You started using an AI scribe to cut your documentation time, and it works. Then a quieter question surfaces. Do your clients know? And do you have to tell them? It is one of the most common questions therapists are asking in 2026, and the answer has changed quickly as states pass new laws and ethics bodies sharpen their guidando therapists have to tell clients they use aice.
This article breaks down what the law actually requires, what professional ethics expect, when you clearly need consent, and how to handle disclosure in a way that protects both your clients and your license. None of this is legal advice, and the rules vary by state, so treat it as a map rather than a ruling.
The Short Answer
In most cases, yes, you should tell clients when AI is involved in their care, and in a growing number of situations the law now requires it. HIPAA on its own often does not force you to get separate consent to use a compliant AI tool, but that is only the federal floor. State laws and professional ethics increasingly point toward clear disclosure, and toward written, revocable consent before any AI records or transcribes a session. When the law is silent, transparency is still the safer and more ethical choice.
Three Different Questions Hiding Inside One
Most of the confusion around AI consent comes from blending three separate questions into one. They have different answers, and untangling them makes everything clearer:
- Does HIPAA let me use this tool at all? This is about whether the vendor has signed a Business Associate Agreement.
- Does my state law require me to disclose AI use or get consent? This is a fast-moving, state-by-state question.
- Do my professional ethics require disclosure? This is about client autonomy and informed consent, and it often goes further than the law.
A tool can clear the first question and still leave you with obligations under the second and third. Compliant to use is not the same as nothing to disclose.
What HIPAA actually requires, and what it does not
Under HIPAA, sharing protected health information with a business associate for treatment, payment, or health care operations generally does not require separate client authorization, as long as a signed BAA is in place. Documentation is a normal part of treatment and operations, so using a compliant, BAA-covered AI scribe usually does not trigger a HIPAA consent requirement on its own.
That surprises many therapists, but it is important to read it correctly. HIPAA permitting something is not the same as HIPAA being the whole story. It is the floor, not the ceiling. Two other layers sit on top: state law and professional ethics. And one HIPAA nuance still matters here, your private psychotherapy process notes receive stricter protection than general progress notes, so be careful which records an AI tool can see.
What State Laws Now Require In 2026
This is where the answer has shifted fast. By early 2026, eleven states had enacted around twenty laws directly regulating AI in mental health contexts, and more than 240 health-AI bills were introduced across the country in 2026 alone. The result is a real and uneven patchwork, and it applies wherever your clients are located, not only where you practice. For a telehealth practice that sees clients across state lines, that is a significant point. Here is how some of the most important laws break down for a clinician.
| State | Law | What it means for clinicians |
| Illinois | WOPR Act (2025) | Bans autonomous AI therapy. Requires specific, informed, written, and revocable consent before AI records or transcribes a session. Penalties up to $10,000 per incident. |
| Nevada | AB 406 (2025) | AI may be used for administrative work only, with independent clinician review of any AI output. Penalties up to $15,000. |
| Utah | HB 452 (2025) | Mental health chatbots must clearly disclose they are AI, not human. Bans selling or sharing identifiable mental health data. Offers a compliance safe harbor. |
| California | SB 243 and AB 489 (2026) | Requires disclosure for AI companions and crisis detection, and forbids AI from implying it is a human provider. Creates a private right of action. |
| Texas | SB 1188 (2026) | Requires providers to inform patients when AI is used in their treatment. |
| New York | AI companion law (2025) | Requires regular disclosure of non-human status and detection of self-harm signals for AI companion tools. |
The throughline across these laws is consistent. AI used purely behind the scenes for administration draws lighter rules. AI that touches the client directly, records a session, or could be mistaken for a human provider draws the strictest disclosure and consent requirements. The clear trend is toward more disclosure, not less.
What Professional Ethics Expect
Even where no state law applies, your professional obligations may. The core ethics codes that govern therapists, including those of the APA, ACA, NASW, and AAMFT, are built around informed consent and client autonomy. Clients have a right to understand the methods and tools involved in their care so they can make informed decisions about it.
Applied to AI, the emerging best practice is straightforward: give clients a plain-language explanation of how AI is used in their care and its limitations, offer a path to human review or a non-AI option for anything consequential, and scale the depth of consent to the level of risk. A tool that records and transcribes a session warrants a fuller conversation than one that drafts a note from your own typed summary. The APA has also urged psychologists to stay current with the laws in every state where they practice, because this area is changing quickly.
When You Clearly Need To Tell Clients And Get Consent
Some situations leave little room for interpretation. Disclose, and get consent, in these cases:
- Recording or transcribing sessions. Any ambient AI scribe that listens to a session needs clear, and in some states written and revocable, client consent before you use it.
- Any client-facing AI. Intake chatbots, screening bots, and automated messaging must disclose that the client is interacting with AI, never a human, and several states now mandate this.
- Anything that could influence clinical decisions. If an AI tool flags risk, suggests a diagnosis, or shapes a treatment plan, clients deserve to know and you must keep a human in the loop.
- Wherever your state, or your client’s state, requires it. For telehealth, the client’s location controls, so the strictest applicable rule wins.
When Disclosure Is Less Clear
Other uses sit in a grayer zone. AI that drafts a note from your own typed summary, with no recording, or pure back-office automation like scheduling, may be permitted under HIPAA through a BAA without separate consent. Many therapists still choose to disclose these uses, both because the legal trend favors transparency and because clients increasingly expect it. A short, honest line in your intake paperwork costs you nothing and protects trust.
By contrast, using a general AI tool to write a blog post, a newsletter, or a psychoeducational handout that contains no client information involves no PHI and no individual client, so it does not require client consent. That is ordinary marketing work, not clinical care.
| Need help getting your AI use compliant and clearly disclosed? We audit how AI touches your practice and build the consent language, policies, and safeguards around it. Book a free AI assessment. |
How To Write An AI Disclosure And Consent
Good disclosure is short, plain, and honest. Whether you put it in your intake packet, your informed consent document, or a dedicated AI policy, cover these points:
- That you use AI tools, and for what specific purposes, such as drafting notes or scheduling
- What information the AI can access, and confirmation that it is covered by a signed BAA
- That you, the clinician, review and remain responsible for everything the AI produces
- Whether sessions are recorded or transcribed, and that no recording happens without consent
- That the client can ask questions, request a non-AI alternative, and revoke consent at any time
Pair the written disclosure with a brief verbal mention during your first session, especially before introducing any tool that records. Keep the language at a reading level any client can follow. The goal is genuine understanding, not a buried checkbox.
Build It Into Your Practice The Right Way
Disclosure is not only a paragraph in a form. It is a system. Your intake paperwork needs updated consent language, your website should carry a clear AI and privacy policy, and any client-facing tool, such as an intake chatbot, must announce that it is AI and route anyone in crisis to a human and to the 988 Lifeline. Getting those pieces right is exactly what we build. Our AI optimization service sets up HIPAA-compliant AI for mental health practices with disclosure, consent capture, and crisis-detection safeguards built in, and our website development team can add the AI policy and updated intake flows to your site. We do this for therapists and group practices so the compliance work is handled before a client ever notices it.
| Make AI disclosure simple and done right. From consent language to client-facing safeguards, we handle the compliant setup end to end. Explore our AI optimization service. |
Frequently Asked Questions
Do I legally have to tell clients I use AI for notes?
It depends on your state and your client’s state. HIPAA alone often does not require separate consent for a BAA-covered tool, but several states now require disclosure, and some require written consent before AI records or transcribes a session. The safest approach is to disclose AI use clearly regardless.
Do I need written consent, or is verbal enough?
For lower-risk uses, a clear disclosure in your intake paperwork is often sufficient. For recording or transcribing sessions, some states, including Illinois, require specific, written, and revocable consent. When recording is involved, written consent is the safe default everywhere.
Does HIPAA require client consent to use an AI scribe?
Generally no, as long as the vendor has signed a BAA and the use falls under treatment or health care operations. HIPAA permits it, but state law and professional ethics may still require disclosure or consent, so HIPAA is not the final word.
What if my client lives in a different state than I do?
For telehealth, the rules of the state where your client is located generally apply. If you see clients across state lines, you need to meet the strictest applicable requirement, which is one reason a clear, universal disclosure is the simplest path.
Can a client refuse AI and still receive treatment?
Yes. Respecting that choice is central to informed consent. You should be able to offer a reasonable non-AI alternative, such as writing notes manually, for clients who decline. Build that option into your process before you need it.
Do I have to disclose AI used only for marketing or scheduling?
AI used to write marketing content with no client data does not require client consent. Scheduling automation that handles client information should run on a compliant system, and many practices disclose it as part of general transparency, though the requirement is lighter than for clinical or session-recording uses.
What happens if I do not disclose when my state requires it?
Consequences range from licensing board complaints to civil penalties that reach $10,000 to $15,000 per incident in some states, plus the harder cost of damaged client trust. Given how fast these laws are expanding, disclosure is the low-risk path.
The Bottom Line For Your Practice
Do you have to tell clients you use AI tools? Increasingly, yes. HIPAA may permit a compliant tool without separate consent, but state laws are moving quickly toward required disclosure, and professional ethics already favor it. The clearest rule to remember is simple. The more directly AI touches the client, especially when it records a session or could be mistaken for a human, the more clearly you need to disclose it and obtain consent.
Transparency is not a burden here. It is a trust advantage. Clients respect a therapist who is open about how their care works, and clear disclosure protects your license while the rules keep changing. Build it into your intake, your website, and your tools once, and you stop having to worry about it.
If you want help getting your disclosures, consent language, and AI safeguards right, that is what we do. Talk to our team about a compliant AI setup designed for your practice.
This article is for general information and is not legal advice. AI and mental health laws vary by state and are changing rapidly. Verify current requirements in every state where you practice and where your clients are located, and consult your licensing board and a qualified attorney before relying on any of the above.