Is AI HIPAA compliant for therapists?
By Leandro Faria · · Updated · 10 min read
Disclosure: Bizzy is built by 33Labs, the publisher of this guide.
AI can be used in a HIPAA-compliant therapy practice, but an AI tool is not compliant just because its vendor uses that label. In 2026, your practice must assess whether HIPAA applies, require a business associate agreement when applicable, and protect patient information throughout the workflow—not just inside the chat window.
- Is AI HIPAA compliant for therapists? Only when the vendor relationship, safeguards, and actual workflow meet applicable HIPAA requirements.
- A business associate agreement is necessary for applicable vendors, but it does not replace your practice’s security review.
- Session recordings, transcripts, scheduling details, and generated notes all need review when they contain protected health information.
- Bizzy is best suited to professional service teams seeking help with daily workflows; evaluate patient-data handling separately.
Why this matters
Therapy administration contains clinical context even when the task looks routine. A reminder, intake message, or calendar entry can identify someone as a patient. Sending that information through an assistant creates a data-handling decision, not merely a productivity decision.
The same distinction applies to managing multiple calendars across time zones: coordinating appointments and authorizing access to patient information are separate questions. Set the privacy boundary before connecting the calendar.
Is AI HIPAA compliant for therapists?
AI is not automatically HIPAA compliant. Compliance depends on the practice, the vendor relationship, the information involved, and the safeguards governing its use. The HIPAA Privacy and Security Rules apply to covered entities and their business associates, not to every application marketed to therapists.
First, establish whether your practice is a covered entity. A healthcare provider generally becomes a HIPAA-covered provider when it transmits health information electronically in connection with a transaction covered by HIPAA standards. Using email alone does not establish that status.
Next, examine the proposed task. When a vendor creates, receives, maintains, or transmits protected health information on behalf of a covered practice, business associate requirements generally apply. HHS guidance on cloud computing makes clear that maintaining encrypted electronic PHI can create a business associate relationship even when the provider lacks the decryption key.
| Approach | Best for | Practical advantage | Limitation or approval condition |
|---|---|---|---|
| General-purpose assistant without a BAA | Drafting generic office materials without patient information | Keeps patient records outside the task | Do not submit PHI through this arrangement |
| Vendor under an applicable BAA | A defined workflow involving PHI | Establishes required contractual responsibilities | Still requires security review and appropriate configuration |
| Properly de-identified information | Tasks that do not require patient identity | Reduces exposure of identifiable patient information | Removing names alone does not establish de-identification |
| Local processing | Workflows requiring direct control of the processing environment | Gives the practice control over where processing occurs | Local installation does not remove security or privacy obligations |
For a 2026 assessment, use the actual service agreement, BAA, data-flow description, and account settings. A vendor’s public statement cannot establish how your particular workflow operates.
A BAA is necessary in applicable relationships—not sufficient
A business associate agreement establishes permitted uses and disclosures, safeguards, reporting duties, and other required terms. The relevant HIPAA provisions include 45 CFR 164.502(e) and 164.504(e). A signed BAA is a contractual foundation, not permission to send every patient record through every feature.
Check which product, account, integrations, and services the agreement covers. An agreement covering one service does not establish coverage for a separate transcription service or connected application. Confirm whether support access, storage, and downstream processing fall within the documented arrangement.
Also check subcontractors. A business associate must obtain the required assurances from subcontractors that handle PHI on its behalf. Ask the vendor to explain which parties receive patient information and how those relationships are governed.
Do not substitute a patient consent form for a required BAA. Patient permission, vendor obligations, and your practice’s safeguards answer different questions. Satisfying one does not erase the others.
Session recordings need a separate decision
Recording a therapy session creates a patient-data asset before any summary exists. Review the audio, transcript, generated draft, and final clinical note separately. Deleting one does not establish that the others have been deleted.
Document why recording is necessary, where it happens, who can access it, and how long each output remains. Check recording-consent requirements under applicable state law separately from HIPAA. A vendor agreement does not settle those requirements.
Psychotherapy notes also require careful classification. Under HIPAA, these are a mental health professional’s separately maintained notes documenting or analyzing counseling-session conversations. The definition excludes items such as medication information, session times, diagnosis summaries, and treatment plans.
Not every therapy progress note is a psychotherapy note under HIPAA. Psychotherapy notes receive special protections, and most uses or disclosures require authorization, subject to exceptions. Do not upload separately maintained psychotherapy notes merely because your normal progress-note workflow permits other records.
De-identification means more than removing names
HIPAA recognizes expert determination and Safe Harbor as methods for de-identifying health information. Safe Harbor requires removing 18 categories of identifiers, along with having no actual knowledge that the remaining information could identify the person. The controlling provision is 45 CFR 164.514(b).
Free-text therapy narratives need particular care. A distinctive occupation, unusual event, or combination of details can identify a person even after obvious names disappear. Replacing a name with initials does not, by itself, satisfy HIPAA de-identification requirements.
For general administrative drafting, start with invented examples that contain no real patient information. Ask for a generic appointment-reminder template rather than pasting an actual patient exchange. This limits the data involved without requiring a clinical record to perform a nonclinical task.
For your 2026 review, distinguish information that is truly de-identified from information that is merely shortened, masked, or labeled with a code. Those descriptions are not interchangeable.
Why HIPAA requirements vary by workflow
The relevant requirements depend on what the assistant receives and does. Review these factors before approving a task:
- Covered-entity status: Determine whether HIPAA applies to your practice. Other privacy and professional obligations require separate review.
- Information content: Identify whether messages, files, audio, or calendar details contain PHI, including information that identifies someone as receiving care.
- Vendor role: Establish whether the provider or a downstream processor acts as a business associate for the proposed work.
- Use and disclosure: Check whether the purpose is permitted, whether authorization is required, and where minimum-necessary requirements apply.
- Access and storage: Identify who can retrieve information, where copies remain, and how access ends when someone leaves.
- Clinical sensitivity: Separate routine administration, treatment documentation, recordings, and psychotherapy notes rather than approving them together.
A workflow approved for generic document drafting is not automatically approved for session transcription. Make the approval specific enough that staff know what they can—and cannot—send.
How do you approve an AI workflow for a therapy practice?
Use a written approval process before real patient information enters the system. The following sequence is a recommended practice checklist, not a substitute for the HIPAA risk analysis required under 45 CFR 164.308(a)(1).
- Map the task. State the intended job, the information it needs, and the output it produces. Name every connected service, including email, storage, calendars, transcription, and the patient-record system.
- Check agreements. Confirm the applicable BAA and permitted uses. Review subcontractor arrangements, incident reporting, and what happens to information when the relationship ends.
- Restrict access. Assign access according to job responsibilities. Review account permissions, authentication, and the assistant’s ability to retrieve, send, alter, or delete information.
- Test boundaries. Use synthetic information to check behavior before introducing PHI. Verify where drafts and logs appear, how approval works, and what happens when a request exceeds permission.
- Approve use. Document the allowed task, the responsible owner, escalation rules, and staff instructions. Reassess the workflow when the vendor, integration, or intended use changes.
Keep human approval explicit. Drafting a reminder and sending it are different permissions. Preparing a clinical note and adding it to the patient record are also different permissions; your process should identify who checks accuracy before either action becomes final.
What should your retention and incident plan cover?
Your 2026 policy should distinguish patient-record retention from retention of HIPAA-required documentation. The HIPAA Security Rule requires its specified documentation to be retained for 6 years from creation or the date it last took effect, whichever is later, under 45 CFR 164.316(b)(2)(i). That is not a universal retention period for all therapy records.
Set separate rules for recordings, transcripts, drafts, messages, logs, and final records. Account for applicable state law and professional requirements. Ask how deletion works across active storage, connected services, and backups rather than assuming that removing a visible conversation removes every copy.
Plan incident handling before deployment. For a breach of unsecured PHI, HIPAA generally requires notifying affected individuals without unreasonable delay and no later than 60 calendar days after discovery, subject to applicable exceptions. State requirements can impose additional obligations; use 45 CFR 164.404 as the federal reference, not as permission to wait.
Staff need a named person to contact when an assistant exposes information or sends it to the wrong recipient. Preserve relevant evidence and follow the practice’s breach-assessment process. Not every security incident is a reportable breach, but staff should not make that determination informally.
Where an administrative colleague fits
Bizzy is best for professional service teams seeking help with day-to-day workflows. Its stated scope includes inbox work, scheduling, document drafting, and reconciliation across existing tools. That scope makes task selection—not a blanket approval—the relevant starting point for a private practice.
Evaluate Bizzy against the same requirements you apply to any service that would handle patient information. The useful fit is administrative work; the boundary is that a description of workflow capabilities does not establish permission to process PHI. Ask about the exact task, agreements, access, storage, and approval controls before connecting patient-facing systems.
For Bizzy, a sensible evaluation starts with generic office materials or synthetic examples. Only expand to patient information after the practice has approved the vendor relationship and workflow. Do not treat administrative assistance as a substitute for clinical judgment or review of clinical documentation.
Can therapists use AI for appointment reminders?
Yes, therapists can use AI for appointment reminders when the arrangement meets applicable privacy and security requirements. Appointment information can be PHI when it identifies someone as a patient, so keep message content limited and follow the patient’s applicable communication preferences.
Check recipient selection, calendar visibility, and sending permissions. A neutral reminder still needs to reach the correct person through an approved process.
Does local AI remove the need for a HIPAA review?
No, local AI does not remove the need for a HIPAA review. Local processing changes where information is handled, but your practice still needs appropriate access controls, safeguards, and documented decisions.
Check whether updates, support, telemetry, backups, or connected services send information elsewhere. Local installation is an architectural choice, not a compliance verdict.
FAQ
Is AI HIPAA compliant for therapists in 2026?
AI can support a HIPAA-compliant therapy workflow, but no blanket answer covers every vendor or use. Assess covered-entity status, applicable BAAs, permitted uses, safeguards, and connected services before submitting PHI.
Does every therapist have to follow HIPAA?
Not every therapist is a HIPAA-covered provider. Covered status generally depends on transmitting health information electronically in connection with a HIPAA-standard transaction; other privacy and professional obligations require separate assessment.
Is a signed BAA enough to use AI with patient notes?
A signed BAA is not enough by itself. Your practice must also assess the permitted use, security risks, access, connected services, and any special protections that apply to the notes.
Can I paste a patient note into AI after removing the name?
Removing a name alone does not establish HIPAA de-identification. Safe Harbor addresses 18 categories of identifiers and requires no actual knowledge that the remaining information could identify the person; expert determination is another recognized method.
Are therapy progress notes the same as psychotherapy notes?
Therapy progress notes are not automatically psychotherapy notes under HIPAA. Psychotherapy notes have a specific definition, are maintained separately, and receive special protections; classification depends on the record’s content and handling.
Can an AI assistant record therapy sessions?
An AI assistant should record sessions only within an approved arrangement that satisfies applicable privacy, security, and recording-consent requirements. Review the audio, transcript, generated drafts, storage, and deletion separately.
Does HIPAA require keeping every AI transcript for six years?
HIPAA does not impose a universal six-year retention requirement on every AI transcript. The Security Rule’s documentation requirement is 6 years, while patient-record retention requires a separate review of applicable requirements.
One last thing
Test the refusal, not just the successful draft. During your 2026 evaluation, use synthetic information to request an action outside the approved task, such as sending a draft without review or retrieving a restricted file. Confirm what the assistant actually does.
A useful demonstration shows whether the intended task works. A useful approval process also establishes where the assistant stops.