Do I need to tell therapy clients when I use AI?

HIPAA does not create one blanket rule that says every use of AI requires a separate patient consent form. Your notice of privacy practices must still describe how you use and disclose PHI, and some uses require authorization. State law, licensing rules, contracts, and the clinical context may add disclosure or consent duties.

You will be able to sort an AI use into the questions your privacy lead or counsel needs to answer.

Start with what the AI does

"We use AI" is too broad for a useful disclosure decision. Write down the actual task and data flow.

• Does the tool receive PHI?
• Is it acting on the practice's behalf under a BAA?
• Is the use for treatment, payment, or health care operations?
• Does the tool influence a clinical decision or speak directly to a patient?
• Is the information a psychotherapy note or a substance use disorder record with added protection?
• Does state law or a licensing board require a notice or consent?

HHS says a practice's uses and disclosures for treatment, payment, and health care operations must be consistent with its notice of privacy practices. HHS also distinguishes voluntary consent from a HIPAA authorization. When the Privacy Rule requires authorization, a general consent form is not a substitute.

Write a disclosure a patient can use

When disclosure is required or the practice chooses to provide one, use plain facts. Tell the patient:

1. What the tool does.
2. What information it receives.
3. Whether a person reviews the output.
4. Whether the tool makes or only supports a decision.
5. Who can answer privacy questions.

Do not promise that a system is error free or "fully HIPAA compliant." Describe the control that the practice has verified.

Clinician example

A therapist uses an approved service to draft a progress note after a session. The therapist reviews the draft before it enters the record. The practice asks counsel whether its current notice covers this health care operations workflow and whether state rules call for an added disclosure.

The practice might use this plain sentence after review:

We use an approved software service to prepare a draft of some documentation. Your clinician reviews and edits the draft before it becomes part of your record. Ask us if you want to know how your information is handled.

That sentence is a starting point for counsel, not a universal form.

Your turn

Write a five sentence patient explanation using the numbered list above. Then remove every product claim you cannot prove from a contract or written policy.

Your draft is ready for legal review when a patient can tell what happens to their information, what a person checks, and whom to contact.

Save this recap

• HIPAA does not require one universal AI consent form.
• Your notice must match your actual privacy practices.
• Some uses need a valid authorization, not general consent.
• State law and professional rules may add duties.
• A useful disclosure names the task, data, review, and contact person.

Frequently asked questions

Does HIPAA require consent for every AI assisted task?

No. HIPAA permits many uses and disclosures for treatment, payment, and health care operations without a separate authorization. The use must still fit the practice's notice, agreements, safeguards, and applicable law.

When is patient authorization different from consent?

HHS uses authorization for uses and disclosures that the Privacy Rule does not otherwise permit. A voluntary consent form does not replace a valid HIPAA authorization when authorization is required.

Should I disclose AI use even when the law is unclear?

A practice can choose a clear disclosure when it helps patients understand what the tool does, what information it handles, who reviews its output, and how to ask questions. Qualified counsel should review the language for the practice's state and specialty.