Reviewed by: Matthew Sexton, LCSW
No, not without a business associate agreement: pasting identifiable session notes into ChatGPT is a disclosure, and the privacy rules for client records let a covered practice make it only after the company gives satisfactory assurance it will safeguard it. For solo and small-group therapists in private practice, the business associate rule was updated January 25, 2013; it matters now because chatbots are being used to draft notes, and it applies on ChatGPT or any AI tool, so before pasting, confirm a signed agreement or de-identified text. The source is the federal regulation, 45 CFR 164.502 and 164.504, checked October 6, 2026. It proves the agreement is required before a company handles client information. It does not prove a tool with an agreement is a good tool. Your next step: open the AI tool you use and find out, in writing, whether it signs a business associate agreement.
Key takeaways
- A company that receives or processes protected health information on a covered practice’s behalf is a business associate under federal rules.
- You may share client information with that company only after you obtain satisfactory assurance it will safeguard it.
- That assurance is a contract that sets what the company may do with the information.
- OpenAI requires a business associate agreement before its API is used with protected health information.
- Deleting a name is not the same as de-identifying a note.
Why is a chatbot a business associate?
A chatbot company can become a business associate when it handles protected health information on behalf of a covered practice. The federal definition in 45 CFR 160.103 covers an outside party that “creates, receives, maintains, or transmits protected health information” for work such as data analysis or processing. Paste a note into a chatbot for a summary, and the company receives and processes it.
This is not a question about whether the tool is smart. It is a question about who holds the information after you press enter.
What does the rule actually require?
It requires a promise in writing before the information leaves your hands. Under 45 CFR 164.502, a covered provider may let a business associate handle protected health information only “if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information.”
45 CFR 164.504 spells out what that assurance looks like. The contract must “establish the permitted and required uses and disclosures of protected health information by the business associate.”
The order in the rule matters: the assurance comes first, and the information comes second.
Is consumer ChatGPT different from the healthcare versions?
Yes, and the difference is the whole question. A Law Commentary report says OpenAI offers products that can operate inside regulated clinical settings, “while ordinary consumer chatgpt operates under a different privacy framework.” The same report says clinicians can violate HIPAA when identifiable health information is sent to a service without the agreements and safeguards federal privacy law requires.
OpenAI’s own Help Center states that an organization “must first enter into a business associate agreement” before using its API with protected health information. That sentence is about the API, not a personal chat account.
The tool is not the problem. The missing contract is.
What if I take the client’s name out first?
Taking the name out is a start, not a finish. Under 45 CFR 164.514, information leaves the rule only when it “does not identify an individual” and there is no reasonable basis to believe it can be used to identify one. Names are the first identifier on the regulation’s list.
Session notes are full of identifying detail. A job, a town, a family event can point to one person. Removing the name alone does not remove those details.
Who is responsible when the AI gets it wrong?
The clinician who signs the note still owns the review. A peer-reviewed viewpoint in the Journal of Medical Internet Research (October 5, 2026) lists clinical documentation among the places AI now enters psychiatric practice, and recommends that “clinicians should remain responsible for contextual, patient-centered judgment.” That paper is about European law, not HIPAA. Its point is that a draft from a tool does not replace the clinician’s own judgment.
A short check before any AI tool touches client records
Before you paste anything, run through this list:
- Does the company sign a business associate agreement, and have you signed it?
- Does the agreement cover the exact product you are using, not a different plan from the same company?
- If there is no agreement, is the text truly de-identified under 45 CFR 164.514, not just missing a name?
- Will you read and correct every line before it goes into the record?
Clients notice this too. People choosing a therapist on directories such as Couch Commons can ask how their records are handled, and a clear answer is part of a trustworthy practice. I have written before about who owns therapy data on AI platforms and who governs AI scribes.
Takeaway
The deciding question is not which chatbot you use. It is whether a business associate agreement covers the client’s information before it leaves your hands. If the answer is no, the rule gives the provider no basis to disclose identifiable notes to that company.
Frequently asked questions
Is it a HIPAA violation to use ChatGPT for therapy notes?
It can be. Sending identifiable client information to a service without the agreements and safeguards federal privacy law requires can violate HIPAA, according to Law Commentary. The deciding question is whether a business associate agreement covers the information.
Does OpenAI sign business associate agreements?
For its API, yes. OpenAI’s Help Center says an organization must first enter into a business associate agreement with OpenAI before using the API with protected health information.
Can I use ChatGPT if I remove the client’s name?
Removing the name alone is not enough. Under 45 CFR 164.514, information counts as de-identified only when it does not identify the person and there is no reasonable basis to believe it can be used to identify them. Names are the first of the listed identifiers.
Sources
All checked October 6, 2026.
- eCFR, 45 CFR 160.103 Definitions, https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
- Cornell LII, 45 CFR 164.502, https://www.law.cornell.edu/cfr/text/45/164.502
- Cornell LII, 45 CFR 164.504, https://www.law.cornell.edu/cfr/text/45/164.504
- Cornell LII, 45 CFR 164.514, https://www.law.cornell.edu/cfr/text/45/164.514
- OpenAI Help Center, Getting a Business Associate Agreement for the OpenAI API, https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai
- Law Commentary, Doctors Using ChatGPT With Patient Records Face HIPAA Privacy Rules, https://www.lawcommentary.com/articles/doctors-chatgpt-patient-records-hipaa-privacy-rules
- Journal of Medical Internet Research via PubMed, Liability and Standard of Care in AI-Driven Psychiatric Practice: European Viewpoint, https://eutils.ncbi.nlm.nih.gov/entrez/eutils/efetch.fcgi?db=pubmed&id=42832687&rettype=abstract&retmode=text
This article is general information for clinicians, not legal, billing or clinical advice.
If you're the therapist here.
Your clients get 4 sessions a month. The other 26 days they're on their own. VibeCheck.luxury is the between-session companion that carries those days back to you — clients check in daily, and you walk in already knowing what kind of week it was. Built by Matthew Sexton, LCSW, NATC.