ChartQuietEarly access

AI Note-Writing: Client Consent and Compliance Kit

For Florida private-practice counselors (LMHC), clinical social workers (LCSW), marriage and family therapists (LMFT) and psychologists. Sources checked October 23, 2026.

This kit is general information, not legal advice. Check with your attorney or your licensing board.

What is inside:

Numbers in brackets, such as [S1], point to the source list at the end. Each source is a primary document: a federal agency page, a professional association's code or guidance, a Florida statute or rule, or a vendor's own help page.

A. HIPAA and AI note tools: a one-page summary

1. Check whether HIPAA applies to your practice. The HIPAA Rules apply to "covered entities," which include "health care providers who transmit health information in electronic form in connection with a covered transaction" [S1]. If you are not sure whether your practice is a covered entity, ask your attorney. Your ethics code and Florida law protect client confidentiality either way (sections B and C).

2. An AI note tool that handles client information is usually a business associate. HHS lists "Independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician" and a "Cloud service provider engaged to create, receive, maintain, or transmit electronic PHI" as examples of business associates [S1]. HIPAA lets a covered entity share protected health information (PHI) with a business associate only after it gets "satisfactory assurances, in the form of a contract or other written arrangement," called a business associate agreement or BAA [S1].

3. A BAA has required contents. Among other things, it must describe what the vendor may do with PHI, say the vendor will not use or disclose PHI beyond that, require the vendor to follow the Security Rule, and require the vendor to report security incidents, including breaches, to you [S1]. It must also require the vendor to return or destroy PHI when the agreement ends, where feasible [S4].

4. Cloud storage counts, even when the data is encrypted. HHS says that if a covered entity uses a cloud service to process or store electronic PHI without a BAA, it "is in violation of the HIPAA Rules." This is true even if the cloud service stores only encrypted data and has no key [S4].

5. Share only what the note needs. The minimum necessary standard asks covered entities "to take reasonable steps to limit the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish the intended purpose" [S2]. In practice, that can mean dictating the clinical content a progress note needs, not a full account of the session.

6. Removing the name is not the same as de-identifying. HIPAA has two ways to de-identify health information: Expert Determination and Safe Harbor [S3]. Safe Harbor requires removing all 18 identifiers in the list below. The list covers the client and also the client's "relatives, employers, or household members." You must also have no actual knowledge that what is left could identify the person [S3]. A story with a rare job, a named workplace or a family event can still point to one person.

7. Consumer AI chat apps are a different product from clinical tools. Whether a vendor offers a BAA can depend on the plan you use. As an example, OpenAI's list of products it makes "available with a Business Associates Agreement" names ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and its API with Modified Retention [S8]. The individual Free, Plus and Pro plans are not on that list. For those plans, OpenAI says "we may use your content to train our models" unless the user opts out [S9]. ChatGPT for Clinicians is currently limited to physicians, nurse practitioners, physician assistants and pharmacists [S10]. The APA Ethics Committee wrote in 2023 that "Clinicians and trainees should not input identifiable client data into ChatGPT or other machine learning tools to protect confidential information" [S11]. Vendor plans change often, so read the vendor's current pages before you decide.

8. Breach notice runs through you. If a breach happens at a business associate, the vendor must notify you "without unreasonable delay and no later than 60 days from the discovery of the breach." Notices to affected individuals have the same 60-day outer limit [S5]. Florida has its own 30-day rule (section C).

9. The Security Rule update is still a proposal. HHS published a proposed update to the HIPAA Security Rule on January 6, 2025 [S6, S7]. As of October 23, 2026, the Federal Register still lists it as a proposed rule, not a final rule [S7]. HHS says "the current Security Rule remains in effect" while the rulemaking continues [S6].

The 18 Safe Harbor identifiers [S3]

Remove these for the client and for the client's relatives, employers and household members:

  1. Names
  2. Geographic units smaller than a state: street address, city, county, precinct, ZIP code (the first 3 ZIP digits may stay only in areas of more than 20,000 people)
  3. All parts of dates (except year) tied to the person, such as birth, admission, discharge and death dates; all ages over 89
  4. Telephone numbers
  5. Fax numbers
  6. Email addresses
  7. Social Security numbers
  8. Medical record numbers
  9. Health plan beneficiary numbers
  10. Account numbers
  11. Certificate or license numbers
  12. Vehicle identifiers and serial numbers, including license plates
  13. Device identifiers and serial numbers
  14. Web addresses (URLs)
  15. IP addresses
  16. Biometric identifiers, including finger and voice prints
  17. Full-face photos and comparable images
  18. Any other unique identifying number, characteristic or code

B. What your professional ethics code says

All four codes below ask for the same three things when you use technology with client information: tell the client, get informed consent, and protect the records. Each section quotes the standard so you can read it yourself.

Counselors: ACA Code of Ethics (2014)

The 2014 Code is the current ACA code. ACA is revising it and says that "until the final version is formally endorsed and adopted by the Board of Directors," the 2014 Code "remains the current version" [S13].

Social workers: NASW Code of Ethics (2021 update) and Technology Standards (2017)

NASW's Code applies its standards to technology too: "all ethical standards in this Code of Ethics are applicable to interactions, relationships, or communications, whether they occur in person or with the use of technology" [S16].

Marriage and family therapists: AAMFT Code of Ethics (revised, effective January 1, 2026)

AAMFT's revised code took effect January 1, 2026 [S18]. It names transcription services directly.

Psychologists: APA Ethics Code (2002, amended 2010 and 2016) and APA AI guidance (2025)

The Ethics Code amendments took effect January 1, 2017 [S19]. [UNVERIFIED: the apa.org Ethics Code page showed a security check on October 23, 2026, so we could not confirm that no revised code was adopted in 2026. The 2017 PDF is still served at the URL in S19.] The APA Ethics Committee says APA "is currently working on an updated" Ethics Code "which will include guidance around ethics and technology" [S11].

C. Florida notes

Confidentiality. For counselors, social workers and MFTs: "Any communication between any person licensed or certified under this chapter and her or his patient or client is confidential" (s. 491.0147, F.S.) [S21]. For psychologists: "Any communication between a psychologist and her or his patient or client is confidential" (s. 490.0147, F.S.) [S22]. Both sections allow a waiver "When the patient or client agrees to the waiver, in writing" [S21, S22].

Records, chapter 491 (LMHC, LCSW, LMFT). "Each psychotherapist who provides services as defined in this chapter shall maintain records" (s. 491.0148, F.S.) [S23]. Board rule 64B4-9.001, F.A.C., says records "shall remain confidential except as provided by law or as allowed pursuant to a written and signed authorization by the client," and "A full record of services shall be maintained for 7 years after the date of the last contact with the client or user" [S25].

Records, chapter 490 (psychologists). Section 490.0148, F.S., requires psychologists to maintain records [S24]. Board rule 64B19-19.0025, F.A.C., says "Written informed consent must be obtained concerning all aspects of services including assessment and therapy" and "Entries in the records must be made within ten (10) days following each consultation or rendition of service" [S26]. Rule 64B19-19.003, F.A.C., requires keeping complete records "for a minimum of 3 years" after services end or the last contact, whichever is later, and then the complete records or a summary "for an additional 4 years" [S27].

Florida Information Protection Act (s. 501.171, F.S.). Under this law, "personal information" includes a person's name together with "Any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional" [S28]. The law says:

AI-specific bills. In the 2026 session, SB 344 and HB 281 would have restricted the use of artificial intelligence in psychology, clinical social work, marriage and family therapy and mental health counseling. Both bills died in committee on March 13, 2026 [S29, S30]. New bills may be filed in later sessions.

D. Sample client consent form: AI-assisted documentation

How to use this form: fill in each blank. Delete any line that does not match how you work. Have your attorney review it before you use it. It is written in short, plain sentences so most clients can read it easily.

[Practice name] Consent to Use an AI Tool for Writing My Session Notes

Why you are getting this form

After each session, I write a progress note. This is a short record of what we worked on. I am asking if I may use a computer tool to help me write these notes. The tool uses artificial intelligence (AI). You can say yes or no. Your choice will not change your care.

What I do

What information the tool gets

About the company that makes the tool

Possible risks

Possible benefits

Your choices

Questions or concerns

Contact: ____ Phone or email: ____

Your decision (check one)

☐ Yes. I agree that my therapist may use the AI tool described above to help write my session notes.

☐ No. Please do not use an AI tool for my session notes.

Client name: ______

Signature: ______ Date: ______

If signed by a parent, guardian or legal representative: Name and relationship: ______

Clinician name and license number: ______

Signature: ______ Date: ______

E. Vendor checklist: 12 questions to ask any AI note tool

Ask for the answer in writing. A "No" or "I don't know" on questions 1 to 6 is a reason to stop and get advice before you use the tool with client information.

# Question Yes / No Why it matters
1 Will you sign a Business Associate Agreement (BAA) with me before I enter any client information, on the plan I will actually use? ☐ / ☐ HIPAA requires a BAA before a business associate handles PHI [S1, S4]. Some vendors offer a BAA only on certain plans [S8].
2 Does the BAA require you to report security incidents and breaches to me, and to return or destroy my data when I leave? ☐ / ☐ Required BAA terms [S1, S4].
3 Is my data excluded from training or improving your AI models, by default and in writing? ☐ / ☐ Some consumer plans may use content for training unless the user opts out [S9]. NASW and APA ask you to know how data is used [S17, S20].
4 Is audio of my dictation deleted after the draft is made? How many hours or days later? ☐ / ☐ AAMFT 1.11 names audio and transcription services [S18]. Less stored data means less to protect.
5 Can you tell me how long you keep drafts, transcripts and finished notes, and can I delete them myself? ☐ / ☐ NASW Standard 3.01: clients should know how information "will be retained" [S17].
6 Is my data stored and processed in the United States? Can you name the cloud providers you use? ☐ / ☐ Cloud providers that store PHI are business associates too [S4]. ACA H.5.a asks you to tell clients how records are kept [S12].
7 Is data encrypted in transit and at rest? ☐ / ☐ ACA H.2.d asks counselors to use "current encryption standards" [S12].
8 Do you offer multi-factor sign-in and automatic logout? ☐ / ☐ NASW 1.07(l): records should not be available to people not authorized to see them [S15].
9 Can you tell me which of your staff can see my data, and is that access logged? ☐ / ☐ ACA H.2.b: clients should know who "might have authorized or unauthorized access" [S12].
10 Will you notify me of a breach within 10 days, so I can meet Florida's 30-day client notice? ☐ / ☐ Florida requires a third-party agent to notify within 10 days, and individuals within 30 days [S28]. HIPAA's outer limit for a business associate is 60 days [S5].
11 Can I review and edit every note before it is final, with nothing sent to my records system automatically? ☐ / ☐ AAMFT 6.2 and APA AI guidance: you make the decisions and check AI output [S18, S20].
12 Can I export all my notes and close my account without losing records I must keep for 7 years (chapter 491) or 3 plus 4 years (psychologists)? ☐ / ☐ Florida record retention rules [S25, S27].

F. What to tell a client who asks

Short answers you can adapt. Use your own words.

"Are you using AI on me?" "I use a tool that helps me write my notes after our session. I don't record our sessions. After you leave, I give the tool a short summary, it makes a draft, and I check and fix every word. I only use it if you agree."

"Is my information safe?" "The company has signed a written agreement with me to protect health information. [If HIPAA applies to your practice:] Federal privacy law requires that agreement. Your information is stored in [location] and the audio is deleted [when]. No system is perfect, and if something ever went wrong, I would tell you."

"Does the AI learn from my sessions?" "[If true:] No. The company has agreed in writing not to use my clients' information to train its AI."

"Can I say no?" "Yes. I will write your notes the usual way, and nothing about your care changes. You can also change your mind later."

"Who reads my notes?" "I do. Your notes stay in your record, which is confidential under Florida law. You can ask to see your record."

If the client seems uneasy: stop and offer the "no" option first. Write down what the client decided and the date.

This kit is general information, not legal advice. Check with your attorney or your licensing board.

ChartQuiet is building a dictate-after-session note tool. Early access: chartquiet.com

Sources

All read October 23, 2026. Dates in parentheses are the document's own date or its "last reviewed" date.