Yes — for the practice around the sessions, not the sessions themselves. Psychology-website copy, workshop materials, de-identified journaling prompts, insurance-appeal drafts with the details stripped.
But your floor is higher than any other solo business: a client's session content is the most sensitive category of information that exists, and the AI that helps you most — drafting, reflecting, summarizing — is exactly the use that touches it. The answer is yes with a structural condition, not a list of exceptions.
Session content — anything a client said, felt, or disclosed — is protected health information under HIPAA, the same law that governs a dental practice but with a harsher reality attached: your clients' trust is the treatment.
The most common AI mistake in a practice isn't a hack. It's a well-meaning paste: "client with panic attacks presented today with..." typed into a free chatbot to find a worksheet. That sentence just left your control — likely into a system that trains on what it's given.
Anything a client said — content, notes, even "I saw a client who..." with the details attached — never goes in a public tool. De-identify completely, or use AI that runs on your own machine where nothing leaves the room.
The de-identification bar is higher here than elsewhere: "a client with panic attacks" isn't de-identified if your town has one therapist. Combine a detail with your practice and it points at a person. When in doubt, don't paste it at all — the local option exists for exactly this reason.
Four uses with real payoff for a practice. Each links to the vetted review that covers it.
The phone-agent rule, restated for this practice: a caller in crisis may say identifying things — their name, their situation, sometimes their state of mind. Rosie publishes no HIPAA statement anywhere; Goodcall shows no confirmed independent security certification in its public record. For a practice, that settles it: Retell signs a HIPAA agreement self-serve at no extra cost, and Bland includes HIPAA in its standard rate.
The voicemail-only tier of the cheaper agents still works fine for "hours and address" duties.
Session notes or summaries — even "brief" versions. The notes are the client.
"A client who..." stories with the identifying details kept — presentation, age, occupation, and town together point at a person.
Crisis-related content — anything about a client's risk of harm goes to your emergency protocol, never to a chatbot for guidance.
Scheduling details with names — "Jordan, Tuesdays at 4, EMDR" is a client record, and a public tool is the wrong place for it.
The test that holds up to a client asking how their information was handled: if it would change what they told you, don't put it in the tool. The treatment depends on what they can say in the room.
Run any vendor through these before money moves. A good vendor answers plainly. A deflecting one tells you what you need to know.
AI doesn't need to be perfect in a practice — it needs to fail quietly and get caught. Three steps, in order:
Stop using the tool for anything client-related the same day. Don't test it with real content.
Write down what went where: which tool, what content, how much, how long ago. This record is what your carrier and your board will ask for.
Call your professional liability carrier before you decide what else to do — HIPAA breach timelines apply, and the call costs you nothing.
This is general information, not legal advice. A session note leaking from a tool is recoverable; the way it's handled is what clients remember.
A therapist's trade-off is the sharpest version of the one every solo practitioner faces: the help you want most — reflecting on session material, drafting between-session notes — is exactly the help that touches the client. The honest resolution isn't caution; it's structure. Public tools for the practice's public face. The local model for anything that carries client content, at $0 and behind your own door. Documented-compliance phone agents for the schedule line. Three lanes, one habit each.
What it protects is the thing the practice runs on: clients who can say anything in the room because they know where it goes. That promise is worth more than any workflow the AI could speed up.
Yes to AI for practice content, worksheets, and the phone — no to session content in public tools, ever. Run the reflective work locally where nothing leaves the room, put a HIPAA-signed agent on the schedule line, and when de-identifying feels hard, that's the signal not to paste it.
Twenty years building software for businesses like yours — cloud tools when they fit, your own machines when the data demands it. Fixed fee projects starting at $500, or a standing second opinion on your AI and software decisions from $300 a month.
Bring one real problem. You leave with a plan — whether we work together or not.
Prefer writing first? Enable JavaScript to see the email
"Most companies are selling you fear and complexity. He cuts through the bullshit and just fixes things. That's what partnership looks like."