General information only. This guide is not legal advice. HIPAA rules are specific and the penalties are real. Check with your attorney or compliance officer before changing how you handle PHI.
What counts as PHI (and what does not)
PHI (protected health information) is any health information tied to an identifiable person. For a therapist, that includes client names, dates of birth, contact details, session content, diagnoses, and treatment plans.
What is not PHI: your fee schedule, a blank intake form, a policy template, marketing copy, or a de-identified example with all identifiers removed. The rule is simple. If it could identify a client, it is PHI.
Why the free tier of ChatGPT is a problem
Free AI tiers typically use your inputs to train their models. That means anything you type could be reviewed or retained. For client information, that is a non-starter.
Paid tiers from major providers offer data controls, like turning off training on your inputs. But data controls alone do not make a tool HIPAA-compliant.
What a BAA is, in plain English
A BAA (Business Associate Agreement) is a contract where the vendor promises to protect health information according to HIPAA rules. No BAA, no PHI. That is the whole rule.
Some AI and EHR-adjacent tools offer BAAs on business or enterprise plans. Consumer free tiers do not. If a vendor will not sign one, treat the tool as off-limits for anything client-related.
The zero-PHI workflow
The safest approach for practice admin: keep PHI out of AI tools entirely. You can still get enormous value.
- Strip identifiers before you prompt. Never paste names, dates of birth, or session details.
- Use templates with [BRACKETS]. Write "a client with [DIAGNOSIS]" instead of the real diagnosis. Fill in the brackets yourself, offline.
- De-identify examples. Change the details that could point to a real person before asking for help rewriting.
- Keep clinical work out. Session notes, treatment plans, and diagnoses stay in your EHR, never in a chatbot.
Practical safeguards for the admin you do run through AI
- Use a paid tier and turn off training on your inputs.
- Use a separate account for practice work, not your personal one.
- Limit who on your team has access, and know what they paste.
- Read the vendor's data retention policy once a year. Policies change.
- When in doubt, ask your attorney or compliance officer before changing how you handle PHI.
Questions, answered
Does ChatGPT offer a BAA?
OpenAI offers BAAs on certain business and enterprise plans, not on the free or standard consumer tiers. Check their current terms, because this changes. A BAA covers only the data you put in under that plan.
Can I use AI to write progress notes?
This guide does not cover clinical documentation, and most compliance officers say keep it out of general AI tools. If you want AI help with notes, look at tools built for that purpose with a signed BAA, and get your attorney sign-off first.
What about de-identified client examples?
Properly de-identified information is not PHI. But de-identification has a specific legal meaning. Removing the name is not enough. When you are unsure, treat it as PHI and keep it out.
Do I need a BAA if I only use AI for admin with zero PHI?
If no PHI ever touches the tool, the BAA requirement does not kick in for that use. That is exactly why the zero-PHI workflow is powerful. Keep it that way on purpose, not by accident.