AI Notes for Therapists in 2026: The Tools, the Privacy Rules, and the Psychotherapy Note Trap

Therapists spend an estimated 30-40% of their working hours on clinical documentation. Progress notes, treatment plans, session summaries, and insurance-mandated formats like SOAP, DAP, and BIRP pile up after every session — eating into time that could be spent with clients, or simply recovering from a demanding emotional workload. AI therapy note tools promise to cut that documentation time to under five minutes per session, generating structured notes from session recordings, ambient listening, or typed summaries.

The time savings are real and the tools are genuinely good. But mental health documentation carries privacy considerations that most general AI scribe coverage glosses over — and one in particular, the legal distinction between psychotherapy notes and progress notes, can create real compliance exposure if a therapist misunderstands it. Mental health data is among the most sensitive information in healthcare, and the stakes of getting privacy wrong are correspondingly higher.

This article covers what therapists actually need to know about AI documentation in 2026: the leading tools, the privacy rules that apply specifically to mental health, the psychotherapy note distinction that trips people up, and how to evaluate a tool without compromising client trust. As always, this is informational, not legal advice — consult your licensing board and qualified counsel for your specific situation.

Why mental health documentation is different

Before evaluating tools, it's essential to understand why therapy notes get treated differently from general medical records — because this shapes every decision about AI tools.

Under HIPAA's Privacy Rule, mental health information receives heightened protection. Most significantly, HIPAA recognizes a special category called "psychotherapy notes" that gets stronger protection than virtually any other type of health information. Understanding this category isn't optional for therapists using AI — it's foundational.

The reason for the heightened protection is the nature of the work. Therapy sessions surface a client's most private thoughts, fears, relationships, and vulnerabilities. The trust that makes therapy effective depends on the client's confidence that what they share stays private. A privacy breach in therapy isn't just a regulatory problem — it can rupture the therapeutic relationship and cause genuine harm.

This is why the privacy posture of an AI tool matters more in mental health than almost anywhere else. A general medical scribe that's "good enough" on privacy may not clear the bar for therapy work.

The psychotherapy note trap

Here's the distinction that trips up many therapists, and it has direct implications for how you use AI documentation.

Under HIPAA, there are two categories of mental health documentation:

Progress notes are part of the client's medical record. They document the treatment provided, the client's status, the treatment plan, medications, symptoms, and similar information needed for treatment, payment, and healthcare operations. These are shared, when appropriate, with other providers, insurers, and as part of the medical record.

Psychotherapy notes are different. Under federal regulation (45 CFR 164.508), psychotherapy notes are the therapist's personal notes documenting or analyzing the contents of a counseling session — the therapist's observations, impressions, and reflections. They're kept separate from the general medical record. And critically: with few exceptions, HIPAA requires the therapist to obtain the client's written authorization before disclosing psychotherapy notes for any reason — including disclosure for treatment purposes to another healthcare provider. Verbal permission isn't enough.

The reason psychotherapy notes get this heightened protection, according to HHS guidance, is that they contain particularly sensitive information and are the personal notes of the therapist that typically aren't required or useful for treatment, payment, or operations by anyone other than the therapist who created them.

There are narrow exceptions — disclosures required by other law, such as mandatory reporting of abuse, and "duty to warn" situations involving threats of serious and imminent harm. But the default rule is that psychotherapy notes stay private and separate, releasable only with specific written client authorization.

Why this matters for AI tools: When you feed a session recording into an AI tool, you need to understand what category of note it's producing and where that data lives. A tool that blurs the line — mixing the therapist's private process reflections into the formal progress note — can inadvertently put heightened-protection content into the shareable medical record. The best AI therapy tools handle this explicitly. Twofold Health, for instance, applies configurable privacy filters to help separate sensitive psychotherapy process notes from formal progress notes. That separation isn't a nice-to-have — it maps directly to a real federal distinction.

Consent and the recording question

The second mental-health-specific consideration is consent to record.

When an AI tool listens to or records a therapy session, the client's session is being captured by a third-party technology. Best practice — and in many cases, legal and ethical requirement — is informed consent. Clients should understand that an AI tool is being used, what it records, where the data goes, whether it's used to train AI models, and who can access it.

Psychology Today's clinical guidance is direct on this: clients should be told what technologies are being used to record and create documentation, and should confirm those technologies are HIPAA-compliant — meaning strong encryption, a Business Associate Agreement between the therapist and the tech provider, and assurances that information from the recordings and AI won't be shared with marketers, AI developers, or other third parties without the client's explicit written permission.

There's also a state-law wrinkle: in two-party-consent (all-party-consent) states, recording a conversation without all parties' consent can violate state wiretapping laws. For therapists, this means obtaining and documenting client consent to AI recording isn't just good ethics — in many states it's a legal requirement. Build consent into your intake process and informed consent documents.

The leading AI tools for therapy notes

With the privacy foundation established, here are the tools built specifically for mental health documentation in 2026. As always, verify current pricing and BAA terms directly with each vendor.

Mentalyc

Mentalyc is among the most established dedicated behavioral health AI scribes, with pricing starting around $19.99/month and ranging to about $69.99/month for full features. It's built specifically for therapy, supporting SOAP, DAP, BIRP, PIRP, GIRP, and SIRP formats plus modality-specific templates for CBT, DBT, EMDR, and trauma-focused work.

Its privacy posture is among the strongest in the category: anonymized transcripts, no model training on client data, no session recording retention by default, and clear informed consent templates for clients. For therapists prioritizing both affordability and a strong privacy stance, Mentalyc is a natural starting point.

Upheal

Upheal is an AI-native platform built specifically for mental health professionals, founded in 2021. It combines therapy note generation with session analytics — surfacing conversational insights and patterns over time, not just notes. It offers a free tier with unlimited typed and dictated notes, with paid plans starting around $29/month for AI session capture features.

Upheal positions itself as more than a scribe — it includes HIPAA-compliant telehealth video, practice management features, and BAA coverage at every paid tier. For solo therapists who want documentation, telehealth, and analytics in one platform, Upheal consolidates several tools into one.

Twofold Health

Twofold Health offers flat-rate pricing (around $49/month annual, $69/month monthly) with unlimited notes, BAA at signup, and no audio retention. It supports multiple note formats including behavioral health (SOAP, DAP, BIRP, GIRP), and notably applies configurable privacy filters to help separate psychotherapy process notes from formal progress notes — directly addressing the psychotherapy note distinction discussed above.

Blueprint

Blueprint takes a measurement-based care approach, combining AI documentation with standardized clinical outcome tracking. It integrates validated assessment tools (PHQ-9, GAD-7, PCL-5, and 250+ others) directly into the workflow, automatically administering measures to clients and incorporating results into progress notes and treatment plans. For therapists who practice measurement-based care or whose payers require outcome measures, Blueprint's integrated assessments are a meaningful differentiator.

A cautionary category: tools that don't sign BAAs

One important warning. Some AI note tools marketed to therapists do not sign Business Associate Agreements and explicitly prohibit uploading PHI. AutoNotes, for example, has been noted as a budget option ($29-$69/month) that doesn't sign BAAs, placing the full HIPAA compliance burden on the practitioner.

A tool that won't sign a BAA cannot legally process your clients' PHI in a compliant way. For therapists, given the heightened sensitivity of mental health data, this should generally be disqualifying. If a tool prohibits PHI uploads, it's telling you it isn't built for compliant clinical use — no matter how good the notes are. Always confirm BAA availability before processing any session data.

How to evaluate an AI therapy tool

A practical evaluation framework specific to mental health practice.

Confirm the BAA first, before anything else. This is non-negotiable. No BAA, no PHI, full stop. Given the sensitivity of mental health data, this is even more important than in general medical practice.

Check how it handles the psychotherapy note distinction. Does the tool help you separate private process notes from the formal progress note? Tools with configurable privacy filters (like Twofold) handle this explicitly. If a tool dumps everything into one note, you'll need to manage the separation manually.

Verify the note formats you actually use. Therapy uses specialized formats (DAP, BIRP, GIRP, PIRP, SIRP) that general medical scribes often don't support. Confirm your formats are covered, and ideally that the tool supports your therapeutic modality (CBT, DBT, EMDR, etc.).

Understand the data handling. Where is session data stored? For how long? Is audio retained or deleted after processing? Is data used to train AI models? The strongest tools anonymize transcripts, don't train on client data, and don't retain audio by default.

Confirm informed consent support. Does the tool provide consent templates or guidance? Strong vendors give you client-facing consent language. You'll need to integrate AI recording consent into your intake and informed consent process regardless.

Check EHR/practice management integration. If you use SimplePractice, TherapyNotes, or another behavioral health platform, confirm the tool integrates or at least exports cleanly.

Consider your state's recording laws. In two-party-consent states, confirm your consent process meets the legal requirement for recording sessions.

Run a trial with real (consented) sessions. Note quality varies, and therapy notes are nuanced. Test with a few consented client sessions before committing. Most tools offer free trials or free tiers.

The clinical judgment question

One more consideration specific to therapy. AI scribes can misinterpret clinical nuance, and in mental health the nuance is everything. The difference between a client expressing a passing thought versus a genuine risk, between reporting a symptom versus describing a hypothetical, between the client's words and the therapist's clinical interpretation — these distinctions are clinically critical and exactly where AI can stumble.

As with all AI documentation, the therapist remains responsible for the note. The AI produces a draft; you review, correct, and finalize. For risk-related content especially — suicidal ideation, self-harm, threats to others, abuse disclosures — review the AI's capture against your own clinical memory carefully. These are the highest-stakes elements of any therapy note, and the ones where an AI error could have the most serious consequences. (Our article on AI scribe accuracy and hallucinations covers the general review workflow in more depth.)

The bottom line

AI documentation tools are a genuine gift to therapists, who carry one of the heaviest documentation burdens in healthcare alongside emotionally demanding clinical work. Cutting note time from 30-40% of your hours to a few minutes per session is transformative — both for capacity and for burnout.

But mental health documentation isn't general medical documentation, and the tools that fit therapy practice are the ones built with that difference in mind. The privacy stakes are higher, the psychotherapy note distinction is a real legal line, consent to record is both an ethical and often legal requirement, and the clinical nuance that AI can miss is exactly the nuance that matters most in therapy.

The practical path: pick a tool built specifically for behavioral health (Mentalyc, Upheal, Twofold, or Blueprint depending on your priorities), confirm it signs a BAA, verify it handles the psychotherapy note distinction, build AI consent into your intake process, and review every note — paying special attention to risk content — before finalizing. Do that, and you capture the time savings without compromising the trust that makes therapy work.

For a directory of AI tools built for behavioral health and therapy practices — with privacy details, note format support, and pricing — see our solo therapy practices page, our AI Therapy Notes use case page, and our full directory.

This article is informational only and does not constitute legal, clinical, or compliance advice. HIPAA regulations, state recording laws, and vendor practices vary and change. Always verify current vendor compliance and BAA availability, consult your professional licensing board's guidance on AI documentation, and seek qualified legal counsel for your specific practice and jurisdiction.