AI for Therapists and Mental Health Professionals: HIPAA-Aware Workflows for Notes, Treatment Planning, and Continuing Education

Mental health and healthcare professionals have good reason to be cautious about AI. HIPAA penalties are severe, the cultural norms in therapy prioritize human-centered care, and the consequences of a confidentiality breach in mental health care can be catastrophic for clients. But the right AI workflows, with the right architectural choices, can help with documentation and administrative work without compromising any of these obligations. This is the practical guide.

The HIPAA Frame, Briefly

HIPAA covers Protected Health Information (PHI) handled by covered entities (clinicians, healthcare providers) and business associates (vendors that create, receive, maintain, or transmit PHI on a covered entity's behalf). Giving PHI to such a vendor without a Business Associate Agreement (BAA) in place is generally a HIPAA violation.¹

Consumer AI plans don't come with BAAs. OpenAI signs them only for its API and sales-managed ChatGPT Enterprise and Edu accounts; Anthropic only for its API and HIPAA-ready Claude Enterprise; Google covers the Gemini app through its Workspace HIPAA Business Associate Addendum.^{2, 3, 4}Inputting PHI into a personal AI account that no BAA covers is a disclosure without a BAA — typically a violation. Enterprise AI tools with BAAs are an option, with careful contract review.

On-device AI sidesteps the vendor question: no data leaves the device, so no third party receives PHI and there is no vendor BAA to negotiate. The PHI still lives on the device, so securing it remains your responsibility.

In January 2025, HHS OCR proposed a major overhaul of the HIPAA Security Rule, last updated in 2013, pointing to steep increases in hacking and ransomware breaches. The proposal would require safeguards such as encryption of electronic PHI, multifactor authentication, and network segmentation. As of September 2026 it is still a proposal: the federal regulatory agenda lists final action for July 2027.^{5, 6} Those safeguards would apply to any device that stores PHI, including one running local AI.

Important Caveat: AI Is Not a Clinical Decision-Making Tool

Before getting into workflows, this clarification matters. AI is a productivity and comprehension tool. It is not a clinical decision-making tool. It does not replace your training, judgment, supervision, or professional responsibility. The use cases below are for your own work process — never for direct clinical recommendations about an individual patient's care without your full clinical review.

Workflow 1: Progress Note Drafting

The use case: turning raw session notes — your own quick written or dictated notes during or immediately after session — into formatted progress notes (SOAP, DAP, or your preferred structure).

The AI workflow: type or paste your raw notes, ask AI to format them into your preferred clinical structure with proper section headers.

Compliance check: Raw session notes contain extensive PHI. Consumer AI tools are prohibited. Enterprise AI with BAA is acceptable with contract review. On-device AI is the structurally cleanest fit because the notes never leave your device.

Workflow 2: Treatment Plan Drafting

The use case: drafting initial treatment plans and treatment plan updates, including diagnostic considerations, treatment goals, intervention strategies, and measurable outcomes.

The AI workflow: provide AI with the clinical formulation, ask for a structured treatment plan in the format your practice or insurance requires.

Compliance check: Treatment plans contain PHI. Same tier rules as progress notes. On-device AI is the cleanest fit.

Clinical responsibility: AI-generated treatment plans must be clinically reviewed and modified before becoming the plan of record. The AI provides structure; you provide the clinical judgment.

Workflow 3: Letter and Report Writing

The use case: writing letters to PCPs, psychiatrists, schools, insurance companies, courts. Writing assessment reports. Writing documentation responsive to records requests.

The AI workflow: provide AI with the clinical content and the audience, ask for an appropriately-formatted letter or report.

Compliance check: Almost always involves PHI. Tier 2 or 3 only.

Workflow 4: Treatment Research and CE

The use case: researching evidence-based interventions for specific diagnoses, reviewing CE course materials, summarizing journal articles, keeping current on clinical literature.

The AI workflow: paste public materials (articles, course notes, treatment manuals) into AI for plain-language summaries focused on clinical application.

Compliance check: Public materials with no patient information pose no PHI issue. Any AI tier works.

Caveat: AI summaries of clinical literature may oversimplify or misstate research findings. Always go back to primary sources for clinically-relevant claims you'll act on.

Workflow 5: Documentation for Insurance and Audits

The use case: writing medical necessity documentation, justification for treatment intensity changes, responses to insurance utilization reviews, documentation for compliance audits.

The AI workflow: provide AI with the clinical context and the documentation requirement, get a structured draft that you then clinically review.

Compliance check: Insurance documentation contains PHI. Tier 2 with BAA or Tier 3.

Workflow 6: Practice Management and Administration

The use case: drafting practice policies, intake forms, informed consent documents, marketing content, website copy. The administrative writing that takes up surprising amounts of clinical time.

The AI workflow: standard drafting and editing assistance.

Compliance check: If no patient information is involved, any AI tier works. If you're drafting templates that will later be populated with patient information, the template-drafting itself is unrestricted.

The Three-Tier System for Clinical Practice

Tier 1 — Public AI: Approved for non-PHI work only — practice management drafting, CE summarization of public materials, broad clinical research with no patient context. Prohibited for any PHI.

Tier 2 — Enterprise AI with BAA: Approved for PHI-involved work if a Business Associate Agreement is in place, the vendor's security posture meets HIPAA Security Rule requirements, and your practice has updated forms reflecting AI vendor use.

Tier 3 — On-Device AI: The strongest fit for PHI-involved work. No third party receives PHI, so there is no vendor BAA or vendor diligence — but the PHI now lives on your device, so encryption, access control, backups, and any history the tool saves fall under your own Security Rule safeguards. If the tool also offers a cloud option, keep it off for PHI.

Informed Consent Considerations

If your informed consent forms predate your use of AI tools, they likely don't address it. Practices using AI for documentation should consider updating consent forms to disclose:

• That AI tools are used to assist with documentation and administrative work
• What categories of AI tools are used (local-only vs vendor-based with BAA)
• That the clinician retains full responsibility for all clinical work product
• That no clinical decisions are made by AI without clinical review

Adapt to your state's informed consent requirements and your professional licensing board's guidance.

“[Practice] uses certain artificial intelligence (AI) tools to assist with documentation, administrative writing, and clinical research. These tools operate either entirely on local devices controlled by [Practice] or under written Business Associate Agreements with the AI vendor consistent with HIPAA. AI tools assist with formatting, drafting, and summarization; they do not make clinical decisions. The treating clinician reviews all AI-generated work product and retains full clinical responsibility for your care.”

The 42 CFR Part 2 Consideration

For federally assisted programs that diagnose, treat, or refer patients for substance use disorders (“Part 2 programs”), 42 CFR Part 2 adds confidentiality protections beyond HIPAA. Disclosing their patient records generally requires the patient's written consent, with limited exceptions.⁹

This regulatory layer makes on-device AI particularly valuable — the consent requirement is for disclosure to third parties, and no third party receives information when AI runs locally.

Part of our AI by Profession cluster: See the pillar guide. For the broader compliance framework, see the step-by-step compliance guide. For the architectural foundation, see the On-Device AI pillarand our Therapists landing page.

Related reading: Can therapists use ChatGPT under HIPAA?, what the APA's AI guidance says, answering an insurance denial, and what to do when you're subpoenaed for records.