.
Plan: Continue weekly telehealth sessions. Follow up on mindfulness practice at next session. Client confirmed next appointment.
Key Learnings:
- Telehealth notes must document platform compliance, client location, and session duration to satisfy payer, licensure, and billing requirements
- Clinicians should confirm client identity and location verbally at the start of each telehealth session and ensure the AI note captures this confirmation
Ambient AI in Therapy Sessions: Consent, State AI Laws, and Part 2
Ambient AI changes the documentation conversation because the tool is listening during the session. HIPAA is only one layer: state recording rules, state AI laws, and Part 2 all shape how you introduce it to clients.
Why consent matters more with ambient AI
HIPAA generally lets you use a business associate for documentation without a separate client authorization. State laws and client expectations often ask for more, especially when a session is recorded.
Some states require every party’s consent before a private conversation is recorded.
A practical consent workflow includes:
- Plain-language notice: What the AI does, what it records, how long audio exists, and who can see the draft
- Written consent in the chart: Captured before the first AI-assisted session, with the option to decline without affecting care
- An easy pause: A visible way to stop capture during sensitive disclosures
- Re-consent on change: A fresh notice when the tool or its data use changes
State AI laws reached the therapy room in 2025 and 2026
Several states now regulate AI in mental health care. Laws passed in Illinois and Nevada in 2025 bar AI from providing therapy on its own, while generally allowing licensed professionals to use it for administrative work, such as documentation, under their oversight.
Other states, including Texas, require providers to disclose when AI is involved in patient care. Requirements differ by state and keep changing, so confirm your consent language, disclosure notice, and clinician-review step against current rules wherever your clients are located.
SUD programs: Part 2 sits on top of HIPAA
If your organization runs a federally assisted SUD program, AI-drafted counseling notes may be Part 2 records. Updated Part 2 rules aligned more closely with HIPAA and reached their compliance date on February 16, 2026, so confirm your AI vendor agreement covers Part 2 records and that consent notices travel with the note.
How To: Using Alleva’s HIPAA Compliant AI Therapy Notes
Alleva is a behavioral health EHR platform built specifically for mental health and substance use treatment, and its HIPAA compliant AI therapy notes are a direct reflection of that focus. Every documentation feature is designed to meet the privacy, security, and clinical standards that behavioral health providers actually face.
Echo and TravisAI: Two AI Tools, One Integrated Platform
Alleva’s HIPAA compliant AI therapy notes are powered by two built-in tools: Echo and TravisAI. Echo is Alleva’s ambient AI that listens to sessions and generates structured, audit-ready notes in real time (supporting DAP, SOAP, UR, and more) without ever saving a recording.
Only secure, compliant notes remain, keeping PHI protected at every step. TravisAI complements Echo by serving as an in-platform AI assistant that answers documentation questions and guides clinicians through compliance workflows on the spot.
Alleva is SOC 2 Type II and ONC certified and HIPAA compliant, with documentation in the Alleva Trust Center. Alleva signs a Business Associate Agreement with clients who request one.
In a case study with Warriors Heart, Alleva reported a 30% reduction in documentation time and a 15% improvement in claim accuracy after the team adopted Echo.
“Echo has raised the bar for documentation quality across our team.”
Rachel Mickelsen, Clinical Director, Warriors Heart
Echo and TravisAI sit inside a task-based workflow that schedules documentation around calendar events and clinical needs, with customizable templates built for payer and regulatory standards. Whether your program is intensive outpatient, partial hospitalization, or residential, shift handoffs, progress notes, and safety observations live in one system.
Notes also flow into integrated behavioral health billing, scheduling, and outcomes tracking, which helps your team avoid much of the manual re-entry that creates compliance gaps and reimbursement delays. It’s all part of Alleva’s full behavioral health platform, from admissions and treatment planning to e-prescribing.
HIPAA Compliant AI Therapy Notes FAQ
Are AI-generated therapy notes HIPAA compliant by default?
No. Compliance depends on the vendor and your workflow, not the AI itself. You need a signed BAA, safeguards such as encryption, access controls, and audit logs, limits on how PHI is used and retained, and clinician review and signature before a note becomes part of the record.
How do you make sure AI-generated notes meet insurance and clinical standards?
Start with templates mapped to payer-required elements, such as medical-necessity language, interventions, client response, and time. The clinician reviews every draft against the session and treatment plan before signing, and a compliance lead audits a sample of notes regularly against payer and accreditation criteria.
Is it HIPAA compliant to use a free consumer AI chatbot for therapy notes?
Usually not. Consumer AI tools typically don’t sign BAAs, and their terms may allow inputs to be stored or used to improve models. Pasting session details into one can be an impermissible disclosure of PHI. Use only tools your organization has vetted and covered under a BAA.
Can an AI vendor use our session data to train its models?
Only if your BAA allows it, and many organizations prohibit it. A business associate may use PHI only as its agreement permits. Ask whether PHI or de-identified data feeds model training, get the answer in writing, and confirm how audio, transcripts, and drafts are deleted.
Do clients need to consent before a session is recorded for AI notes?
HIPAA doesn’t always require a separate authorization for documentation by a business associate, but state recording and AI laws may. Some states require all-party consent to record private conversations, and several 2025 and 2026 laws address AI in therapy. Written notice and consent is the safer default.
Does Alleva sign a BAA for its AI documentation tools?
Yes. Alleva signs a Business Associate Agreement with clients who request one. Alleva is SOC 2 Type II and ONC certified and HIPAA compliant, and its security documentation is available in the Alleva Trust Center. Ask for the BAA as part of your onboarding conversation.
HIPAA Compliant AI Therapy Notes Made Simple
HIPAA compliant AI therapy notes come down to a few habits: a BAA before any PHI moves, safeguards you can document, consent your clients understand, and a clinician’s signature on every note. Get those right, and AI can help give your team time back while keeping documentation defensible.
Alleva builds those habits into Echo, TravisAI, and the rest of its behavioral health platform, from the first session note to the final claim. See it with your own workflows, or call (877) 425-5382.
Content on this page is for general educational purposes and isn’t legal, compliance, or clinical advice. HIPAA, 42 CFR Part 2, and state requirements change, and how they apply depends on your program, so consult qualified counsel or your compliance officer before acting.
Last updated: October 21, 2026
Erica Ward is a Product Manager at Alleva.