Are AI scribes safe for therapy notes? 7 questions to ask first

22 October 2026 · 7 min read

AI scribes can turn a session into a draft progress note in seconds. For therapists, that's hours saved every week, and a new set of risks, because the raw material is the most private conversation your clients will ever have. Before you switch one on, get clear answers to these seven questions.

Why therapists are cautious

AI scribes spread quickly in medicine, but mental health is different. Reporting by NPR and CBC has described therapists who value the time saved and others who worry that recording sessions could damage trust or expose deeply personal conversations in a breach. A 2025 study of primary care clinicians in New Zealand found that only 59% of those using AI scribes reported asking patients for consent, and that data security was among their top concerns.

None of this means AI scribes are off-limits. It means you need to know exactly what happens to the recording.

1. Where is the audio processed?

Most AI scribes send the session audio to the vendor's servers, where speech recognition and the language model run. Some tools now process audio on the device itself. On-device processing keeps the conversation off third-party servers entirely; cloud processing means you are trusting the vendor's security.

2. Is the audio stored, and for how long?

Look for a precise answer: is the recording deleted once the note is generated, after a fixed number of days, or kept until you delete it? The same question applies to the transcript and the draft note. "We retain data as long as necessary" is not an answer.

3. Is your data used to train their AI?

Check the privacy policy and terms for model training. Phrases like "de-identified data may be used to improve our services" deserve a follow-up question. For therapy notes, you want a clear statement that customer content is never used for training, or a way to opt out.

4. Will the vendor sign the right agreement?

In the US, a vendor that creates, receives, stores or transmits protected health information on your behalf is a business associate under HIPAA, and you need a Business Associate Agreement (BAA) with it. In the UK and EU, a vendor that processes personal data for you needs a data processing agreement under GDPR. If a vendor won't sign, don't use it with client data. Tools that process everything on your own device, without the vendor ever receiving the data, change this picture, so ask your compliance adviser how your rules apply.

5. How will you get informed consent?

Tell clients what is recorded, where it goes, how long it's kept, and that they can say no without it affecting their care. Do it in a conversation at the start, not only in an intake form clients scroll past. Recording laws also vary: some places require everyone in the conversation to agree.

6. What happens when you stop using it?

Make sure you can export your notes and delete everything the vendor holds, and that deletion includes backups within a stated time.

7. Do you need the session recorded at all?

An alternative many therapists overlook: dictate your own summary right after the session. Your client's voice is never recorded, you capture your clinical reasoning rather than a transcript, and the privacy footprint is far smaller, especially if the dictation is transcribed on your device.

Note: this guide is general information, not legal or compliance advice. Your licensing board, professional association and local law set the rules that apply to you.