Can I use AI to write my session notes?

Short answer: yes, but only with a tool whose vendor will sign a business associate agreement. HIPAA does not ban AI. It governs how patient information is handled, no matter what tool is touching it.

I am Scott Derby, I am an attorney, and this is the question I get most often from psychologists and mental health therapists right now.

People expect the answer to be a rule about artificial intelligence. It is not. HIPAA does not mention any particular technology, and it does not ban this one. What it regulates is patient information, and it follows that information wherever it goes.

So the useful question is not “is AI allowed.” It is: when you put patient information into this tool, where does it go?

If a tool stores or processes patient information, HIPAA treats that vendor the way it treats any other vendor handling your patients’ data. That means you need a signed agreement with them, called a business associate agreement, or BAA.

Here is the catch that catches people. The free consumer versions of the popular AI tools generally will not sign one. Some of their business and healthcare versions will. Same brand name on the screen, completely different situation under HIPAA. Practice owners see the familiar logo and assume the familiar terms.

The rule of thumb I give practice owners: no BAA, no patient information. If the vendor will not sign, nothing about your patients goes in. Not names, not initials with identifying details around them, nothing that could point at a particular person.

AI can absolutely have a place in a compliant practice. It just has to come through the front door.

This is general information about federal HIPAA. It is accurate as of writing and it can change. Your state very likely has its own privacy rules that sit on top of HIPAA and can be stricter, so treat this as a starting point rather than the final word, and check what applies where you practice. This is education, not legal advice for your specific situation.