Can therapists use AI for progress notes?
Yes — but not the way most people start.

Yes, with the right deployment — and not by pasting session content into a personal chatbot account at ten at night. No AI product is "HIPAA compliant" on its own. What matters is whether a Business Associate Agreement covers the exact tool and plan, where the processing happens, what's retained, and what your clients have been told.

Rules that may apply to you

Depending on what you do and who you serve, you may be subject to rules such as the ones below. We link the official sources and leave the interpretation to your compliance advisor, your counsel, or your professional association's ethics resources. This is a starting point, not a complete list, and nothing on this page says what these rules require of you.

• HIPAA — 45 CFR 164.501, Definitions(opens in new tab)
• HIPAA — 45 CFR 164.508, Uses and disclosures for which an authorization is required(opens in new tab)
• HIPAA — 45 CFR 160.103, Definitions(opens in new tab)
• California Confidentiality of Medical Information Act — Civil Code section 56.10(opens in new tab)
• California Confidentiality of Medical Information Act — Civil Code section 56.05(opens in new tab)
• California Confidentiality of Medical Information Act — Civil Code section 56.06(opens in new tab)

Why notes are the hard case

Documentation is the part of the job nobody trained for and everybody does after hours. AI is genuinely good at it: turn a clinician's shorthand into a clean SOAP or DAP note, keep the format consistent, flag a missing element. The obstacle has never been capability. It's that the raw material is the most sensitive thing a person will ever say out loud.

Therapy records may also be subject to stricter handling than ordinary medical records, and different kinds of notes may be treated differently, under the federal HIPAA rules linked above. Which of your documents fall into which category is a question for your compliance advisor, not for us. It matters for AI because a tool is usually set up for the ordinary progress note — and then a tired clinician pastes from wherever the detail happens to be.

California's layer

California practices may also be subject to the state's Confidentiality of Medical Information Act, and that law may reach some mental health apps and digital services as well as clinicians. The relevant sections are linked above. What they mean for a specific tool in your practice is for your counsel to say. It's a good reason to ask any AI note vendor how they see their own status under California law, and to get the answer in writing.

What to ask an AI note-taking vendor

1. Will you sign a BAA for this product, on this plan? Solo-practitioner tiers sometimes differ from group tiers. Get the product name into the agreement.
2. Does session content ever train or improve your models? Including "de-identified" content — ask how it's de-identified, and by whom.
3. If the tool records sessions, where does the audio go? How long is it kept, who can listen, and can it be deleted on request?
4. Which other companies process our data? Many note tools are built on a larger AI provider's service. Ask which one, and under what agreement between them.
5. What is retained after I delete a note or close my account?
6. Can your staff read client content? Under what circumstances, and is each access logged?
7. What do you suggest I tell clients? A vendor that has thought about consent language has usually thought about the rest.

Habits that matter more than the tool

• Structured input beats a transcript. A clinician's own bullet points — themes, interventions, response, plan — give the AI everything it needs to draft a note and expose far less than a verbatim session.
• Leave the name out of the prompt. The note lands in the right chart because you put it there, not because the AI knew who it was about.
• You sign it, so you read it. AI drafts are fluent and occasionally wrong. A confident sentence about something that didn't happen in session is the failure to watch for.
• No personal accounts. The fastest way to undo a careful setup is one clinician using the free app on their phone because it's quicker.

What we check when we deploy for a practice

• The server doesn't talk to the internet. Outbound traffic is blocked at the firewall, and we prove it by unplugging the uplink and drafting a note.
• Each clinician has their own login, and admin staff get a separate, narrower role — billing lookups, not clinical drafting.
• Drafts don't pile up. The drafting tool keeps what you decide it keeps. The finished note lives in your EHR, not in a second shadow record.
• Logs and backups are treated as client records, because that's what they contain.
• Our own agreement. We're willing to sign a BAA, and we'd have that conversation before we touch a system that holds client information.

What in-house AI changes

With a model on a machine in your own office, session content never goes to an outside AI vendor, so most of the questions above have a short answer: it stays here. A solo or small-group practice doesn't need a server room. Note drafting fits on a single 24GB graphics card in a quiet tower, in the $1,500 to $7,500 range, with no per-clinician subscription.

It doesn't replace your policies, your risk analysis, your consent conversations, or your judgment about what belongs in a note. For the broader question, see Is ChatGPT safe for business documents?