Can I use ChatGPT for therapy notes without violating HIPAA?

You may use a ChatGPT product for therapy note information only when your organization has the right BAA, uses a service and feature covered by that BAA, completes its own risk analysis, and applies appropriate safeguards. A personal or ordinary business chat account is not enough. Keep PHI out until those controls are confirmed.

You will be able to decide whether a proposed therapy note workflow is ready for a formal privacy and security review.

Start with the account, not the prompt

HIPAA does not certify a product in isolation. HHS says a covered entity that uses a cloud service to create, receive, maintain, or transmit electronic PHI needs a business associate agreement with that provider and must still comply with the HIPAA Rules.

OpenAI now lists several HIPAA eligible products and configurations. Coverage is specific. Your contract, workspace, enabled features, retention settings, and actual workflow must match the terms of the BAA. A plan name on a pricing page is not proof that your account is covered.

Use this five part check before any patient information enters the workflow:

1. Confirm that your practice is using the exact product and workspace named in the BAA.
2. Confirm that every feature in the workflow is eligible under the agreement.
3. Complete and document a risk analysis for the full data path.
4. Limit access to staff who need it and train them on the approved use.
5. Require a clinician to review and correct every draft before it enters the record.

If one answer is missing, test with synthetic information instead of PHI.

Know which notes you mean

Progress notes and psychotherapy notes are not the same thing under HIPAA. HHS defines psychotherapy notes as a mental health professional's separate notes that document or analyze the contents of a counseling conversation. Those notes receive special protection.

This difference does not make routine progress notes safe to paste into any AI tool. It tells you that the data classification must be part of the review. Your EHR, payer rules, state law, licensing duties, and contracts may also affect the workflow.

Clinician example

A therapist wants help turning a short set of session facts into a draft progress note. She first tests the prompt with an invented patient. Her practice then checks the vendor agreement, eligible features, retention, access controls, and risk analysis. Only after approval does the team test the workflow with PHI. The therapist reviews each draft and remains responsible for the final note.

The unsafe version starts with a real note in a personal chat account and asks compliance questions later.

Your turn

Choose one note workflow and write five lines:

1. The exact account and feature you plan to use.
2. The information the tool will receive.
3. The agreement that covers that information.
4. The person who reviews the output.
5. The action staff take when the output is wrong.

You are ready for a privacy review when each line names a specific owner, setting, or document. "The vendor handles it" is not a complete answer.

Save this recap

• A BAA must cover the exact service and features you use.
• Your practice still needs a risk analysis and safeguards.
• Psychotherapy notes receive special protection.
• A clinician reviews the draft and owns the final record.
• Test with synthetic information until every control is confirmed.

Frequently asked questions

Does a BAA make every ChatGPT feature HIPAA compliant?

No. The BAA applies only to the eligible services and features named in the agreement. The practice must also complete a risk analysis, configure the service correctly, limit access, and follow the HIPAA Rules.

Can I paste psychotherapy notes into a personal ChatGPT account?

Do not put psychotherapy notes or other PHI into a personal ChatGPT account. HHS gives psychotherapy notes special protection, and OpenAI limits BAA coverage to named eligible products and configurations.

Can AI draft a progress note?

An approved AI service may draft a progress note when the workflow is covered by the required agreements and safeguards. A clinician should review and correct the draft before it becomes part of the record.