HIPAA and Artificial Intelligence: What Every Therapy Clinic Needs to Know in 2026
AI tools are arriving in therapy clinics faster than the rules are changing. Here is how HIPAA applies today, where the proposed Security Rule update stands, and the questions to ask every AI vendor.
AI is now part of everyday clinical software: drafting notes, summarizing visits, suggesting next steps and powering patient messaging. For therapy clinics, the question is no longer whether to use AI but how to use it without putting patient privacy at risk.
The good news is that HIPAA already provides a clear framework. AI does not get a special exemption, and it does not need one. If a tool touches protected health information, the same rules apply.
This article is general information, not legal advice. Talk to your compliance advisor about your specific situation.
The basics have not changed
If a vendor handles PHI, it is a business associate
HHS guidance is explicit for cloud services: a covered entity can use a cloud service provider to store or process electronic protected health information, provided it has a HIPAA-compliant business associate agreement and otherwise complies with the HIPAA Rules (HHS). AI vendors that receive visit audio, transcripts or clinical notes fall into the same category.
Minimum necessary still applies
Send AI tools only the information they need to do the job. A tool that drafts a visit note needs the visit, not the patient's entire history.
Security safeguards are required
The current Security Rule requires administrative, physical and technical safeguards to protect electronic PHI (HHS). That includes access controls, audit controls and transmission security for AI features, just like any other system.
The proposed Security Rule update
In December 2024, HHS proposed the most significant update to the Security Rule in years. Among other changes, it would make multi-factor authentication and encryption mandatory and remove the distinction between "required" and "addressable" safeguards (Kirkland & Ellis).
As of mid-2026, it is not final. HHS moved the rulemaking from "final rule stage" to "long-term actions" and now projects a final rule in July 2027, later than the earlier May 2026 estimate (Davis Wright Tremaine).
The practical advice is the same either way: MFA and encryption are already best practice. Clinics that adopt them now will not have to scramble later.
AI fairness is now a legal requirement
Section 1557 of the Affordable Care Act prohibits discrimination in covered health programs. The 2024 final rule added a specific requirement: covered entities must make reasonable efforts to identify and mitigate the risk of discrimination from patient care decision support tools, which include AI (HHS).
For a therapy clinic, that means knowing which tools influence clinical decisions, understanding what inputs they use, and keeping clinicians in control of the final call.
Ten questions to ask every AI vendor
- Will you sign a business associate agreement?
- Where is our data stored and processed, and is it encrypted in transit and at rest?
- Is our data used to train models? Can we opt out?
- How long are recordings, transcripts and drafts retained?
- Who at your company can access our data, and is that access logged?
- Do you support multi-factor authentication and role-based access?
- Is each clinic's data isolated from other customers?
- Does a clinician review every AI output before it enters the record?
- How do you test for accuracy and bias, and can you share the results?
- What happens to our data if we leave?
A simple internal policy
- Inventory every tool that uses AI and what data it touches.
- Contract with a BAA before any PHI is shared.
- Review every AI-generated clinical output before it is signed.
- Inform patients when AI assists with their care or documentation.
- Train staff on what can and cannot be entered into AI tools.
- Audit access and outputs periodically.
How TheraPro approaches it
TheraPro Clinical is built around these principles. Each clinic runs in its own isolated environment on AWS, with encryption in transit and at rest, role-based access, audit logging and optional multi-factor sign-in. TheraPro signs a business associate agreement with every clinic. Smart Notes™ drafts are always reviewed, edited and signed by the therapist, and nothing is filed automatically. More detail is available in TheraPro's security and legal documents.
The bottom line
HIPAA was written long before generative AI, but its principles fit well: protect the data, limit what is shared, control who can see it and keep a record. Add clinician review and a clear eye on fairness, and AI can be both useful and safe.
