HIPAA-Compliant AI Scribe for Therapists: A Practical Checklist

A HIPAA-compliant AI scribe is one you can use without breaking the Privacy and Security Rules. No software is "HIPAA certified". There is no official certification. Compliance comes from the vendor's safeguards, the agreement you sign with them, and how you use the tool in your practice.

Most of what ranks for this topic is written for hospitals and medical groups. Therapy adds its own questions: session audio is some of the most sensitive data a clinician holds, and psychotherapy notes have their own rules. This checklist is for therapists.

When an AI scribe needs a Business Associate Agreement

If you are a covered entity under HIPAA and a vendor creates, receives, stores, or transmits protected health information on your behalf, that vendor is a business associate. An AI scribe that processes session audio or transcripts fits that definition. You need a signed Business Associate Agreement (BAA) before you use it with client data.[^1]

The BAA should cover the vendor's own subcontractors too. A scribe usually relies on at least a speech-to-text provider and a language model provider. Ask who they are and confirm the vendor has agreements in place with them.

No BAA, no client data. That one rule removes most consumer AI tools from consideration.

The checklist: ten questions to ask any AI scribe

1. Will you sign a BAA? Get it before the trial uses real client sessions.
2. Who are your subprocessors? Transcription, language model, hosting. Ask for the list and where each one processes data.
3. Is the audio stored? Some tools keep recordings indefinitely. Others process audio and discard it. Know which, and for how long.
4. What is kept, and for how long? Transcripts, drafts, and signed notes each need a retention answer.
5. Is client data used to train models? The answer you want is no, written into the contract.
6. How is data encrypted? In transit and at rest, at minimum.
7. Who can see what? Role-based access, so a colleague or an admin does not see your clients' sessions by default.
8. Is there an audit log? You should be able to see who accessed a record and when.
9. Where is the data hosted? Location matters for some contracts, payers, and clients outside the United States.
10. Can I export and delete? You need your records if you leave, and a deletion path when a retention period ends.

Cloud vendors that handle health information are business associates even if they say they cannot read the data. HHS has published guidance on exactly this point.[^2]

Therapy-specific questions most checklists miss

Risk language. A general medical scribe may compress a client's statement about self-harm into a vague summary. Ask how the tool handles risk content, and test it on a sample before you rely on it.

Psychotherapy notes versus progress notes. HIPAA gives extra protection to psychotherapy notes, the clinician's separate process notes. Progress notes are part of the record. An AI draft is a progress note. Do not let a scribe merge your private process notes into the record.[^3] If you need a refresher on note formats, see our therapy progress note template.

Consent to record. HIPAA does not by itself require consent to record a session, but your professional code, your licensing board, and state recording laws may. Get informed, written consent at intake, explain the AI's role, and offer a way to decline.

Sessions you do not record. If a client declines, the tool should still help. A scribe that can draft from your short written reflection keeps your documentation consistent without recording anyone.

Red flags

• The vendor will not sign a BAA, or says one is "not needed".
• The website says "HIPAA certified" or "100% HIPAA compliant" with no detail behind it.
• No answer about audio retention or model training.
• Notes go straight into the record without your approval.
• A consumer chatbot account used for client sessions. Personal ChatGPT, Gemini, or Claude accounts are not set up for your client data.

How Citt.ai answers the checklist

Citt.ai offers a Business Associate Agreement to United States practices. Client data is encrypted in transit and at rest, with role-based access and audit logging. Uploaded session audio is processed and not intentionally retained. Citt.ai stores the resulting transcript with the session. Production data is hosted on AWS in London, and AI providers process only what each feature needs under contractual controls. The full subprocessor list and retention summary are on Trust & Safety and in the privacy policy.

On the clinical side, Citt drafts notes in SOAP, DAP, BIRP, GIRP, psychodynamic, or your own uploaded format. Drafts stay drafts until you approve them, and signed notes keep a version history. Private reflections stay out of the client record. See how AI therapy notes work, and read what to automate in AI progress notes.