HIPAA-Compliant AI Documentation

Setting Up AI Documentation the Right Way

Before you connect any AI tool to your practice, you need to verify compliance. This isn’t optional — it’s the foundation everything else rests on.

The HIPAA Compliance Checklist

Run through this checklist before using any AI documentation tool:

Requirement	What to Verify	Red Flag
Business Associate Agreement	Signed BAA available as part of signup	“We take privacy seriously” without an actual BAA
Data encryption	AES-256 encryption at rest and in transit	No mention of encryption standards
SOC 2 certification	Type II SOC 2 audit completed	Self-reported security without third-party audit
Data storage	Where data is stored, for how long, who can access it	Vague answers about data handling
Recording deletion	Session recordings deleted after note generation	Recordings stored indefinitely
PII redaction	Personally identifiable information removed from transcripts	Full names and details retained in transcripts
Breach notification	Process for notifying you of data breaches	No breach notification policy

The rule: If a vendor can’t clearly answer every item on this checklist, do not use them with client data.

The AI Documentation Landscape

Three types of tools serve different documentation needs:

AI Scribes (Session Transcription → Notes)

These tools listen to your session (with client consent) and generate formatted clinical notes:

Tool	Note Formats	Key Feature	Price Range
Mentalyc	SOAP, DAP, BIRP, GIRP	Pattern tracking across sessions	$$
Eleos	Multiple formats	Enterprise/group practice focus	$$$
Upheal	SOAP, DAP, paragraph	Budget-friendly, session analytics	$
Supanote	SOAP, DAP, BIRP	Clean interface, quick generation	$$

General AI with Clinical Prompts

ChatGPT, Claude, or Gemini with carefully crafted prompts for note generation — but with critical caveats:

Important: General-purpose AI tools (ChatGPT, Claude, Gemini) are NOT automatically HIPAA-compliant. If you use them:

Use the enterprise/business tier with a BAA (e.g., ChatGPT Enterprise, not ChatGPT Free)
Never enter client names or identifying information
Use anonymized session summaries, not raw transcripts

Dictation-Based Tools

You dictate a brief session summary; the AI expands it into a formatted note:

Session summary: 45-year-old female, 12th session. Discussed
relationship conflict with partner. Client identified pattern of
avoiding confrontation. Used Socratic questioning to explore beliefs
about conflict. Client recognized connection to childhood experiences.
Assigned thought record homework. Mood improved by end of session.
Next: continue exploring conflict avoidance patterns.

AI expands this into a complete SOAP or DAP note.

✅ Quick Check: Why might dictation-based tools be preferable to full session recording for some therapists? Because dictation gives you control over what enters the AI system. You summarize the session in your own clinical language, omitting identifying details and sensitive content that doesn’t belong in the note. The AI formats and expands your summary — but the clinical content is filtered through your judgment first. This approach is also less intrusive during sessions, as there’s no recording device running.

Note Format Quick Reference

Format	Sections	Best For
SOAP	Subjective, Objective, Assessment, Plan	Medical settings, insurance requirements
DAP	Data, Assessment, Plan	General counseling, streamlined documentation
BIRP	Behavior, Intervention, Response, Plan	Behavioral health, substance abuse
GIRP	Goals, Intervention, Response, Plan	Goal-oriented therapy

AI prompt for SOAP note generation:

Generate a SOAP note from this session summary:
[paste your dictated summary]

Format:
- Subjective: Client's reported symptoms, concerns, and subjective experience
- Objective: Observable behaviors, affect, appearance, mental status
- Assessment: Clinical formulation, progress toward treatment goals, diagnostic impressions
- Plan: Interventions for next session, homework, referrals, medication considerations

Use clinical language appropriate for the medical record.
Do not include any identifying information (use "the client" not a name).

✅ Quick Check: Why does the prompt specify “use clinical language appropriate for the medical record”? Because session notes are legal documents. They may be reviewed by insurance companies, auditors, other providers, or attorneys. AI tends toward conversational language unless instructed otherwise. Specifying clinical language ensures the output meets the professional standard expected in medical documentation.

Your First AI Note: A Step-by-Step Walkthrough

Complete your session as usual — no changes to your clinical process
Within 5 minutes of the session ending, dictate or type a brief summary (3-5 sentences capturing the key clinical content)
Paste the summary into your AI tool with the appropriate note format prompt
Review the AI output — check for clinical accuracy, add your unique observations (affect, nonverbal cues, therapeutic alliance)
Edit and finalize — typically 2-3 minutes of review and additions
File in your EHR — copy the finished note into your electronic health record

Total time: 3-5 minutes (vs. 10-15 minutes writing from scratch).

Key Takeaways

Verify HIPAA compliance before using any AI tool: BAA, SOC 2, encryption, data handling policies
AI scribes generate notes in SOAP, DAP, BIRP, and other formats — but you must review every note before filing
Dictation-based approaches give you more control over what enters the AI system than full session recording
General AI tools (ChatGPT, Claude) require enterprise tiers with BAAs for clinical use — never use free tiers with client data
AI captures words; you add the clinical context that makes notes therapeutically meaningful

Up Next: You’ll learn AI-assisted treatment planning — generating treatment plans with SMART goals that you refine and approve as the clinical decision-maker.