Guide

AI scribes in the therapy room: consent, review, and the record

Summary

Yes — most ethics codes and HIPAA treat an AI scribe the same as any other tool that touches protected health information: usable with informed consent, a signed business associate agreement with the vendor, and your review before the draft becomes the official note. Tell the client what the tool does, where the audio and transcript go, and how long they're kept. You remain responsible for the record whether a human or an algorithm typed the first draft.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

Can you use an AI scribe in a therapy session?

Yes. HIPAA and the major ethics codes treat an AI scribe like any other technology that creates, receives, or transmits protected health information — governed by the rules that already apply to your paper chart, your EHR, and your billing service, not banned outright. Ethics codes across the talk-therapy professions require you to disclose the technology used in a client's care and protect confidentiality across whatever medium carries it 1Ref 1American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That psychologists' ethics code requires disclosing technology used in a client's care and protecting confidentiality across the medium used.2Ref 2National Association of Social Workers (2021).NASW Code of Ethics.That social workers' ethics code requires informed consent and confidentiality protections for technology-mediated practice..

What changes with an AI scribe is the checklist you clear before you press record, not whether you may use one at all. Three things have to be true at once: the client has agreed to it, the vendor is under a signed contract that makes it accountable for the data, and you review the machine's draft before it becomes your official note. Skip any one of the three and the risk isn't the technology — it's the missing paperwork behind it.

The vendor is a business associate — get the agreement before the first session

An AI scribe vendor creates, receives, or transmits protected health information on your behalf, which makes it a business associate under HIPAA — a signed business associate agreement has to be in place before you record a single session, not after 4Ref 4HHS Office for Civil Rights (2026).Business Associates.That a vendor creating, receiving, or transmitting PHI on a practice's behalf is a business associate requiring a signed BAA before use.. The agreement should spell out how the vendor may use the data, how it's secured, how long it's retained, and what happens to it if you stop using the service.

Ask the vendor directly for its BAA rather than assuming a consumer-facing transcription tool offers one — many general dictation apps do not, and recording clinical sessions on one without a BAA is the kind of gap a breach investigation finds immediately. If the vendor can't produce a BAA, that's the answer: it isn't cleared for clinical use, whatever its marketing claims.

What happens to the raw audio, the transcript, and the draft

An AI scribe typically produces three artifacts — raw audio, a transcript, and a drafted note — and each has a different fate. Raw audio and full transcripts rarely need to survive once the note is finalized; many practices have the vendor delete them on a short retention window written into the BAA, while the finished, edited note goes into the permanent record under your usual retention schedule 3Ref 3American Psychological Association (2007).Record Keeping Guidelines.That documentation of consent and session content belongs in the clinical record, and that retention decisions for records and related artifacts follow standard record-keeping practice..

Decide in advance whether the AI-drafted content, before your edits, counts as part of the clinical record or as something closer to your own working notes. If you treat the unedited draft the way HIPAA already treats a clinician's separately filed psychotherapy notes — kept apart from the record you release on a routine request — say so in your documentation policy and file it separately 5Ref 5HHS Office for Civil Rights (2026).Does HIPAA provide extra protections for mental health information compared with other health information?.That psychotherapy notes are kept separate from the general record and require separate authorization to disclose — the model used for treating an unedited AI draft.. What you sign and finalize is the progress note; that's what a payer or a records request actually reaches.

Review, edit, and sign before the note is final

An AI-drafted note is not a finished clinical note until you have reviewed it, corrected it, and authenticated it with your signature — the same standard that already applies to any note someone else drafts on your behalf. Read every AI-generated note in full before signing; do not rely on the tool's summary being accurate, and correct anything that misstates what was clinically significant in the session 6Ref 6Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That services must be authenticated by signature, and that the clinician's review and signature is what finalizes a record someone else drafted..

Treat the AI output the way you'd treat a trainee's draft: useful, often close, but yours to verify line by line. A note that's wrong because the transcription engine misheard a word, or invented content the client never said, is still your note once you sign it — the signature is the attestation line that puts your judgment behind everything above it.

Telehealth sessions and the AI scribe

Running an AI scribe over a telehealth session adds one more layer: the platform carrying the video or audio and the scribe capturing it may be two different vendors, and each needs its own business associate agreement. Telepsychology guidance asks you to confirm the security of the specific medium you're using in a given session, not just the general category of video call 7Ref 7American Psychological Association (2013).Guidelines for the Practice of Telepsychology.That telepsychology practice requires confirming the security of the specific remote medium used in a given session..

The consent conversation still has to happen before the first minute of audio, whether the session is in your office or over telehealth — the teletherapy note covers what location, consent, and modality specifically add to a telehealth chart entry. And because recording therapy at all is a consent question independent of who's doing the recording — human or AI — the same disclosure rules apply if you record a session for supervision or training rather than for a scribe.

Fitting the AI scribe into your practice model

Whether an AI scribe is worth adopting often tracks the same operational choices that shape your documentation load elsewhere in the practice. A heavier telehealth caseload gets more use from automatic transcription than a mostly in-person one, so the hybrid decision about office versus telehealth mix and the scribe decision tend to arrive together. Introduce the consent language from first call to first session so no client is surprised by it mid-appointment.

If you're piloting a scribe, run it for a defined trial period with a handful of consenting clients before rolling it out to your full caseload, and keep your manual note-writing skills current — the tool fails, the login expires, or a client declines, and you still need to be able to write a complete note without it.

Common questions

Tell the client what the tool does, who the vendor is, where the recording and transcript are stored, how long they're kept, and that declining is an option — you'll write the note by hand instead. Document that conversation and the client's agreement in the chart. A clear verbal disclosure, documented, is enough in most settings; some practices add a signed line to the intake packet for good measure.

Yes, before you record anything. A vendor that transcribes or drafts notes from a session is creating, receiving, or transmitting protected health information on your behalf, which makes it a business associate under HIPAA. Ask for the signed agreement directly rather than assuming a transcription app has one — many consumer dictation tools don't, and using one without a BAA for clinical sessions is a compliance gap.

Yes. An AI-generated draft is not a finished clinical note until you've read it in full, corrected anything the tool misheard or invented, and authenticated it with your signature — the same standard that applies to a note anyone else drafts for you. Sign only what you've verified is accurate; the signature is your attestation that the record reflects the session.

That depends on your vendor agreement, not on any single universal rule — build a retention window into the BAA rather than assuming one exists. Many practices have the vendor delete raw audio and full transcripts once the note is finalized, keeping only the edited, signed note in the permanent record under your usual retention schedule. Confirm the deletion timeline in writing before your first session.

Treat it that way if you want the extra protection: file the unedited draft separately from the record you release on a routine request, the same separation HIPAA already draws for handwritten process notes. What you sign and finalize is the progress note that a payer or records request actually reaches — the unedited draft is not a substitute for either category, so define your policy in writing.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.American Psychological Association (2017). Ethical Principles of Psychologists and Code of Conduct. American Psychological Association. link ✓That psychologists' ethics code requires disclosing technology used in a client's care and protecting confidentiality across the medium used.
2.National Association of Social Workers (2021). NASW Code of Ethics. National Association of Social Workers. link ✓That social workers' ethics code requires informed consent and confidentiality protections for technology-mediated practice.
3.American Psychological Association (2007). Record Keeping Guidelines. American Psychological Association. link ✓That documentation of consent and session content belongs in the clinical record, and that retention decisions for records and related artifacts follow standard record-keeping practice.
4.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkThat a vendor creating, receiving, or transmitting PHI on a practice's behalf is a business associate requiring a signed BAA before use.
5.HHS Office for Civil Rights (2026). Does HIPAA provide extra protections for mental health information compared with other health information?. U.S. Department of Health and Human Services. linkThat psychotherapy notes are kept separate from the general record and require separate authorization to disclose — the model used for treating an unedited AI draft.
6.Centers for Medicare & Medicaid Services (2023). Complying with Medicare Signature Requirements. CMS Medicare Learning Network (MLN905364). link ✓That services must be authenticated by signature, and that the clinician's review and signature is what finalizes a record someone else drafted.
7.American Psychological Association (2013). Guidelines for the Practice of Telepsychology. American Psychological Association. linkThat telepsychology practice requires confirming the security of the specific remote medium used in a given session.

https://www.gale.care/for-providers/bhd-ai-scribe-therapy-consent · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers