AI notes for therapists in the US: HIPAA-safe session documentation without a BAA

A therapy session is 50 minutes. Documentation is supposed to take another 10. In practice, it takes 20 to 30 — and those minutes come from somewhere: lunch, the gap before the next client, the end of the evening, the weekend.

Multiply 20 extra minutes by 25 sessions per week and you have nearly 500 hours of documentation annually on top of 1,250 hours of direct client contact. That is 40% overhead on top of the clinical work itself — before billing, scheduling, or supervision.

This is why therapist burnout in the United States is concentrated in documentation. Not in the sessions, which most therapists entered the profession to do. In the paperwork that follows every session, stretching the working day past its clinical end.

AI documentation changes this ratio. But the HIPAA landscape for mental health AI tools is specific, and the wrong tool creates liability that outweighs the time it saves.

What a therapy progress note requires

A SOAP-format progress note for outpatient therapy contains: the presenting concerns the client brought to session, objective observations (affect, speech, engagement, risk indicators), the therapist's clinical assessment (progress against treatment goals, diagnostic impression), and the plan (interventions used, homework, next session focus, any changes to the treatment plan).

A full SOAP note from a 50-minute session typically runs 300–600 words. Writing it accurately from memory 30 minutes after the session — after another client — produces notes that are compressed, generic, and harder to defend in an audit or legal proceeding than notes written contemporaneously.

The documentation standard in malpractice cases is whether a note would withstand scrutiny. "Client reported improved mood" is weaker than "Client reported reduced frequency of intrusive thoughts from daily to 2–3x per week; PHQ-9 score declined from 16 to 9; connected improvement to CBT thought records completed between sessions." The second version requires either careful contemporaneous notes or a recording.

HIPAA and the AI notetaker problem

The central HIPAA issue for AI documentation in therapy is the Business Associate Agreement (BAA). Any software vendor that receives, processes, or stores Protected Health Information (PHI) — which includes session content — must sign a BAA with the practice. Without a signed BAA, using that vendor to process therapy session audio creates a HIPAA violation regardless of the vendor's privacy marketing.

Several AI notetakers that market themselves to therapists explicitly state they do not sign BAAs and prohibit PHI uploads. For a therapist using such a tool to generate session notes, the liability sits entirely with the practitioner.

Cloud-based therapy documentation tools that do sign BAAs — SimplePractice, Therapy Notes, Twofold — remain HIPAA-compliant within that BAA framework. But the BAA framework is a contractual compliance mechanism. The audio of a therapy session has still left the practitioner's device and been processed on a vendor's server. For clients with high-risk disclosures — domestic violence situations, child abuse histories, suicidality — many therapists operate under a higher standard than contractual compliance requires.

The on-device alternative

Kuulo processes everything on the iPhone. Session audio never leaves the device. There is no vendor server, no cloud processor, no BAA required — because there is no third-party processor to enter into a BAA with.

The data governance position: the session audio is processed on the practitioner's device, stays on that device, and the resulting note is created and stored there. The only HIPAA obligations are those that apply to the device itself — which are the same obligations the practitioner already holds for any clinical record on their device: encryption, access controls, and secure backup if the notes are retained.

This is a materially simpler compliance position than any cloud-based tool, regardless of that tool's BAA status.

The workflow in practice

The therapist places an iPhone on the desk during the session — visible to the client, with consent obtained and documented. Kuulo records. The session runs normally. At session end, the therapist opens Kuulo, generates the progress note from the session recording, and reviews it before the next client.

The AI-generated SOAP note covers: presenting concerns (from the client's opening), objective observations (drawn from the session), the therapeutic work done, and the plan. The therapist reviews, edits for clinical nuance, and signs off. A 50-minute session produces a defensible progress note in 5–8 minutes of review rather than 20–30 minutes of reconstruction.

At 25 sessions per week, that is roughly 6 hours recovered weekly — time that returns to client capacity, supervision, or simply leaving the office at a reasonable hour.

Client consent and clinical framing

Recording a therapy session requires explicit client informed consent. This is an ethical requirement under APA and NASW guidelines, and a legal requirement in many states. The consent conversation is also a therapeutic opportunity: explaining that recording is used for documentation purposes only, stays on the practitioner's device, and is deleted after the note is generated — is a demonstration of the same data transparency therapists ask of the digital platforms their clients use.

Many therapists report that framing on-device recording as a documentation tool, not a surveillance tool, is received positively by clients who are themselves uncomfortable with cloud data practices.

Telehealth sessions

For video-based sessions, Kuulo captures the therapist's side of the session and the client audio through the iPhone microphone. The resulting note reflects the full session content. For clients who have declined recording, the traditional documentation workflow continues — but the default for consenting clients is AI-assisted from the device.

The solo practice economics

Solo and small group practices face a specific economics of AI documentation: cloud-based therapy AI scribes typically cost $99–$150 per provider per month. At 25 sessions per week, this is $3.96–$6 per session on top of EHR costs, liability insurance, and supervision.

Kuulo's pricing does not depend on session volume. The AI processing runs on the device. For a solo practitioner running a full caseload, the economics are substantially different from a per-session or per-month cloud pricing model — especially for practices that are already profitable and where the goal is recovering time rather than buying a new software subscription.