AI is quickly becoming part of clinical practice. Clinicians use it to summarize information, draft letters, create patient education, improve documentation, and reduce the time spent typing after hours.
But there is an important difference between asking an AI tool to rewrite a generic paragraph and giving it information from an actual patient encounter.
Once patient information is involved, HIPAA matters. In psychiatry and mental health, additional privacy requirements may apply, including protections for psychotherapy notes, federal substance use disorder records under 42 CFR Part 2, and state mental health confidentiality laws.
And simply removing the patient’s name does not necessarily make the information safe to paste into a general-purpose AI tool.
It depends on the tool and how it is being used.
If an AI company creates, receives, maintains, or transmits protected health information on behalf of a HIPAA-covered healthcare organization, it will generally be acting as a business associate. That usually means a Business Associate Agreement, or BAA, is required, along with the appropriate HIPAA privacy and security safeguards.
HHS specifically addresses this in its guidance on cloud computing and HIPAA. A vendor can still be a business associate even if the PHI it handles is encrypted and the vendor does not have the key to decrypt it.
HHS: Guidance on HIPAA and Cloud Computing
That is different from using a general consumer AI account or another AI tool that has not been approved to receive PHI.
Whether an AI model is open source or proprietary does not determine whether it is appropriate for use with PHI. An open-source model could theoretically be deployed inside an appropriately secured healthcare environment. A proprietary model could also be configured for healthcare use.
What matters is where the patient information is going, how it is handled, who can access it, what happens to it afterward, and whether the appropriate HIPAA agreements and safeguards are in place.
PHI stands for Protected Health Information.
Under HIPAA, PHI is individually identifiable health information created, received, maintained, or transmitted by a covered entity or its business associate.
This includes information about a person’s past, present, or future physical or mental health; healthcare provided to the person; or payment for that care, when the information identifies the individual or there is a reasonable basis to believe it could identify the individual.
In psychiatry, PHI can include diagnoses, medications, symptoms, psychiatric history, treatment plans, hospitalization history, insurance information, portal messages, and clinical notes when that information can be linked to a particular person.
One of the easiest mistakes to make with AI is assuming that removing the patient’s name makes the rest of the note anonymous.
It does not necessarily.
HIPAA recognizes two methods for de-identifying health information: Safe Harbor and Expert Determination.
Under the Safe Harbor method, 18 categories of identifiers relating to the patient, or the patient’s relatives, employers, or household members, must be removed.
They are:
Names
Geographic information smaller than a state, with limited exceptions for certain ZIP-code information
Dates directly related to an individual, other than the year, including birth dates, admission dates, and discharge dates
Telephone numbers
Fax numbers
Email addresses
Social Security numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate or license numbers
Vehicle identifiers and serial numbers, including license plate numbers
Device identifiers and serial numbers
Web URLs
IP addresses
Biometric identifiers, including fingerprints and voiceprints
Full-face photographs and comparable images
Other unique identifying numbers, characteristics, or codes
But there is another part of the Safe Harbor rule that is especially important when dealing with psychiatric narratives.
The covered entity must also not have actual knowledge that the remaining information could be used, alone or in combination with other information, to identify the patient.
In other words, HIPAA de-identification is not always as simple as deleting 18 fields from the top of a chart.
HHS: Guidance on De-identification of Protected Health Information
Consider a psychiatric note with the patient’s name, date of birth, home address, phone number, and other demographic fields removed.
The remaining note says:
“Patient is a 38-year-old mother who reports worsening depression despite sertraline 250 mg daily and trazodone 300 mg nightly. She is considering going off work and reports that an aide in the third-grade classroom she teaches could take over temporarily. In an emergency, she reports she would return to the Northwestern Medicine psychiatric unit in Winfield, Illinois, where she has previously received care.”
That paragraph doesn’t include the patient’s name.
But it still includes quite a bit of information about the person.
We know her age. We know she is a mother. We know what grade she teaches. We know something about her classroom staffing. We know the health system and town where she would seek psychiatric care. We know she has previously received care there. And we know a relatively unusual medication regimen.
That does not mean that “sertraline 250 mg” is itself one of the 18 HIPAA identifiers. It isn’t.
The issue is the combination of information.
A full psychiatric evaluation or encounter transcript can contain dozens of details like these. Taken together, they may make the patient identifiable even after someone has deleted the demographic section.
This is particularly relevant in psychiatry because so much clinically important information is contained in narrative text.
A psychiatric transcript may contain the patient’s employer, school, spouse’s occupation, children’s ages, hometown, recent hospitalization, court involvement, a rare medical condition, or a highly specific life event.
HHS specifically addresses de-identification in free-text fields. Safe Harbor is not limited to structured demographic fields in an electronic health record.
Not necessarily.
An entire encounter transcript may contain PHI throughout the conversation.
For example:
Clinician: How have things been since our last visit?
Patient: Worse. My principal told me I should probably take some time off. My classroom aide said she could cover the third graders if I need to be out for a few weeks.
Clinician: Are you still taking the sertraline?
Patient: Yes. I’m taking 250 mg every morning and trazodone 300 mg at night.
Clinician: If you felt unsafe tonight, where would you go?
Patient: Probably back to Northwestern in Winfield. That’s where I went before.
There may be no name anywhere in that transcript.
It is still information from an identifiable patient’s psychiatric encounter.
Removing the patient’s name does not automatically turn an entire clinical conversation into de-identified information.
This is why copying a transcript, psychiatric evaluation, progress note, portal message thread, or other clinical record into a general-purpose AI tool requires more consideration than simply stripping out the demographic header.
If a tool has not been approved to receive PHI, clinicians should not paste identifiable patient information into it.
The obvious information includes things such as:
Patient names
Addresses
Dates of birth
Telephone numbers
Email addresses
Medical record numbers
Insurance or beneficiary numbers
Specific dates of care
IP addresses
Photographs or biometric identifiers
But psychiatric clinicians also need to think about the narrative itself.
An entire psychiatric evaluation, therapy transcript, progress note, intake questionnaire, discharge summary, portal conversation, or patient message may contain enough information to identify the person even when their name is missing.
A practical rule is:
If the information came directly from an identifiable patient’s chart or encounter, do not assume it has been de-identified simply because you deleted the demographics.
There is no government certification that makes a software application “HIPAA certified.”
The HHS Office for Civil Rights does not endorse, certify, or recommend particular technology products.
HIPAA compliance involves the technology, the vendor providing it, the healthcare organization using it, and how PHI moves through the system.
For electronic PHI, organizations must address the confidentiality, integrity, and availability of the information through administrative, physical, and technical safeguards.
Depending on the system, that can involve:
Encryption
Authentication
Appropriate access controls
Audit controls
Security risk analysis
Risk-management procedures
Workforce policies
Incident response
Backup and recovery
Appropriate vendor and subcontractor relationships
The healthcare organization using the technology also has responsibilities.
A secure product used incorrectly can still create a HIPAA problem.
A Business Associate Agreement, or BAA, is a contract governing how a company may use and disclose PHI when it is acting as a business associate of a HIPAA-covered entity or another business associate.
For example, a healthcare organization might use an outside company for cloud hosting, medical billing, transcription, software services, or AI documentation.
If that company creates, receives, maintains, or transmits PHI on behalf of the healthcare organization, it may be a business associate.
A BAA establishes the permitted uses and disclosures of PHI and requires the business associate to use appropriate safeguards. It also addresses breach reporting, subcontractors, patient rights involving PHI, and what happens to PHI when the business relationship ends.
HHS: Business Associate Contract Requirements and Sample Provisions
A BAA is important, but a BAA is not magic.
Having one does not eliminate the need for security controls, risk analysis, workforce training, appropriate configuration, and proper use of the system.
No.
Encryption is an important safeguard, but it is not the entirety of HIPAA compliance.
HHS makes this distinction very clearly. A cloud provider that maintains encrypted ePHI on behalf of a healthcare organization can still be a business associate, even if it does not have the decryption key and cannot view the information.
HIPAA looks at whether a vendor creates, receives, maintains, or transmits PHI, not simply whether an employee of the vendor can open and read it.
Encryption also does not address every Security Rule requirement. Issues such as access, integrity, availability, risk management, backup, authentication, and incident response still matter.
Sometimes, but the terminology matters.
HIPAA generally treats mental health information the same as other protected health information.
A psychiatric evaluation, medication-management note, diagnosis, treatment plan, symptom description, or progress note does not automatically receive a different level of federal protection simply because it involves psychiatric care.
Important exceptions and additional laws apply.
One is HIPAA-defined psychotherapy notes.
Another is certain substance use disorder information protected under 42 CFR Part 2.
Individual states may also have their own mental health confidentiality statutes that provide protections beyond HIPAA.
The term psychotherapy notes has a very specific meaning under HIPAA.
It does not mean every note written by a therapist, psychologist, psychiatrist, psychiatric nurse practitioner, or other mental health professional.
HIPAA psychotherapy notes are notes a mental health professional records that document or analyze the contents of a counseling conversation and are maintained separately from the rest of the patient’s medical record.
The definition excludes information such as:
Medication prescribing and monitoring
Counseling session start and stop times
Treatment modalities and frequency
Clinical test results
Diagnosis
Functional status
Treatment plan
Symptoms
Prognosis
Progress to date
Those items are generally part of the ordinary medical record rather than HIPAA-defined psychotherapy notes.
True psychotherapy notes receive additional federal protection. With limited exceptions, HIPAA requires patient authorization before they are disclosed, including many disclosures to another healthcare provider for treatment.
HHS: Mental Health Information and Psychotherapy Notes Under HIPAA
This distinction matters in psychiatric documentation.
A SOAP note, psychiatric evaluation, medication-management follow-up, treatment plan, or progress note does not become a HIPAA psychotherapy note merely because psychotherapy was performed during the encounter.
42 CFR Part 2 is a federal confidentiality regulation protecting certain substance use disorder records.
It does not apply to every psychiatric clinician who treats a patient with a substance use disorder.
Part 2 generally applies to records maintained in connection with qualifying federally assisted substance use disorder programs and activities covered by the regulation.
The regulations were substantially revised in 2024 to align portions of Part 2 more closely with HIPAA. Compliance with the updated rule became mandatory on February 16, 2026.
Among other changes, the updated regulations permit a patient to provide a single consent for certain future uses and disclosures for treatment, payment, and healthcare operations.
Part 2 still contains protections that go beyond ordinary HIPAA requirements.
For example, protected Part 2 records generally cannot be used to investigate or prosecute a patient based on the patient’s SUD information without the consent or court process required by the regulation.
HHS: 42 CFR Part 2 Final Rule Fact Sheet
Clinicians who want to read the regulation itself can review the current version of 42 CFR Part 2 in the Electronic Code of Federal Regulations.
Electronic Code of Federal Regulations: 42 CFR Part 2
The current Part 2 regulations also provide additional protection for SUD counseling notes.
These are notes recorded by an SUD or mental health professional that document or analyze the contents of a conversation during an SUD counseling session and are maintained separately from the remainder of the patient’s SUD and medical record.
The concept is similar to HIPAA’s special treatment of psychotherapy notes, and SUD counseling notes are subject to specific consent requirements under Part 2.
HHS: Current 42 CFR Part 2 Guidance
HIPAA is federal law. It is not necessarily the final word on mental health confidentiality.
States can have their own statutes governing psychiatric records, mental health treatment records, therapy records, substance use information, treatment of minors, disclosure to parents, subpoenas, court orders, duty to warn, and other privacy issues.
Those laws vary significantly by state.
In some circumstances, state law protects mental health records more than HIPAA.
Illinois provides a good example.
The Illinois Mental Health and Developmental Disabilities Confidentiality Act states that records and communications created in the course of providing mental health or developmental disability services are confidential except as permitted by the Act. The statute also separately addresses certain personal notes therapists keep.
Illinois General Assembly: Mental Health and Developmental Disabilities Confidentiality Act
That does not mean Illinois law applies everywhere. It illustrates why mental health clinicians should not stop their privacy analysis after asking whether something is permissible under HIPAA.
For a multistate psychiatry practice, the applicable state mental health confidentiality law may also need to be considered.
PMHScribe was built specifically for psychiatry and mental health documentation.
That matters because psychiatric documentation is unusually dependent on narrative information. A clinical encounter may include medication history, family relationships, trauma, psychiatric hospitalization, substance use, legal history, suicidality, psychotherapy, and other highly sensitive information.
PMHScribe is designed for use with PHI within a HIPAA-regulated clinical workflow, rather than requiring clinicians to manually strip identifying information from a patient encounter before using the product.
PMHScribe provides a BAA for HIPAA-regulated customers.
This provides the contractual framework required for PMHScribe to handle PHI on behalf of covered healthcare organizations.
PMHScribe processes clinical encounters to generate documentation without maintaining a library of encounter audio recordings.
For practices using ambient documentation, that means the audio used to generate the note is not retained as an ongoing recording of the psychiatric encounter.
PMHScribe is not a general-purpose consumer AI interface being used as a substitute for clinical documentation software.
The platform was designed around psychiatric and mental health documentation, including psychiatric evaluations, follow-up visits, psychotherapy documentation, medical decision-making, patient education, and other clinical workflows.
No healthcare technology eliminates the clinician’s or organization’s own HIPAA responsibilities.
Practices still need appropriate policies, workforce training, access controls, secure devices, risk analysis, appropriate consent procedures, and processes for handling and releasing patient information.
AI can be used in healthcare.
The question is not whether a clinician uses AI.
The question is what information is being sent, where it is being sent, and what protections exist around it.
Removing a patient’s name from a transcript does not automatically make the transcript de-identified.
Signing a BAA does not automatically resolve every HIPAA issue.
Encryption by itself does not make a product HIPAA compliant.
Meeting HIPAA requirements does not necessarily resolve every privacy requirement in psychiatry.
For mental health clinicians, several layers of privacy law may apply:
HIPAA → special protections for psychotherapy notes → 42 CFR Part 2 when applicable → applicable state mental health confidentiality law.
That is why psychiatric information should be treated as clinical information first and AI input second.
Yes. HIPAA does not prohibit the use of artificial intelligence. Healthcare organizations can use AI as long as PHI is handled in accordance with applicable HIPAA requirements, including appropriate business associate relationships and safeguards.
Not necessarily. Removing a patient’s name alone does not satisfy HIPAA’s de-identification standard. Other identifiers and potentially identifying information may remain throughout the clinical narrative.
Only if the AI environment is appropriate for receiving the PHI contained in that transcript. A transcript can contain identifiable information throughout the conversation even if the patient’s name is never spoken.
HIPAA’s Safe Harbor method identifies 18 categories of identifiers that must be removed, including names, certain geographic information, most patient-related dates, telephone numbers, email addresses, medical record numbers, IP addresses, biometric identifiers, photographs, and other unique identifying information.
IP addresses are included among the identifiers that must be removed under HIPAA’s Safe Harbor de-identification method when they relate to the individual whose health information is being de-identified.
No. A BAA is an important contractual requirement, but HIPAA compliance also requires appropriate administrative, physical, and technical safeguards and appropriate implementation by both the healthcare organization and its business associates.
No. Encryption is an important security safeguard, but it is only one part of HIPAA compliance. HHS specifically states that a cloud service provider can remain a business associate even when it stores only encrypted ePHI and does not possess the decryption key.
No. HIPAA defines psychotherapy notes narrowly. Routine psychiatric evaluations, follow-up notes, medication-management notes, diagnoses, treatment plans, symptoms, and progress notes are not automatically psychotherapy notes.
No. Part 2 applies to qualifying federally assisted substance use disorder programs and covered records. Treating a patient who has a substance use disorder does not automatically make every psychiatric practice a Part 2 program.
Yes. States may impose additional confidentiality requirements for mental health, substance use, psychotherapy, treatment of minors, and other records. Healthcare organizations may therefore need to comply with both HIPAA and applicable state law.
Generally, no. Information that has been properly de-identified under HIPAA’s Safe Harbor or Expert Determination method is no longer considered PHI under the HIPAA Privacy Rule. However, simply deleting a patient’s name or demographic header does not necessarily de-identify the information.
U.S. Department of Health and Human Services, Office for Civil Rights
Guidance Regarding Methods for De-identification of Protected Health Information
Guidance on HIPAA and Cloud Computing
Business Associate Contract Requirements and Sample Provisions
Does HIPAA Provide Extra Protection for Mental Health Information?
42 CFR Part 2 Final Rule Fact Sheet
Federal Regulation
42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records
Example of State Mental Health Confidentiality Law
Illinois Mental Health and Developmental Disabilities Confidentiality Act
PMHScribe is an AI documentation platform built specifically for psychiatrists, psychiatric mental health nurse practitioners, therapists, counselors and behavioral health clinicians. Founded by practicing PMHNP Allison Sikorsky, PMHScribe helps clinicians turn patient encounters into structured psychiatric and mental health documentation while keeping the clinician in control of the final note.
