AI for Therapists in 2026: Notes, Consent and the New State Laws

AI can draft a therapist's progress notes, suggest treatment plan updates and shrink the paperwork around a session, as long as the vendor signs a business associate agreement and your client consents. It can't deliver therapy or make clinical decisions, several states now say so in law, and you review everything it writes.

Vendor pages are good on features and thin on the questions that can cost you your license. So this guide starts from what you're allowed to hand over, then gets to tools.

Where a therapist's unpaid hours go

Documentation is the biggest block, and it's written into the job. The US Labor Department's O*NET database lists required treatment records and reports, mandated forms, diagnostic records and progress notes among a mental health counselor's duties, plus monitoring voicemail and email and following up on missed appointments. The government's handbook entry for counselors adds concise but detailed progress reports, discharge plans and referrals.

In a solo practice the same person also verifies benefits, resubmits denied claims, chases a late copay and answers the 9 p.m. message asking whether Thursday can move. Each of those carries a client's name, and that detail decides which AI you may use for it.

Sort every task by what the AI would see

The useful question isn't which AI is best for therapists. It's whether this task exposes client information, and whether it involves a clinical judgment. That gives you three groups: no client data (use almost anything), client data with a human decision (only a tool under a signed agreement), and clinical decisions (not a job for AI).

Watch for tasks that drift between groups. A cancellation policy has no client data. The same chatbot, asked to soften a message to a named client who missed twice, does.

What a signed BAA does, and what "HIPAA compliant" doesn't

A signed business associate agreement is the contract HIPAA requires before an outside company handles client information for you. Anyone who creates, receives, maintains or transmits protected health information on a covered provider's behalf is a business associate, and the assurances must be in writing. APA's tool guide, updated in October 2026, says the same about AI: if a tool handles client information for you, you need a signed business associate agreement.

A "HIPAA compliant" badge on a homepage is a vendor's claim, not that contract. Ask for the agreement itself, then ask three questions the marketing page may answer differently from one vendor to the next:

• Is there a BAA, and how do you get it? Mentalyc says its BAA is created when you sign up. SimplePractice says Note Taker falls under its existing BAA. Upheal's pricing page states HIPAA compliance without describing a BAA, so ask for it directly.
• What happens to the audio? Mentalyc says audio is deleted once the note is ready. Upheal deletes recordings by default but lets you keep them. SimplePractice documents how long it retains transcripts.
• Does your data train anything? Mentalyc says session data is never used for training. Upheal says de-identified session data may be used to improve its product, with an opt-out. SimplePractice says retained transcripts are de-identified and used only to improve its AI tools. APA suggests asking whether training is on by default and documenting your review.

If you run mail through Google, the same logic applies. Gmail and Google Calendar are on Google's covered list, but you must accept Google's BAA before using protected health information, and third-party apps and add-ons aren't covered by it. If client mail sits in that inbox, anything you connect to it needs its own agreement. For email itself, HHS allows unencrypted messages with reasonable safeguards, and a client can ask you to reach them another way. Our guide to sending encrypted email from a Mac covers the options.

A cash-only practice that never bills electronically may fall outside HIPAA's definition of a covered provider. That isn't a green light. Your licensing board and state confidentiality rules still apply, so check with them first.

Psychotherapy notes are not your progress notes

Under HIPAA, psychotherapy notes are a narrow category: notes documenting or analyzing session conversation, kept separate from the rest of the record. The definition excludes medication, session times, modalities, test results and summaries of diagnosis, treatment plan, symptoms, prognosis and progress. So the note most AI scribes draft is generally the ordinary progress note, which sits in the record.

The distinction matters because a covered entity generally needs the client's authorization to use or disclose psychotherapy notes, with narrow exceptions such as the note's author using them for treatment. HHS treats them differently from other mental health information for that reason.

Two practical points follow. Don't paste your separately kept process notes into an AI tool on the assumption that a BAA settles it. And the definition says nothing about AI transcripts, so ask your vendor and your attorney how a stored transcript should be treated if your session content is detailed.

Which states limit AI in therapy

Illinois, Nevada, Colorado, Maine, Vermont and Rhode Island have all passed laws that restrict AI in mental health care, and the common line is that administrative help is allowed and clinical work isn't. In Colorado and Nevada, a violation can mean board discipline, so read your own state's text. The Maine, Vermont and Rhode Island rows rest on a law firm's October 2026 summary, and none of this is legal advice. Tennessee's law targets how AI is advertised rather than how you use it, so it doesn't change the clinical limits below.

Telehealth complicates this, because a client may be sitting in a different state from you. Ask your board or attorney which state's rules apply before you turn on a scribe for out-of-state clients.

Recording a session takes more than one yes

Recording law and AI law are separate questions, and a session can trip either. Federal law permits recording when one party consents, but some states ask for more: California's Penal Code 632 reaches confidential conversations recorded unless every party agrees. In a couples or family session, everyone in the room counts. The state AI laws above then add their own written consent on top.

HHS adds a vendor point: a phone carrier that only connects a call needs no BAA, but an app or vendor that stores recordings or transcripts does. So a generic meeting bot shouldn't join a telehealth visit unless its maker has signed one. Our comparison of AI meeting note takers looks at business calls, not sessions, so don't read it as clearance.

Minors and clients with a guardian need their own process. APA's AI scribe guidance asks whether you have one for parents and guardians.

How to explain AI notes to a client

APA's ethics guidance calls informed consent about AI an obligation, and its tool guide says to update your consent process and paperwork to cover a tool's purpose, risks, benefits and limits. APA writes for psychologists, so counselors and social workers should also check their own boards. SimplePractice's guidance adds plain language, an opt-out and a verbal conversation, not only a form, and APA's Monitor suggests being ready to accommodate clients who are uncomfortable and asking at intake what role AI plays in their life.

Here's a starting point for that conversation. Keep only the bracketed wording that's true of your tool, and have your attorney or board check the written version against your state's requirements.

I use a software tool that helps me write my session notes.
[It records our session and creates a transcript / I dictate a summary afterward], and it drafts a note. I read and correct every note before it goes in your record. It doesn't make decisions about your care.

The company is bound by a privacy agreement with me. [Recordings are deleted after the note is ready.]

You can say no, now or at any point, and it won't change your care with me. I'll write those notes myself. If you'd like to think about it, we can start without it.

Where Merlin fits, and where it doesn't

Merlin is our assistant for the Mac, built around your email, calendar and calls. It should not be used with protected health information, and you shouldn't use it to record client sessions. Its privacy page states SOC 2 compliance and doesn't mention HIPAA or a BAA, so nothing here is a claim of HIPAA suitability. Paid plans upload recorded audio for transcription, and transcripts and notes live in your Merlin account, which is exactly the kind of handling that needs a signed agreement.

Merlin is also not a scribe, an EHR or a practice-management system. It won't pick up a phone, reply to a text, file a claim or hold a clinical record. Setup on your Mac requires connecting a Gmail and Google Calendar account, and Merlin reads them, so an inbox or calendar holding client names doesn't belong in it. Connect only a separate business account with no client correspondence.

With that boundary in place, it can help with the side of the practice that isn't clinical:

• Referral relationships. Merlin's People panel shows who you've stopped writing to, so a psychiatrist or school counselor you used to swap general practice news with doesn't fall away. Keep it to the relationship, never a specific client.
• Business threads. It flags direct email sitting unanswered for two days to a month, say from a landlord, an accountant or a conference organizer. Ask in chat and it drafts a reply you approve on a card before anything goes out.
• Calls that aren't sessions. A business consultant, an accountant or a panel rep can be recorded and transcribed on a paid plan, with their agreement, as long as no client comes up. If you run telehealth on the same Mac, turn off the meeting-detection banners in Settings → Preferences → Meetings.
• Errands and pages. Merlin can work in a browser to fill out a form for continuing education, and its Projects feature can build a simple practice website. A payment or a final submit waits for your yes.

One caution: routines, the tasks you schedule Merlin to run by itself, can send email without that card if you allow them, so keep any routine to a summary for you.

A first week that starts with the low-risk work

1. Look up your state. Read your state's AI law, if it has one, and your board's guidance. Call your liability carrier, which APA also recommends.
2. List your tasks by group. Use the table above and mark what touches client data. Move business-only email out of your clinical account if the two are mixed.
3. Start without client data. Use a general chatbot on your directory profile or cancellation policy, so you learn how it fails at no risk to anyone.
4. Update consent and get the BAA. Revise your forms before any client detail reaches a scribe, and note your review of the vendor, since APA suggests documenting it.
5. Trial one scribe with dictation. With clients who've agreed, dictate a summary after session, which tests note quality before you record anything. Record only clients who agree to that too.