AI therapy note consent form: what to include, with a template

A client consent form for AI note-taking in therapy should make sure your client understands how their information is used. It tells the client what the tool is for, what it captures, where the data goes and for how long, whether it trains AI, what could go wrong, that a clinician reviews every note, where the finished note goes in their record, and that they can decline or withdraw without affecting their care. If the tool records audio, the form also needs a separate, visible recording acknowledgment and a signature. Those nine elements are the whole job.

Using an AI scribe brings your handling of client data under more than one set of rules. Consent is required in practice even though HIPAA itself does not demand a separate form: professional ethics codes require permission before recording a client, and roughly a dozen states require every party's consent to a recording by law. This guide covers what the form your clients sign must include, when recording consent is legally required, and a template you can adapt, written for therapists and practice owners in 2026.

The short version

HIPAA does not require a separate consent form for an AI scribe, but ethics codes and state recording laws require your client's informed consent, so treat written consent as mandatory, whether as a standalone form or added to your existing paperwork. We suggest the form includes nine elements: the tool and vendor name, what data is captured, data handling and retention, AI training policy, benefits and risks, clinician review, where the note goes in the record, voluntary opt out, and a separate recording acknowledgment with signature. Roughly a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, require all party consent to record; in telehealth, apply the stricter state's rule. A sample template is below, with each clause mapped to the APA or HHS point it addresses. It is a starting point for your own review, not legal advice. Upheal publishes a short statement to add to existing consent forms, and downloadable consent templates for US providers, including a version that incorporates 42 CFR Part 2 (last updated February 12, 2026).

What does the APA say an AI note-taking consent form should include?

The American Psychological Association (APA) says informed consent for an AI tool should cover which tool is used and how, its role, benefits, and risks, how client data is stored and shared, and the client's right to opt out at any time with alternatives explained. APA also says clinicians should review and edit every AI note before signing it.

The APA's recommendations on AI consent come from two documents: the Ethical Guidance for AI in the Professional Practice of Health Service Psychology (updated July 2025) and the Guidance for the Evaluation of AI Scribes (December 2025). Both are written for psychologists, and both present themselves as guidance, not enforceable standards. Counselors, social workers, and marriage and family therapists can use them as a benchmark alongside their own ethics codes.

One HIPAA point belongs in the form too. The U.S. Department of Health and Human Services (HHS) explains that HIPAA gives extra protection only to psychotherapy notes, meaning a clinician's notes on session content kept separate from the rest of the record. An AI drafted progress note filed in the client's chart is part of the record, so the form should say where the note goes.

The table maps each clause of the sample template below to the APA or HHS point it addresses. The template is Upheal's own sample. APA and HHS have not reviewed or endorsed it.

Is client consent required to use AI note-taking during sessions?

Yes, in practice, although the requirement does not come from where most therapists expect. HIPAA permits a business associate to process protected health information for treatment, payment, and health care operations under a signed BAA without a separate client authorization (45 CFR 164.506). However, HIPAA does not override your ethics code or your state's recording law, and both of those reach an AI scribe directly.

The APA Ethics Code, Standard 4.03, requires psychologists to obtain permission before recording clients' voices or images. Read it in the APA Ethical Principles of Psychologists and Code of Conduct. The ACA Code of Ethics and the NASW Code of Ethics contain parallel provisions on recording and on informing clients about the technology used in their care, so the requirement holds across license types. An AI scribe that listens to the session is a recording, or is at minimum real time processing of the client's words by a third party, and either way the client has a right to know and to say no.

The APA's two AI documents, mapped in the table above, add the specifics: an informed consent process and a documentation policy before using a scribe, clinician review of every AI generated note before it is signed into the record, and a named contact for clients who want to withdraw consent. A consent form that covers those points addresses the ethics side of consent. State recording and AI laws can add their own requirements, covered in the next section.

The three layers, and what each one actually asks of you:

The first two rows require your client's consent. The third row requires your vendor's contract, the BAA. Practices get into trouble by expecting one of these to cover the others.

Can therapists legally record sessions without client consent?

No. Whether recording without consent is a crime depends on state law. Whether it is an ethics violation does not: professional codes require permission to record regardless of what the state allows.

State recording laws split into two groups:

1. Most states are one party consent states, where a participant in the conversation can record it without telling the other participants.
2. Roughly a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, are all party consent states, where every participant must agree.

A therapy session is a private conversation in every state, so the all party rule applies with full force where it exists. Recording statutes attach to the act of capturing the conversation, not to how long the audio is kept, so a tool that transcribes in real time and discards the audio still triggers the same consent requirement.

Two situations trip practices up:

1. Telehealth across state lines. The client may be in a different state from you. Apply whichever state's law is stricter, which means confirming where the client is at the start of each session. Simpler still: apply the strictest standard to every client and obtain consent before the first session.
2. Family and couples sessions. More than one person is in the room, so obtain consent from every participant, not only the person whose chart the note goes into.

In a one party state, the recording statute alone does not require your client's consent, but your ethics code still does, and verbal permission leaves you with nothing in the record if a complaint is filed a year later. Written consent before the first recorded session is therefore the recommended standard. It satisfies the strictest state, satisfies every ethics code, and gives you a document to point to if a client later asks what they agreed to.

What should a client consent form for AI note-taking in therapy include?

A client consent form for AI note-taking should include the following nine elements at a minimum, each in plain language the client can read without a glossary:

1. The tool and the vendor, by name. State that an AI documentation tool is used, name the vendor, and describe its role as drafting clinical notes, not diagnosing, treating, or replacing the clinician.
2. What is captured. Say whether the session is audio recorded, video recorded, transcribed in real time, or summarized from the clinician's dictation. These are materially different arrangements, and the client should be able to tell which one they are agreeing to.
3. Where the data is stored and processed, and how long it is kept. Name where audio, transcripts, and draft notes are stored and processed, whether the vendor retains audio after the note is generated, the retention and deletion timeline for each, and who inside your practice can see the output, including supervisors and billing staff. Our guide to AI scribe data retention covers how long each should be kept.
4. Whether session data trains AI. State plainly whether client data is used to train or improve AI models. If the vendor offers AI training, keep the opt in as a separate choice rather than folding it into the general consent.
5. The benefits and risks of using an AI tool. Say what the tool is meant to do for the client's care, such as giving the clinician more attention for the session, and be transparent about the additional risks an AI tool introduces: unauthorized access, transcription errors, inaccurate or incomplete drafts, and the possibility that information about other people discussed in session is captured.
6. Clinician review and responsibility. State that the clinician reviews and edits every AI generated note before it becomes part of the record, and remains responsible for its accuracy and for all clinical decisions.
7. Where the note goes in the record. State that the finished note becomes part of the client's clinical record, whether any separate psychotherapy notes are kept, and that the usual limits of confidentiality, such as mandatory reporting and duty to warn, are unchanged. HIPAA's extra protection applies only to psychotherapy notes kept apart from the record.
8. A voluntary choice with a real alternative. State that use of the tool is voluntary and that the client can decline now or withdraw later. The client should also know that declining will not affect their care, and what the alternative documentation method is.
9. A separate recording acknowledgment and signature. If audio is recorded, add a distinct checkbox for the recording itself, then a signature and date line for the client, or for a parent or guardian where state law requires it for a minor, with space for the clinician to countersign.

Many practices choose between two formats, and the right one depends on what you already have:

Whichever format you use, the recording acknowledgment should never be buried in a general technology clause. A client should be able to find it in seconds.

A sample consent form template for AI note-taking in therapy

The template below is a vendor-neutral sample, not a finished form. It is not legal advice, it does not account for your state, license, or client population, and it should be reviewed by someone qualified to do that before you use it. Replace every bracketed item. Each clause matches a row in the APA and HHS table near the top of this guide.

Consent for AI assisted clinical documentation

What is used. [Practice name] uses [tool name], an AI documentation tool provided by [vendor name], to help create clinical notes from therapy sessions. The tool drafts notes. It does not diagnose, make treatment decisions, or replace your clinician's judgment.

How it works. [Choose one: Sessions are audio recorded and the recording is transcribed / Sessions are transcribed in real time without a stored recording / Your clinician dictates a summary after the session and the tool drafts a note from it.] Your clinician will tell you when the tool is in use, and you can ask for it to be turned off for any session.

Clinician review. The tool produces a draft note. Your clinician reviews and edits every draft before signing it and remains responsible for your clinical record and all clinical decisions.

Your information. The tool may process everything discussed in session, including sensitive mental health information and information about other people you talk about. [Vendor name] stores [audio / transcripts / draft notes] [where] and [deletes audio once the note is generated / retains audio for X days / other]. Transcripts are kept for [timeframe]. Inside [Practice name], [your clinician / supervisors / billing staff] can see the notes. [Vendor name] protects this information under a signed Business Associate Agreement with [Practice name] and [describe safeguards, for example encryption in transit and at rest].

AI training. [Vendor name] [does not use your session data to train AI / uses your session data to improve its AI only if you separately agree to that below]. [Vendor name] [does not sell your data or use it for marketing / describe any other use]. [Vendor name] [builds its own AI / uses third party AI providers that are bound by contract not to keep or train on your session data].

Benefits and risks. The tool is intended to reduce the time your clinician spends writing notes, so more of their attention stays on you during sessions. AI tools also add risks beyond ordinary record keeping, including unauthorized access, transcription errors, and inaccurate or incomplete draft notes. Your clinician's review is intended to catch errors before they reach your record.

Your records. The finished note becomes part of your clinical record. [If your clinician also keeps separate psychotherapy notes, say so here.] Your rights regarding your records, and the limits of confidentiality, such as mandatory reporting and duty to warn, are the same whether or not this tool is used.

Your choice. Using this tool is voluntary. You can decline now or withdraw consent at any time by telling your clinician or contacting [contact]. Declining or withdrawing will not affect the care you receive. If you decline, your clinician will [describe the alternative, for example: write notes by hand after the session].

Your consent choices.
☐ I consent to my sessions being [recorded / transcribed] and processed by [tool name] as described above.
☐ I do not consent. I understand my clinician will document sessions without the AI tool.
☐ [Only if the vendor offers this] I separately agree that de-identified session data may be used to improve the AI.

Questions and signatures. I have had the chance to ask questions, including how my information is stored and protected, and I understand how AI assisted documentation will be used, its benefits and risks, and my right to decline or withdraw.

Client or guardian signature: ____________ Date: ________
[If the client is a minor] Client assent: ____________ Date: ________
[For couples or family sessions] Other participant signature: ____________ Date: ________
Clinician signature: ____________ Date: ________

If you use Upheal, you do not have to start from this sample. Upheal's own statement and templates are covered in the section on how Upheal handles client consent, below. Whichever form you use, check that it covers all nine elements above.

How to introduce the consent conversation

The form works better when it follows a conversation rather than replacing one. We recommend talking your client through it first, then sharing the form for their signature. A version that takes under a minute:

"I use a tool that helps me write my notes after our sessions, so I can pay attention to you instead of my notepad. It [records / transcribes] the session, drafts a note, and I review and edit everything before it goes in your file. Your session isn't used to train anything unless you separately agree to that. You can say no, now or later, and it won't change anything about our work together. Here's what it says in writing. What questions do you have?"

The conversation is the consent. The form is the record of it.

What consent does not do

A signed consent form does not make your AI documentation compliant on its own. Four things stay separate:

• It does not replace the vendor's BAA. Consent is the client agreeing to the use of the tool. The BAA is the vendor agreeing to protect the PHI you share with it. You need both, and the form should reference the BAA rather than stand in for it. Our HIPAA BAA checklist for an AI therapy scribe covers what the vendor side needs.
• It does not cover other people in the session. A partner, parent, or family member who is present is a participant in the recording and needs to consent as a participant, whether or not they are your client.
• It does not change your confidentiality limits. Mandatory reporting, duty to warn, and court orders apply exactly as before. The form should say so rather than implying the AI tool adds or removes any of them.
• It does not cover other purposes. Consent to record for note taking does not extend to supervision, AI model training, or research use of the same recording. Each new purpose and audience needs its own disclosure. For a worked example, see what SimplePractice's Note Taker does with your session transcripts, which compares two of its consent templates that describe the same event differently.

Consent obtained once at intake is common practice, and it holds as long as the arrangement does not materially change. However, consent has to stay revisitable: the client can decline any individual session. When a client declines or withdraws, stop the tool for that client, document the refusal in the record, and confirm what happens to any recordings already made under the vendor's deletion terms.

How Upheal handles client consent

Upheal, an AI-native EHR and note-taking platform for mental health clinicians, treats consent as a workflow rather than a document you have to build alone. The APA's AI scribe guidance asks clinicians to check whether a tool stores audio, who controls transcript retention, whether session data trains AI, and whether the vendor signs a BAA. Upheal's answers, as of October 2026:

• Session audio is deleted by default once your notes are generated.
• Transcripts and whole sessions can be deleted manually or set to delete automatically after a timeframe you choose, for your whole practice at once. Without the transcript, that session cannot be reprocessed into a different note type, used to generate a treatment plan, or summarized for the client.
• Upheal does not use session data to train AI unless you and your client both choose it. That second consent is a separate request, so it never rides inside the general consent to use the tool.
• Upheal signs a BAA with every practice. Upheal publishes its full Business Associate Agreement, effective March 25, 2026. Providers accept the BAA during signup, before any PHI enters the platform. Subcontractors are bound in writing to the same restrictions that apply to Upheal, and third parties that handle session data are barred from logging it or using it to train their own AI.
• Upheal can email a consent form to your clients from inside the platform, or you can use your own documents.
• Upheal publishes a short statement to add to existing consent forms, and downloadable consent templates for US providers, including a version that incorporates 42 CFR Part 2. The templates were last updated February 12, 2026, and the 42 CFR Part 2 rules took effect February 16, 2026. Both are in Upheal's support center.
• You can dictate or type a session summary instead of recording, including on the free plan, so a client who declines recording can still be documented with the tool.

The statement Upheal provides for existing forms reads, in part: "[Name of the practice] has signed a Business Associate Agreement (BAA) to protect data that is shared with Upheal. Under the BAA, Upheal adheres to regulations such as the HIPAA Security Rule and Privacy Rule." For the rest of your intake paperwork, see Upheal's practice forms.

If you want a consent flow that is already built, try Upheal free.

Frequently asked questions

Is client consent required to use AI note-taking during sessions?

Yes, because professional ethics codes and state recording laws require it, even though HIPAA itself does not mandate a separate form. A vendor BAA covers HIPAA. Client consent covers the ethics of recording and the client's right to know how their words are processed.

Can therapists legally record sessions without client consent?

No, as a practical rule. Roughly a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, make recording without every party's consent illegal, and every professional ethics code requires permission before recording a client regardless of state law. Written consent before the first recorded session meets the strictest standard and resolves both.

Do I need a separate consent form for AI note-taking, or can I add it to my intake paperwork?

Either works, as long as the recording acknowledgment is a separate, visible consent. A statement in existing paperwork is faster to roll out. A standalone form is the clearer record if consent is ever questioned. Both must cover the nine elements above.

What happens if a client declines AI note-taking?

You document the session another way, and their care does not change. The form should name the alternative, such as notes written by hand or from a dictated summary, and your workflow should make that alternative real rather than theoretical.

Is consent still needed if the AI works from my dictated summary rather than a recording?

Recording consent is not needed if nothing is recorded, but disclosure to the client still is. Ethics codes expect clients to know when a third party tool processes information about their care, so the form should still name the tool and describe what it does, even when the input is your own dictation.

Do I need to get consent every session, or again if I switch tools?

Once at intake is the standard, and new consent is needed when the arrangement changes. Consent stays revisitable, so a client can decline any single session. A new vendor, a change in what is captured, or different retention or training terms are all new arrangements that need fresh consent.

Are there official requirements for what an AI note-taking consent form must include?

As of October 2026, no federal rule sets the contents of an AI note-taking consent form. HIPAA does not require a separate form, and the APA's AI documents are guidance rather than enforceable standards. The binding rules come from ethics codes, which require consent to record, and from state recording and AI laws, such as Illinois's written consent rule.

Are AI generated therapy notes psychotherapy notes under HIPAA?

Usually not. HHS defines psychotherapy notes as a mental health professional's notes on session content that are kept separate from the medical record, and excludes summaries of symptoms, treatment plan, and progress. An AI drafted progress note filed in the client's chart is part of the record, so HIPAA's extra authorization rule for psychotherapy notes does not cover it.

The bottom line

The form is not the hard part. The hard part is being able to answer, in plain language, what the tool captures, where it goes, and what happens if the client says no. Get those answers from your vendor first, put them in a form that covers the nine elements above, and have the conversation before the signature. Done that way, consent protects the client, protects you, and usually makes the client more comfortable with the tool, not less. The clinicians who end up in front of a board are rarely the ones who never asked. They are the ones who asked once and assumed it covered everything after.

Upheal gives you the templates, the in platform consent request, and the answers to the vendor questions in one place. Start free, no credit card required.

Last updated October 26, 2026. The template on this page is a sample and not legal advice.