Yes, using AI for therapy notes is safe — if you use a purpose-built clinical tool that is HIPAA or GDPR compliant, signs a data agreement (BAA or DPA), encrypts data, and doesn't train its models on your sessions. It is not safe to paste client information into consumer chatbots like ChatGPT, which are not compliant and may retain or learn from what you enter.
The line that matters: clinical tool vs. consumer chatbot
The entire safety question comes down to one distinction.
- Consumer AI (ChatGPT, Gemini, Claude.ai) is not built for protected health information. Entering client details can breach HIPAA, GDPR, and your professional code of ethics.
- Purpose-built clinical AI (Eclio, Mentalyc, Upheal, etc.) is designed for health data — with legal agreements, encryption, and compliant infrastructure.
Same underlying technology, completely different legal and ethical standing.
Can I use ChatGPT to write therapy notes?
No. ChatGPT is not HIPAA or GDPR compliant, and OpenAI does not sign a Business Associate Agreement for standard accounts. Entering any client information — even with the name removed — risks a confidentiality breach, because clinical detail can still identify a person. This is the most common AI mistake therapists make.
What makes an AI notes tool actually safe
Before trusting any tool with session data, confirm all five:
| Safeguard | What to look for |
|---|
|---|---|
| Legal agreement | A signed BAA (US/HIPAA) or Data Processing Agreement (EU/GDPR) |
|---|---|
| No model training | Your sessions are never used to train the vendor's AI |
| Data residency | Servers in a region appropriate to your clients' law |
| Deletion control | You can export and permanently delete client data |
If a vendor can't answer these clearly, that's your answer.
The real risks (and how to manage them)
1. Data privacy and breaches
Any tool that stores health data is a potential breach target. Mitigate by choosing tools with encryption, compliance certifications, and a clear breach-notification policy.
2. Recording consent
In most jurisdictions you need the client's informed consent before recording or processing a session with AI. Build it into your intake paperwork and explain it plainly.
3. Clinical accuracy
AI drafts notes; it doesn't replace your judgment. Always review and edit before a note enters the record. The clinician remains responsible for accuracy.
4. Over-reliance
AI handles documentation, not the therapeutic relationship. Treat it as an administrative assistant, not a clinical decision-maker.
How to use AI for notes ethically
- Choose a compliant clinical tool — never a consumer chatbot
- Get informed consent — document it before recording
- Review every note — you sign off, you're responsible
- Minimize data — only process what the record genuinely needs
- Keep client control intact — honor access and deletion requests
The bottom line
AI note-taking is not inherently risky — careless tool choice is. A compliant, purpose-built clinical tool with consent and clinician review is a safe, ethical way to reclaim hours each week. Pasting sessions into ChatGPT is not. The technology is the same; the safeguards are everything.
Ready to compare compliant options? See the best AI therapy notes apps in 2026.