Is it HIPAA compliant to use AI for therapy notes?
AI note tools are business associates. What the BAA must cover, the questions to ask a vendor, how recording consent differs, and the risks no contract fixes.
Telehealth
HIPAA does not certify video products; it governs how a covered entity and its vendors handle protected health information. A telehealth session is compliant when the video is encrypted in transit, access is controlled and logged, and the vendor signs a business associate agreement covering the service. Consumer video tools generally fail the third condition, not the first.
Congruent's video runs inside the EHR, under the BAA we provide at no cost on both plans, and no session is recorded unless your client has consented in writing. HIPAA telehealth for therapists is less about the picture quality than about who is contractually on the hook for the recording, and where it goes afterward. How we handle protected health information.
One window
Telehealth stitched together from a separate video product means the clinical record is always one window away from the person you are talking to. You either interrupt the session to look something up, or you do not look it up, and the plan goes unmentioned for another fifty minutes.
Because the room is part of the chart, the things you would want mid-session are simply there — the current objective, what you tried last time and how it landed, the score that came back on Monday. Which is a small thing, twice a day, forty weeks a year.
Client waiting since 1:28 · connection good
On screen beside the video
Sample data for a fictional client. Recording off unless consent is on file.
After the call
A telehealth session is the one clinical encounter where the audio is already flowing through software you control. If your client has agreed to it, there is no reason that audio should not become the first draft of the note instead of evaporating the moment the call ends.
Consent comes first and it is genuinely optional — plenty of clinicians will not record, and the dictation path produces a comparable note. Where recording is used, the form is in the intake packet, the signed copy lives in the chart, and the audio is destroyed once the draft exists. How the note gets written →
Session ends
The appointment closes with its real start and stop time recorded, not the time you had scheduled.
Draft appears
If consent is on file, a progress note draft is waiting in the chart before you have stood up.
Check runs
The Golden Thread Check compares the draft against the plan and the diagnosis being billed.
Audio is deleted
Once the draft exists the recording is destroyed. It is never used to train any model.
Billing it
The clinical case for telehealth was settled years ago. The administrative case is still fiddly: place of service depends on where the client sat, most payers want a modifier, some want a location attestation, and a chart that is vague about any of it invites a question you will answer from memory much later.
Congruent captures those fields as part of the session rather than as a billing chore afterward, and carries them onto the claim. How claims are assembled from documentation →
AI note tools are business associates. What the BAA must cover, the questions to ask a vendor, how recording consent differs, and the risks no contract fixes.
Run one real telehealth appointment end to end — waiting room, plan on screen, note draft waiting when you close the window. The BAA is countersigned before you enter a single client's information.
30 days free · No credit card · Free migration and BAA