AI Note-Takers in Therapy and Client Privacy

Several separate obligations apply at once. The first is recording law. In the United States, some states allow recording with one party's consent, while others require every participant's consent. Getting everyone's consent is the safe default in therapy regardless of the state. Professional ethics codes point the same way: the APA Ethics Code requires psychologists to obtain permission before recording voices or images. The second is HIPAA. Any vendor that creates, receives or stores protected health information for a covered provider is a business associate and must sign a business associate agreement (BAA). General-purpose meeting assistants built into consumer video tools often do not offer one. HIPAA also defines 'psychotherapy notes' narrowly: a clinician's private notes analyzing session content, kept separate from the rest of the record. They get extra protection. Most disclosures need the client's specific authorization, and clients do not have the usual right to access them. Medication details, session times, diagnosis, treatment plan, symptoms and progress are explicitly excluded and belong in the regular record. Guidance does not clearly say how raw recordings and full transcripts should be classified. That uncertainty is one reason many practices delete them promptly. The third is informed consent. It should be a real choice. Clients should be told what is captured, who processes it, where it is stored, how long it is kept, and that declining will not affect their care. The fourth is vendor vetting. A practice should find out whether data is used for model training. It should also ask which subprocessors, such as third-party AI model providers, handle audio, whether data is encrypted and where, what the retention defaults are, and how deletion is confirmed. Breach notification terms matter too. A common misconception is that a vendor's claim of 'HIPAA compliant' settles the question. Compliance depends on the signed agreement, the configuration and the practice's own policies. Substance use treatment records may also fall under the federal rules at 42 CFR Part 2.