Yes, on one of two lawful routes when the text identifies the client: a scribe vendor that has signed a business associate agreement with your practice, or a general tool fed nothing that identifies anyone. A third arrangement, a model on a machine in your office, sends nothing out. Past that it is a judgment call about consent and about what belongs in the chart rather than a chat window.
Two limits first. This is not legal advice, and we are not clinicians, so nothing here is a documentation standard or a script for what to tell a client. Regulation text below was read on eCFR on 13 August 2026.
The three arrangements
They differ in who ends up holding the session content, not in which product writes the tidier paragraph. A vendor turns your audio or rough notes into a draft under a signed agreement. Or a general tool sees only text that identifies nobody. Or the model runs on an office machine and nothing leaves.
Almost everything written on this describes the first, because the first has products behind it. The second is free and covers more of the week than therapists expect. The third is rare and occasionally right. Sorting the three is deciding what can leave the practice, as in any small firm.
Exhibit 1
Each route trades a different piece of the work, and the middle row is the part no contract removes.
Route A: the scribe with a signed agreement
Protected health information covers anything "transmitted by electronic media", so a paragraph typed into a chat box is the same category of thing as a claims file. The vendor handling it is a business associate: the definition catches anyone outside your workforce who does "data analysis, processing or administration" with it.
Which means paperwork: the assurances you get "must be documented through a written contract or other written agreement or arrangement". A line about bank-grade security on a pricing page is not that contract.
The part practices miss sits one level down. Most scribes call somebody else's model rather than run their own, and the rule saw that coming: business associate expressly includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate". Ask which provider sits behind the product, and whether an agreement covers it.
Route B: why removing the name is not de-identification
The standard is generous once you meet it. Information carrying "no reasonable basis to believe that the information can be used to identify an individual" is not individually identifiable health information at all, so the Privacy Rule stops applying and nothing needs signing.
Meeting it is the work. Safe Harbor strips eighteen categories of identifier, well past the name: geography smaller than a state, every element of a date except the year, contact details, record numbers, and a catch-all for "any other unique identifying number, characteristic, or code".
Then the clause that bites a small practice. Safe Harbor also requires that you "not have actual knowledge that the information could be used alone or in combination with other information to identify" the person. One high school in town. A presentation you have seen twice in a decade. A stripped paragraph can still be one person to anybody who knows the town, and you do. OCR says as much of both methods: "Although the risk is very small, it is not zero".
Exhibit 2
The identifiers come off between the chart and the chat window, not after.
Route C: the machine in the office
Run the model on hardware you own, operated only by your own workforce, and there is no business associate: the definition turns on a person acting other than as a member of your workforce, so nothing goes to an outsider and nothing needs papering under 164.502(e). That comes out of the definition itself, not from guidance.
The Security Rule does not move. You still have to "ensure the confidentiality, integrity, and availability of all electronic protected health information". On an office machine that means access control with a unique user identification per person, which the rule marks Required, audit controls that record and examine activity, and encryption, which is Addressable: implement it or write down why something else is reasonable.
The drafting is kinder to a two-person practice than people expect: in choosing measures you take into account "the size, complexity, and capabilities of the covered entity". One caution of ours rather than the rule's is that a setup phoning home for licence checks or a cloud fallback is not local. What the box costs and who patches it is another subject, covered in running the model on your own machine.
If you treat substance use disorder, the bar is higher
Federally assisted substance use disorder programs sit under 42 CFR Part 2 as well, and Part 2 wants a different piece of paper: a Qualified Service Organization Agreement. Its definition asks two things no software contract contains. The organization acknowledges that in "receiving, storing, processing, or otherwise dealing with any patient records from the part 2 program, it is fully bound by the regulations in this part". And it agrees that "if necessary" it "will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by the regulations in this part". You are asking a software company to promise, in advance, to fight a subpoena for your patient.
The scope is wide too: a Part 2 record includes "emails, voice mails, and texts", which is where a pasted prompt lives. With the agreement in place, the restrictions "do not apply to the communications between a part 2 program and a qualified service organization" doing the work. Whether any major AI vendor will sign a QSOA is an open question we have not answered. Ask in writing.
Consent, and what belongs in the chart
This is where our part stops: whether you tell a client that a tool helped draft the note belongs to your licence, your board and your own judgment. That is separate from the paperwork: a signed agreement makes the disclosure lawful and decides nothing about what you owe the person in the room. What you can settle this week is smaller: the chart is your record and carries the detail; the chat window should carry the least text that still gets a useful answer. When those two are the same text, you need the contract.
Choose in one sitting
Will the vendor sign, and will it name the subcontractors behind it? Does your text still identify the client to somebody who knows the town? Is there anyone here who would keep a machine patched and locked down? No to the first sends you to Route B, no to the second back to Route A, no to the third rules out Route C. If you want a second pair of eyes on the sort, that is the part we help with.
Common questions
Can therapists use ChatGPT for notes?
For text that identifies nobody, yes, on the same footing as any other writing task. For session content it turns on your plan and whether the vendor signed an agreement covering it, and the plans that carry one are usually not the plans people are logged into. That list moves every few months, so we keep it in one place: what HIPAA asks of any practice.
What makes an AI note taker HIPAA compliant for a therapy practice?
Nothing about the product by itself. A vendor can be eligible, meaning it will sign and has built controls you can use, but the duty stays with the practice, and there is nothing to certify against. Microsoft's own compliance documentation puts it plainly: "There's currently no certification standard that the Department of Health and Human Services approves to demonstrate compliance with HIPAA or the HITECH Act by a business associate."
Is an AI scribe different from pasting a session summary into a general tool?
Yes, and the difference is which rule you lean on. The scribe route leans on a contract permitting the disclosure. The paste route leans on the text not being protected health information at all. The first obligation is partly somebody else's; the second is entirely yours, decided in the second before you press paste.