If AI scribes only generate progress notes, why does session audio privacy still matter?

Because the input to the AI scribe — the session audio and its transcript — captures everything the session generated, including material that would go into psychotherapy notes if the clinician had dictated them. A cloud AI scribe receives and processes the full session audio regardless of whether the output is a progress note or a process note. The vendor now holds a recording that contains the raw clinical material, the client's disclosures, and the clinician's in-session reactions — the exact content that psychotherapy notes are designed to protect. On-device processing means the audio and transcript never leave the clinician's computer, so the question of who holds that raw material does not arise.

Does HIPAA require a Business Associate Agreement for AI scribes that process session audio?

Yes. When a cloud AI scribe vendor receives session audio or transcripts on behalf of a covered entity (the therapist), the vendor is a Business Associate under HIPAA and a signed BAA is required. However, the BAA only covers the progress-note workflow — it does not change the legal exposure created by the vendor holding a copy of the raw session audio in their infrastructure. A BAA permits the disclosure; it does not un-disclose the audio or limit what can happen to it via subpoena, breach, or policy change. For more on what a BAA actually covers, see our companion post: What is a BAA, actually — and what it does NOT cover.

Blog · Compliance

Psychotherapy notes vs. progress notes: the HIPAA distinction AI therapy scribes must get right

Q: What is the HIPAA definition of psychotherapy notes?

Under 45 CFR 164.501, 'psychotherapy notes' means notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. The notes must be in a separate file from the medical record to qualify. Medication prescription and monitoring information, session start and stop times, modalities and frequencies of treatment, clinical test results, and summaries of diagnosis, prognosis, functional status, treatment plan, symptoms, and progress are all specifically excluded from the psychotherapy notes definition — these go into the progress note instead.

Q: Can patients access their psychotherapy notes under HIPAA?

Generally no. Under 45 CFR 164.524(a)(1)(i), the HIPAA right of access does not apply to psychotherapy notes. A covered entity may deny a patient's request to access their psychotherapy notes without giving the patient an opportunity to review the denial. This is one of the few areas where HIPAA explicitly limits patient access rights. Note that state law may be more protective — some states give patients broader access rights to psychotherapy records than federal HIPAA does, and in those states the state law controls.

Q: Do AI therapy scribes generate psychotherapy notes or progress notes?

AI therapy scribes generate progress notes — the structured clinical documentation (SOAP, DAP, BIRP, GIRP) that goes into the patient's medical record and may be shared with payers, supervisors, and treatment team members. Psychotherapy notes are the clinician's personal process notes — the raw clinical impressions, countertransference observations, and detailed session content that the clinician keeps separately and does not share broadly. An AI scribe is not suited to draft psychotherapy notes and should not be used for them; the output is always a structured progress note.

2026-05-31 · 1,950 words · All posts

TL;DR

HIPAA defines "psychotherapy notes" precisely — and they are not what AI scribes produce.
AI scribes draft progress notes (SOAP, DAP, BIRP, GIRP): structured clinical documentation that goes in the medical record and is shareable with payers and treatment teams.
Psychotherapy notes are the clinician's separate process notes — legally protected from patient access and payer disclosure.
The privacy concern is not about the output: it is about the input. Session audio contains everything — including the raw clinical material that psychotherapy notes protect.
On-device processing means the audio never leaves the clinician's Mac. The psychotherapy-notes distinction becomes a documentation workflow question, not a custody question.

Therapists who are evaluating AI session-note tools often ask a version of this question: "If my AI scribe produces my therapy notes, does that mean it is handling my psychotherapy notes?"

The answer is no — but the question reveals a genuine and important confusion about HIPAA terminology that is worth untangling carefully, because the answer has real consequences for how you structure your documentation workflow and how you evaluate the privacy claims of any AI scribe on the market.

What HIPAA actually means by "psychotherapy notes"

The term "psychotherapy notes" has a specific federal legal definition under 45 CFR 164.501. It does not mean "any notes a therapist takes." It means:

Notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record.

— 45 CFR 164.501 (emphasis added)

Critically, the regulation goes on to exclude a long list of items from the psychotherapy notes definition. The following are not psychotherapy notes — they are part of the regular medical record regardless of what you call them:

Medication prescription and monitoring information
Session start and stop times
Modalities and frequencies of treatment furnished
Results of clinical tests
Any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date

That last bullet is important. The moment a note summarizes the session in clinical terms — what the presenting symptoms were, what progress was made, what the treatment plan involves — it falls out of the psychotherapy notes category and into the ordinary medical record, subject to all standard HIPAA rules about access and sharing.

What progress notes are, and why AI scribes work on them

Progress notes — also called session notes, clinical notes, or visit notes — are the structured documentation that goes into the patient's official medical record. This is where SOAP (Subjective, Objective, Assessment, Plan), DAP (Data, Assessment, Plan), BIRP (Behavior, Intervention, Response, Plan), and GIRP (Goal, Intervention, Response, Plan) formats live.

Progress notes serve multiple operational functions:

They document medical necessity for insurance billing
They communicate clinical findings to other treating providers
They establish the treatment plan record for supervisors and consultation teams
They satisfy state licensing board documentation requirements
They provide the clinical record in the event of a complaint, audit, or legal proceeding

Because progress notes are structured, templated, and derived from observable clinical data, they are the natural target for AI-assisted drafting. TherapyDraft, for example, drafts DAP, SOAP, BIRP, and GIRP notes — not process notes, not raw session transcripts, not personal clinical impressions. The output is the structured clinical documentation that lives in the chart.

What psychotherapy notes are, and why they are different

Psychotherapy notes — sometimes called process notes or personal notes — are the clinician's own private record of their impressions, countertransference observations, hypotheses about the client's dynamics, and moment-to-moment clinical thinking during the session. They are not for billing, not for sharing with the treatment team, and not for the chart. They stay in a separate file and serve the clinician's own reflective practice.

HIPAA extends special protection to psychotherapy notes precisely because of this character. Under 45 CFR 164.524(a)(1)(i), the general right of access — the rule that patients can request and receive their own health information — does not apply to psychotherapy notes. A therapist can deny a patient's request to access their psychotherapy notes without affording the patient an opportunity to seek review of the denial. This is one of the few HIPAA provisions that explicitly reduces patient rights rather than expanding them.

Similarly, most permitted uses and disclosures under HIPAA that apply to the medical record do not automatically apply to psychotherapy notes. To disclose psychotherapy notes — even for treatment purposes, even to another treating provider — you generally need the patient's written authorization. The notes exist in their own legally protected compartment.

The AI scribe workflow only touches progress notes — so what is the real privacy concern?

Here is where the question gets more nuanced.

AI scribes draft progress notes, not psychotherapy notes. If your question is "will my AI scribe create psychotherapy notes," the answer is no — the output is always structured clinical documentation designed for the chart. You still write your own process notes separately, in your own hand, and keep them in your own separate file.

But the privacy concern is not actually about the output. It is about the input.

A session recording captures everything the session generated: the client's full disclosures, the emotional texture of the conversation, the moments that would later go into your personal process notes if you sat down to write them. The raw audio and transcript contain the unfiltered session — including material that you would protect under the psychotherapy notes category if you had dictated it.

When you send that audio to a cloud AI scribe, you are transmitting the full session to a third party. The output they return is a progress note. But what they received and processed is a recording that contains everything — the clinical material, the client's disclosures, the session content that your process notes would protect if it had been written down separately.

This is not a theoretical concern. Several legal proceedings since 2024 have tested whether session recordings held by AI vendors can be reached by subpoena. The vendor holds the recording. The vendor is a separate party. The psychotherapy notes privilege protects your written process notes — it does not automatically extend to a third party's copy of the audio that generated those notes.

What cloud AI scribes actually receive

For cloud-based AI scribes like Mentalyc, Upheal, Blueprint, Supanote, and Freed, the processing chain works roughly as follows:

The therapist records the session (or uploads a recording).
The audio is transmitted to the vendor's servers for transcription.
The vendor runs the transcript through a large language model to generate a structured draft note.
The therapist reviews the draft and pastes it into the EHR.

The vendor has received the full session audio. Their servers have generated a full transcript. Their LLM has processed both. The vendor's infrastructure now holds all of this, governed by their privacy policy, their BAA, and their subprocessors' policies — regardless of the fact that the output they delivered to you is only a structured progress note.

The detailed data-flow analysis of what cloud scribes transmit covers this in full. The short version: what leaves your device is far more than what appears in your chart.

The on-device difference

TherapyDraft processes session audio entirely on the clinician's Mac. Whisper.cpp runs the transcription locally on Apple Silicon; a quantized 7–14B language model drafts the note. Nothing — not the audio, not the transcript, not the note draft — is transmitted to any server for any purpose except a Stripe license check and an anonymous version update ping.

This changes the psychotherapy notes question completely. The full session audio stays on the clinician's device. There is no vendor holding a copy. The question "who has custody of the raw clinical material this session generated" has only one answer: the clinician who recorded it, on the device they own.

Your psychotherapy notes remain yours. Your progress notes are drafted by a local model on your Mac. And the audio that underlies both — the session recording that contains everything — never left your computer.

Practical workflow: keeping psychotherapy notes and progress notes separate

Regardless of which AI scribe you use, the following documentation structure is legally sound and supported by HIPAA's framing of the two note types:

Progress notes (chart file, shareable): Use your AI scribe for these. Review, edit, and attest the draft. Paste into your EHR. This document is part of the medical record, subject to standard access and disclosure rules, available for treatment coordination and billing.

Psychotherapy notes (separate file, your own): Write these yourself. Keep them in a clearly separate physical or digital location from the chart — not in the EHR, not in the same folder as the progress notes. These are your personal professional reflections: countertransference observations, hypotheses, clinical impressions that are not suited to the progress note format. Do not run these through any AI tool, including on-device tools.

The separation is not just a good-practice recommendation — it is a HIPAA definitional requirement. Notes only qualify for psychotherapy notes protection if they are "separated from the rest of the individual's medical record." Notes that are filed together with progress notes lose the special protection.

Some therapists use a simple naming convention: the EHR holds the progress notes; a separate encrypted note-taking app (or a physical notebook kept off-site) holds the process notes. The process notes never touch any cloud service, any AI tool, or any system accessible to the EHR vendor.

State law overlay

HIPAA sets the federal floor. State law can go further in either direction on access rights to psychotherapy notes. A few patterns worth knowing:

California: Patients have a broader right to inspect and copy mental health records under state law than HIPAA provides federally. The HIPAA psychotherapy notes exemption from access rights does not necessarily protect California therapists from state-law access requests.
New York: Mental Hygiene Law governs confidentiality of mental health records and in some respects is stricter than HIPAA on disclosure requirements.
Texas: Health and Safety Code Chapter 611 covers mental health records broadly and interacts with HIPAA's psychotherapy notes provisions.

If your state has its own mental health records statute, check how it treats the psychotherapy notes category specifically. The federal exemption from patient access may be narrower than you expect in your jurisdiction.

What this means for your AI scribe evaluation

When you evaluate any AI therapy scribe — cloud or on-device — the right question is not "does it produce psychotherapy notes?" It does not. The right question is: "What happens to the session audio and transcript that the AI scribe receives before it produces the progress note?"

For cloud scribes, that audio travels to the vendor's servers, gets transcribed, gets processed by an LLM, and is retained according to the vendor's privacy policy. The note output is a progress note. The input is the full session recording.

For on-device scribes like TherapyDraft, the audio stays on your Mac. The transcription and note generation happen locally. There is no vendor copy of the session recording, and no third party in the custody chain for the raw clinical material the session produced.

The psychotherapy notes distinction is real and legally meaningful. Understanding it also clarifies why the architectural argument for on-device processing is not just about the note that gets pasted into the EHR — it is about the full chain of custody for everything a therapy session generates.

No vendor copy. No session audio in the cloud.

TherapyDraft drafts SOAP, DAP, BIRP, and GIRP notes locally on your Mac. The audio never opens a network socket.

Join the waitlist — 10 free sessions, no card

Frequently asked questions

What is the HIPAA definition of psychotherapy notes?

Under 45 CFR 164.501, psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the contents of conversation during a counseling session, separated from the rest of the individual's medical record. Medication monitoring, session times, treatment modalities, clinical test results, and all summaries of diagnosis, prognosis, functional status, treatment plan, symptoms, and progress are explicitly excluded — these go into the progress note instead.

Can patients access their psychotherapy notes under HIPAA?

Generally no. HIPAA's right of access (45 CFR 164.524) explicitly exempts psychotherapy notes — a therapist may deny a patient's access request without review opportunity. State law may provide broader rights, however; California and New York both have mental health records statutes that interact with this federal exemption.

Do AI therapy scribes generate psychotherapy notes or progress notes?

AI scribes generate progress notes — structured clinical documentation (SOAP, DAP, BIRP, GIRP) that goes into the chart and is shareable with payers and supervisors. Psychotherapy notes are the clinician's personal process notes, written separately and not shared broadly. AI scribes are not appropriate for psychotherapy notes and should not be used for them.

If AI scribes only output progress notes, why does session audio privacy still matter?

Because the input — the full session audio and transcript — contains everything the session produced, including material that would otherwise go into psychotherapy notes. A cloud scribe vendor receives and holds that full recording even though the output is only a structured progress note. The vendor now has custody of the raw clinical material regardless of what the output format is.

Does a BAA cover psychotherapy notes when using a cloud AI scribe?

A BAA authorizes the Business Associate to handle PHI — including processing session audio. But a BAA does not prevent a subpoena from reaching the vendor's infrastructure, does not prevent a breach of the vendor's systems, and does not prevent vendor policy changes that might affect how long or how broadly the audio is retained. For the full analysis, see What is a BAA, actually — and what it does NOT cover.