By Mike Chen · January 22, 2025

TL;DR: Which HIPAA Compliant AI Note Taker Should Therapists Use?

Pick Mentalyc or AutoNotes if you're a solo LCSW on a budget. Pick Upheal for mental health depth with DAP and SOAP output. Pick Nabla or Blueprint AI for group practices needing SimplePractice or TherapyNotes integration. A signed BAA is table stakes. What the BAA actually says is what matters.

Every tool on the shortlist below signs a Business Associate Agreement. That doesn't mean they're equal, and it doesn't mean you're safe. We've reviewed vendor BAAs where the subprocessor list was empty, the training data clause was ambiguous, and the breach notification window quietly exceeded the 60 days HIPAA requires. So this guide skips the marketing copy and gets into the clauses, note formats, and workflow trade-offs that actually matter to a practicing clinician.

For context on why this problem hurts: the American Medical Association's 2023 survey work on documentation burden puts clinician time on notes at several hours per week beyond scheduled sessions, and the National Academy of Medicine's Clinician Well-Being report links administrative load directly to burnout. Therapists are not immune. If anything, the emotional weight of the session content makes the after-hours charting worse.

Why Most AI Note Takers Aren't Actually HIPAA Safe for Therapists

Here's the first trap. General purpose transcription tools, Otter.ai and Fireflies being the two we see therapists accidentally use, do not sign BAAs for individual practitioners. As of our last check in January 2025, neither offers a BAA on standard plans. Running a therapy session through them is a HIPAA violation the moment PHI hits their servers.

PHI in a therapy context is broader than most clinicians realise. It's not just the client's name and date of birth. It's the diagnosis, the treatment plan, the session content itself, the fact that a person is receiving mental health care at all. Any AI tool that hears, transcribes, or summarises a session is handling PHI.

The rule you want to cite when a vendor pushes back is 45 CFR §164.308(b)(1), which requires a BAA with any business associate that creates, receives, maintains, or transmits PHI on your behalf. No BAA, no legal basis to hand over the data.

Psychotherapy notes get an extra layer of protection under 45 CFR §164.501 and §164.524(a)(1)(i). These are the therapist's personal process notes, kept separate from the chart. Most AI tools generate progress notes, not psychotherapy notes, and the distinction matters if you ever get subpoenaed or audited. Assume any AI-generated content is a progress note unless the tool explicitly documents otherwise.

The BAA Checklist: What Therapists Must Audit Before Signing

We've been through dozens of these agreements. The same weak clauses keep appearing. Here's what to check line by line before you enter a credit card.

Subprocessor disclosures. Does the BAA name which underlying providers touch PHI? OpenAI, Anthropic, AWS, Google Cloud, Azure. If the vendor uses a third-party LLM API, that provider is a subprocessor and needs its own BAA in place. A vendor that won't tell you their subprocessor stack is a vendor that either doesn't know or doesn't want you to know.

Breach notification timeline. HIPAA requires notification without unreasonable delay and no later than 60 days after discovery under 45 CFR §§164.400–414. Your BAA should match or beat this. We regularly see BAAs quoting 60 days from confirmation, which is not the same thing as discovery. Push for 30 days from discovery.

Data retention and deletion rights. Can you request deletion of session transcripts on demand? What is the default retention window? A tool that keeps raw audio for 90 days by default is a tool that gives an attacker or subpoena a 90-day window into your client's sessions.

Training data opt-out. This is the clause most therapists miss. The BAA must explicitly state that session audio, transcripts, and generated notes are not used to train the vendor's models or any subprocessor's models. Ambiguous language like "we may use aggregated de-identified data to improve services" is not good enough.

Data residency. US-only storage matters for state-level privacy laws like the California Confidentiality of Medical Information Act. If your vendor spins up processing in a region you can't control, you inherit that risk.

If any of that felt overwhelming, that's normal. Our team goes through this exercise weekly with practices, and it's the same reason we wrote a broader cybersecurity compliance requirements checklist for teams doing full vendor reviews.

The 5 Leading HIPAA Compliant AI Note Takers for Therapists: Compared

Pricing verified against vendor sites in January 2025. Confirm before purchase, these tools reprice frequently.

Nabla. Around $119 per clinician per month. Signs a BAA. Native integrations with several EHRs. Note quality is strong on medical SOAP formatting, which makes it a good fit for psychiatric or psychiatry-adjacent practices where a prescriber is also documenting mental status exams. Less tailored for pure talk therapy DAP output.

Upheal. Around $69 per month on the solo tier. BAA included. Built specifically for mental health, which shows in how it handles clinical language. Strong on SOAP and DAP. Its "session insights" feature that surfaces themes across sessions is useful but ethically complex, treat it as a prompt for your own reflection, not clinical truth.

Mentalyc. Starts around $29 per month. BAA included. Therapy-focused with support for SOAP, DAP, BIRP, and GIRP. Limited native EHR integrations, so expect to copy and paste into SimplePractice or TherapyNotes. Best fit for solo LCSW, counselors, or LMFT practices on a tight budget.

Blueprint AI. BAA available. Integrates with TherapyNotes and SimplePractice, which is the reason to pick it. Better suited to group practices where admin overhead of manual note transfer would kill the ROI.

AutoNotes. Around $19 to $29 per month. BAA signed. Template library covers BIRP and GIRP, which most competitors treat as afterthoughts. Good for high-volume solo practitioners who bill Medicaid and need format flexibility.

Two others show up in comparison articles that we'd flag with caution: Heidi Health leans toward general medical, verify current BAA terms for behavioural health use. Noteable's therapy specificity is thinner than the five above.

Therapy Note Formats: How Well Does Each Tool Handle DAP, BIRP, and SOAP?

Quick definitions. SOAP is Subjective, Objective, Assessment, Plan. DAP collapses subjective and objective into Data, then Assessment and Plan. BIRP is Behaviour, Intervention, Response, Plan, common in Medicaid billing and case management. GIRP swaps Behaviour for Goal, useful in goal-directed treatment plans.

Format specificity matters because LCSW licensure boards and Medicaid audits often require a specific structure. A DAP note submitted where BIRP is required can trigger a clawback. Insurance auditors don't care that the AI produced a fluent narrative.

Now the liability piece. If an AI mis-renders a clinical impression in the Assessment section and that note gets submitted to insurance, the clinician who signed the note owns the error. Not the vendor. The BAA transfers data handling responsibility, not clinical responsibility.

In our review of sample outputs, Upheal and Mentalyc produce cleaner DAP structure for talk therapy. Nabla's default leans medical SOAP, which reads clinically appropriate but can feel stiff for psychodynamic or humanistic work. AutoNotes is the most flexible on format switching within a single account.

Ethical and Liability Considerations Most Guides Ignore

Informed consent is not optional. The APA Ethics Code section 3.10 requires informed consent for services, and using an AI tool to process session content is a material fact clients are entitled to know. Update your intake paperwork. Get a signed acknowledgement. Do not rely on a verbal mention in the first session.

Some state boards have started to issue guidance, others haven't. Check your state licensing board's technology in practice statement before you assume general HIPAA compliance covers you.

Scope of practice risk is the one we push clients on hardest. Tools that auto-generate the Assessment section are generating clinical judgement. That is your job, not the model's. Treat every AI draft as a first pass by an intern who has never met the client. Review it, edit it, and take ownership before signing.

This is the same operator mindset we apply when helping practices choose adjacent tools like a HIPAA compliant phone service for therapists or a HIPAA compliant texting app. The vendor's BAA is necessary. It is never sufficient.

Solo Practice vs. Group Practice: Which Tool Fits Your Setup?

Solo LCSW, LPC, or LMFT. Prioritise low per-seat cost, quick setup, no IT overhead. Mentalyc or AutoNotes at $19 to $29 per month. If you're seeing 20 to 25 clients per week, the time savings pay for the tool within a fortnight.

Small group, 2 to 10 clinicians. Admin controls, per-clinician BAA coverage, and EHR integration start to matter. Upheal or Blueprint AI. Break-even on Blueprint AI versus manual export usually hits around 6 clinicians, because that's when copy-paste time overwhelms the savings.

Mid-size group, 10 or more clinicians. Per-seat pricing breakpoints, SSO support, audit logging. Nabla or an enterprise tier from Upheal. At 20 clinicians, negotiate. Nobody pays list at that volume.

Watch for tools that charge per audio hour rather than per seat. That model punishes high-volume practices. A clinician running 30 sessions a week at 50 minutes each is a very different cost profile from one running 15 assessment intakes.

Multi-clinician practices should also review broader vendor governance. Our guide to HIPAA compliance service providers covers the wider stack, EHR, secure messaging, backup, that surrounds the AI note taker.

How to Integrate an AI Note Taker Into Your Session Workflow

Step 1, pre-session. Update client consent forms. Confirm the BAA is on file with the vendor and countersigned. Store the executed BAA somewhere you can produce it during an OCR audit.

Step 2, during session. Start recording via the tool. Most integrate with Zoom, some with SimplePractice telehealth or Doxy.me. For in-person work, use a dedicated USB mic, not the laptop's built-in.

Step 3, post-session. Review the AI draft inside the tool's UI. Edit the Assessment section with your clinical judgement. Correct any misheard names, medications, or diagnoses.

Step 4, export. Push to your EHR if the integration exists. Otherwise copy the finalised note into TherapyNotes or SimplePractice manually.

Step 5, audit trail. Confirm the tool logs who edited the note and when. This is required for HIPAA audit readiness and gets asked about in every SOC 2 style review we've run against a therapy group's tech stack.

On time savings, vendor-published pilots typically claim reductions from 20 to 30 minutes per note down to 5 to 10 minutes of review. Take that with the appropriate salt, it's vendor data. Our own observation across practices we support is that the honest number sits closer to 8 to 12 minutes of review per note once the clinician's editing habits stabilise. Still material. Still worth doing.

FAQ

Can I use Otter.ai or Fireflies for therapy notes? No. As of January 2025, neither signs a BAA on standard plans. Any PHI processed through them is a HIPAA violation.

Does my AI note taker need a BAA even if I anonymise sessions? Yes. If any PHI including indirect identifiers is present, a BAA is required under 45 CFR §164.308(b)(1). True de-identification under the HIPAA Safe Harbor method is harder than most clinicians think.

Do I need client consent to use an AI note taker? In most states, yes. Check your licensing board's technology in practice guidance and update your intake forms. APA Ethics Code 3.10 applies.

Who is liable if the AI note contains a clinical error? The clinician who signs the note. Always review drafts before finalising. The vendor's BAA covers data handling, not clinical judgement.

What note formats do therapy AI tools support? SOAP is universal. Upheal, Mentalyc, and AutoNotes also produce DAP, BIRP, and GIRP. Verify current format support before purchase.

Does end-to-end encryption alone make a tool HIPAA compliant? No. AES-256 encryption in transit and at rest is necessary but not sufficient. You still need a signed BAA, audit logging, breach notification terms, and workforce controls on the vendor's side.

If you run a therapy practice and your vendor agreements haven't been audited for HIPAA compliance, book a free 30-minute audit with Mike. We'll review your BAAs and flag gaps before they become OCR problems. And if you're building out the broader compliance stack, our HIPAA compliant managed IT services guide is the next thing worth reading.