FOR THERAPISTS · GUIDE
An AI note taker
for therapists.
A session recording is health information. Before any AI tool hears one, check consent, where the recording goes, and whether a business associate agreement is needed. Here is what HHS and the professional codes say.
Consent comes before the recording.
All three major professional codes say the same thing.
The APA Ethics Code, Standard 4.03: “Before recording the voices or images of individuals to whom they provide services, psychologists obtain permission from all such persons or their legal representatives.”1 The ACA Code of Ethics, B.6.c: “Counselors obtain permission from clients prior to recording sessions through electronic or other means.”2 The NASW Code of Ethics, 1.03(h): social workers should obtain clients’ informed consent before making audio or video recordings.3
The ACA and NASW codes go further on technology: both ask for a discussion of technology risks or policies with clients, and the ACA code adds how records are kept electronically.
A session recording is health information.
Under HIPAA, health information covers information “whether oral or recorded in any form or medium”.4 If you are a HIPAA covered entity, a recording that identifies a client, and the transcript made from it, are protected health information.
Psychotherapy notes are a separate, narrower category: notes recorded by a mental health professional that document or analyze a counseling session and are kept apart from the rest of the record.5 HHS says they receive special protections.6 HHS guidance we found does not say whether an AI transcript or summary of a session counts as a psychotherapy note; ask your compliance adviser.
HIPAA does not require you to record sessions, nor to retain digital or tape recordings after transcription. But if you keep a recording and use it to make decisions about the client, it may become part of the designated record set the client can ask to see.7
When a vendor holds it, a BAA is needed.
HHS guidance on cloud services is direct.
A cloud service that creates, receives, maintains or transmits electronic PHI for a covered entity is a business associate, “even if the entity cannot actually view the ePHI”. Encryption without the key does not change that. The provider and the covered entity must sign a business associate agreement.8
HHS gives the session example directly: an app developer that stores recordings or transcripts in its cloud is creating, receiving and maintaining PHI, so the provider needs a BAA with that developer.9 The other side of the same rule: selling or providing software alone does not create a business associate relationship if the vendor has no access to the PHI.10
What to check before a tool hears a session.
- Client permission, recorded the way your code requires, before any recording.
- Where the audio and transcript go, and which AI providers process them.
- Whether the vendor has access. If yes, a signed BAA first.
- Training use of recordings or transcripts, in the vendor’s exact words.
- Retention and deletion, including whether you keep the audio once the note is written.
- Your own safeguards on the devices that hold recordings: passcodes, encryption, who else uses them.
Where a local recorder fits.
The audio stays on your devices. Your obligations stay with you.
Locus records on your Mac, Apple Watch or iPhone and transcribes and summarizes on your Mac with local AI. No cloud AI is required, and recordings and notes are files in a folder you choose on your Mac. Choosing an external AI service or sharing a note is a separate action, and it would send data off your devices.
Locus makes no HIPAA compliance claim today. Whether a local workflow meets your obligations, and whether any agreement is needed for your setup, is a question for your compliance adviser. Consent from the client comes first either way.
Not legal or compliance advice. This page summarizes HHS guidance and professional codes as of 20 October 2026.
Guide
For lawyers
Product