AI for Therapists (2026): What's Safe to Use, What Never to Paste, and What Note Tools Cost

TL;DR: Therapists can use AI today, and the line is the Business Associate Agreement (BAA). ChatGPT, Claude and Gemini on a personal or small-team plan don't come with one, so they're fine for marketing, handouts, policy drafts and letter templates, and nothing that identifies a client goes in. For session notes, use a therapy note tool that signs a BAA: as of November 9, 2026, Mentalyc starts at $14.99 a month (billed annually), Upheal's AI notes are $39, and SimplePractice's Note Taker is a $35 add-on. Then get the client's consent in writing. In Illinois that's the law.

Most "AI for therapists" pages are written by a note-taking vendor ranking itself first. This one lines up the general assistants and the therapy tools side by side, with every price read from the vendor's own page today.

What therapists actually use AI for (no client information needed)

A lot of the writing in a private practice never names a client. That part can start on any plan this week:

• Your website and directory profile. A Psychology Today bio, a services page, an about page that sounds like you.
• Generic psychoeducation handouts. "What to expect in your first session," a sleep hygiene sheet, a grounding exercise. You review every line, because it goes out under your license.
• Practice policies. Cancellation policy, a no-show email, a telehealth etiquette page, a draft of your AI consent form.
• Insurance letter templates. The appeal or prior authorization letter with blanks where the client details go, filled in later inside your EHR.
• Studying. Summarizing a CE article, comparing two treatment approaches, prepping for a licensing exam.

Session notes, treatment plans and anything about a specific client are the other half of the job. That half needs a tool that signs a BAA.

The never-paste list for ChatGPT, Claude and Gemini

On a plan with no BAA, keep these out entirely, even with the name removed:

• Client names, initials, dates of birth, session dates, phone numbers, email addresses, street addresses and record numbers
• Session audio, transcripts or your own process notes
• A screenshot of your EHR, a scanned intake form or a referral packet
• Small details that point to one person: "a 40-year-old firefighter in my town whose wife just left"

That last one catches people. HIPAA's de-identification rule goes well past names, and in a small town a job, an age and a life event can be enough to tell who it is. If you have to think about whether a detail identifies someone, it stays out.

Which AI tools sign a BAA, in one line each

No AI tool is HIPAA compliant on its own. A vendor can sign a BAA, a contract promising to protect the client information it handles for you, and that's the line between "fine for templates" and "fine for client work." As of November 2026:

• ChatGPT: no BAA on Free, Plus, Pro or Business. Covered paths are ChatGPT for Healthcare, Enterprise, the API, and ChatGPT for Clinicians for one verified clinician.
• Claude: no BAA on Pro, Max, Ultra or Team. Covered on Enterprise (20-seat self-serve minimum) and the API, once an owner turns it on.
• Microsoft Copilot: covered on a work account under Microsoft's commercial terms, where the BAA is included by default.
• Gemini: covered inside a Google Workspace account after an admin accepts Google's BAA. The free personal Gemini app is not.
• Otter.ai: Enterprise only, with the HIPAA add-on. Pro and Business are not covered.

Each one has its own page with the plan names, the settings and what stays outside even a signed BAA, all linked from the HIPAA compliant AI guide.

One wrinkle for therapists: OpenAI's free ChatGPT for Clinicians plan page names psychologists and "other licensed clinicians," but its help article lists only physicians, nurse practitioners, physician assistants and pharmacists. LCSWs, LPCs and LMFTs aren't named in either. If you want to try it, go through NPI verification and confirm the BAA shows in your account before any client information goes in. What's included and where its BAA stops is on ChatGPT for Clinicians.

Progress notes vs psychotherapy notes: what HIPAA says about AI notes

HIPAA gives "psychotherapy notes" extra protection, and therapists sometimes assume that covers anything written about a session. The federal definition is narrower. Psychotherapy notes are a mental health professional's notes "documenting or analyzing the contents of conversation" in a counseling session "that are separated from the rest of the individual's medical record."

The same definition then excludes medication monitoring, session start and stop times, modalities and frequency, test results, and "any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date."

Read that next to what an AI note tool writes: a summary of symptoms, interventions, progress and the plan, saved into the chart. By the definition, that's a progress note in the regular record, not a psychotherapy note. Two things follow:

• The AI note gets regular record rules. Psychotherapy notes need the client's authorization for almost any use or disclosure (45 CFR 164.508(a)(2)), and they're excluded from a client's right of access (45 CFR 164.524). A progress note has neither of those. Write it knowing the client may ask to read it.
• Your separate process notes are the sensitive ones. If you keep private notes apart from the chart, those are the notes with the extra protection. Keep them out of every AI tool, including the one that drafts your progress notes, unless your privacy counsel has signed off.

This is my plain-English reading of the rule text, not legal advice. Your state's mental health confidentiality law may be stricter.

Consent: Illinois made it law

Illinois' Wellness and Oversight for Psychological Resources Act (Public Act 104-0054, signed August 2025) is the clearest state rule on this so far. It applies to licensed clinical psychologists, social workers, counselors, marriage and family therapists and other licensed therapy providers in the state, and it does four things a solo practice should know:

1. AI notes are allowed. The law calls "preparing and maintaining client records, including therapy notes" supplementary support, and lets a licensed professional use AI for it while keeping "full responsibility" for the output.
2. Recorded or transcribed sessions need written notice and consent. Before AI helps with a session that's recorded or transcribed, the client has to be told in writing that AI will be used and "the specific purpose" of the tool, and give consent.
3. A terms-of-use click isn't consent. The law says consent doesn't include "the acceptance of a general or broad terms of use agreement." It has to be its own clear, written, revocable agreement.
4. Some things AI may not do at all: make independent therapeutic decisions, talk with clients therapeutically, produce treatment plans without your review and approval, or "detect emotions or mental states." Penalties run up to $10,000 per violation.

Outside Illinois, the recording itself is still a consent question: many states require every party to agree before audio is recorded. Mentalyc lists consent forms on every plan, and other note vendors publish their own templates. Use one as a starting draft, adapt it to your state, and keep the signed copy in the chart.

What AI note tools for therapists cost (read November 9, 2026)

The choice for a solo therapist comes down to whether you add AI to the EHR you already pay for or run a separate note tool next to it. Prices below are monthly, from each vendor's own pricing page:

Put together for one clinician: SimplePractice Essential plus Note Taker is $114 a month, TherapyNotes Solo is $69 before the TherapyFuel add-on, and Upheal's $39 AI notes plan sits next to whatever EHR you already have. At 25 sessions a week, Mentalyc's 40-note Mini covers under two weeks, so most full caseloads land on a bigger plan. The note takers built for general meetings, and the medical scribes like Freed, are compared by plan and price in HIPAA compliant AI note takers.

Three questions to ask any vendor before the first recorded session, in writing:

1. Is the BAA in place for my plan today, and where do I find the signed copy?
2. Is the session audio stored, and for how long are the transcripts kept after the note is signed?
3. Is any of my clients' data, even de-identified, used to train or improve your AI, and can I or my client opt out?

Where to start this week

If you're solo, start with the no-client-information list above on whatever AI you already have, and trial one note tool for 30 days with a signed consent form from every client in the trial. If you run a group practice, the bigger job is the office: which plan your front desk and billing staff are on, a written never-paste rule, and training so it sticks. That's what my AI consulting for healthcare practices covers. I don't sell a note tool and I don't configure your EHR.

Not sure which side of the line your practice is on? Book a free 30-minute strategy call and I'll tell you straight, including when the answer is a $35 add-on and no consultant.

This is a technology explainer, not legal or clinical advice. Your licensing board, your state's confidentiality law and your privacy counsel have the final word.

Sources

• 45 CFR 164.501, definition of psychotherapy notes; 45 CFR 164.508(a)(2), authorization for psychotherapy notes; 45 CFR 164.524, right of access. Read November 9, 2026.
• Illinois HB 1806, enrolled text (Public Act 104-0054, Wellness and Oversight for Psychological Resources Act). Read November 9, 2026.
• SimplePractice pricing: plans, Note Taker and Care Aide add-ons; SimplePractice, HIPAA-compliant AI note-taking guide (updated October 15, 2026): Note Taker under the existing BAA. Read November 9, 2026.
• TherapyNotes, December 2026 pricing updates: Solo $69, TherapyFuel pricing unchanged. Read November 9, 2026.
• Upheal pricing and Upheal Business Associate Agreement (effective March 25, 2026). Read November 9, 2026.
• Mentalyc pricing: Mini plan, BAA on every plan. Read November 9, 2026.
• ChatGPT, Claude, Microsoft and Google BAA lines: each vendor's own pages, read November 2 to 8, 2026, as cited on this site's per-tool HIPAA pages.