AI therapy note consent form: what to include, with a template
A client consent form for AI note-taking in therapy should make sure your client understands how their information is used. It tells the client what the tool is for, what it captures, where the data goes and for how long, whether it trains AI, what could go wrong, that a clinician reviews every note, and that they can decline or withdraw without affecting their care. If the tool records audio, the form also needs a separate, visible recording acknowledgment and a signature. Those eight elements are the whole job.
Using an AI scribe brings your handling of client data under more than one set of rules. Consent is required in practice even though HIPAA itself does not demand a separate form: professional ethics codes require permission before recording a client, and roughly a dozen states require every party's consent to a recording by law. This guide covers what the form your clients sign must include, when recording consent is legally required, and a template you can adapt, written for therapists and practice owners in 2026.
The short version
HIPAA does not require a separate consent form for an AI scribe, but ethics codes and state recording laws require your client's informed consent, so treat written consent as mandatory, whether as a standalone form or added to your existing paperwork. We suggest the form includes eight elements: the tool and vendor name, what data is captured, data handling and retention, AI training policy, risks, clinician review, voluntary opt out, and a separate recording acknowledgment with signature. Roughly a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, require all party consent to record; in telehealth, apply the stricter state's rule. A sample template is below. It is a starting point for your own review, not legal advice. Upheal publishes consent statements and full templates for US providers, including a 42 CFR Part 2 version, and can send the consent request to your clients from inside the platform.
Is client consent required to use AI note-taking during sessions?
Yes, in practice, although the requirement does not come from where most therapists expect. HIPAA permits a business associate to process protected health information for treatment, payment, and health care operations under a signed BAA without a separate client authorization (45 CFR 164.506). However, HIPAA does not override your ethics code or your state's recording law, and both of those reach an AI scribe directly.
The APA Ethics Code, Standard 4.03, requires psychologists to obtain permission before recording clients' voices or images. Read it in the APA Ethical Principles of Psychologists and Code of Conduct. The ACA Code of Ethics and the NASW Code of Ethics contain parallel provisions on recording and on informing clients about the technology used in their care, so the requirement holds across license types. An AI scribe that listens to the session is a recording, or is at minimum real time processing of the client's words by a third party, and either way the client has a right to know and to say no.
The APA has also published guidance specifically on AI scribes. It tells psychologists to develop an informed consent process and a documentation policy before using one, to review and edit every AI generated note before signing it into the record, and to remain responsible for all clinical decisions and documentation accuracy. Read the APA guidance for the evaluation of AI scribes. APA's broader ethical guidance on AI in professional practice adds that clients should be told whom to contact if they want to withdraw consent for AI tools in their care. A consent form that covers those points satisfies the ethics requirement and, in most states, the legal one.
The three layers, and what each one actually asks of you:
| Layer | What it requires | When it applies |
|---|---|---|
| State recording law | Consent from every participant before recording, in all party consent states | Any session where audio is captured, AI or not |
| Professional ethics codes (APA, ACA, NASW, state licensing boards) | Documented informed consent when recording or new technology enters treatment | Every licensed clinician, in every state |
| HIPAA business associate rules | A signed BAA between your practice and the vendor before PHI is shared | Any third party tool processing session content |
The first two rows require your client's consent. The third row requires your vendor's contract, the BAA. Practices get into trouble by expecting one of these to cover the others.
Can therapists legally record sessions without client consent?
No. Whether recording without consent is a crime depends on state law. Whether it is an ethics violation does not: professional codes require permission to record regardless of what the state allows.
State recording laws split into two groups:
- Most states are one party consent states, where a participant in the conversation can record it without telling the other participants.
- Roughly a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, are all party consent states, where every participant must agree.
A therapy session is a private conversation in every state, so the all party rule applies with full force where it exists. Recording statutes attach to the act of capturing the conversation, not to how long the audio is kept, so a tool that transcribes in real time and discards the audio still triggers the same consent requirement.
Two situations trip practices up:
- Telehealth across state lines. The client may be in a different state from you. Apply whichever state's law is stricter, which means confirming where the client is at the start of each session. Simpler still: apply the strictest standard to every client and obtain consent before the first session.
- Family and couples sessions. More than one person is in the room, so obtain consent from every participant, not only the person whose chart the note goes into.
In a one party state, the recording statute alone does not require your client's consent, but your ethics code still does, and verbal permission leaves you with nothing in the record if a complaint is filed a year later. Written consent before the first recorded session is therefore the recommended standard. It satisfies the strictest state, satisfies every ethics code, and gives you a document to point to if a client later asks what they agreed to.
What should a client consent form for AI note-taking in therapy include?
A client consent form for AI note-taking should include the following eight elements at a minimum, each in plain language the client can read without a glossary:
- The tool and the vendor, by name. State that an AI documentation tool is used, name the vendor, and describe its role as drafting clinical notes, not diagnosing, treating, or replacing the clinician.
- What is captured. Say whether the session is audio recorded, video recorded, transcribed in real time, or summarized from the clinician's dictation. These are materially different arrangements, and the client should be able to tell which one they are agreeing to.
- Where the data is stored and processed, and how long it is kept. Name where audio, transcripts, and draft notes are stored and processed, whether the vendor retains audio after the note is generated, the retention and deletion timeline for each, and who inside your practice can see the output, including supervisors and billing staff.
- Whether session data trains AI. State plainly whether client data is used to train or improve AI models. If the vendor offers AI training, keep the opt in as a separate choice rather than folding it into the general consent.
- The risks of using an AI tool. Be transparent about the additional risks an AI tool introduces: unauthorized access, transcription errors, inaccurate or incomplete drafts, and the possibility that information about other people discussed in session is captured.
- Clinician review and responsibility. State that the clinician reviews and edits every AI generated note before it becomes part of the record, and remains responsible for its accuracy and for all clinical decisions.
- A voluntary choice with a real alternative. State that use of the tool is voluntary and that the client can decline now or withdraw later. The client should also know that declining will not affect their care, and what the alternative documentation method is.
- A separate recording acknowledgment and signature. If audio is recorded, add a distinct checkbox for the recording itself, then a signature and date line for the client, or for a parent or guardian where state law requires it for a minor, with space for the clinician to countersign.
Many practices choose between two formats, and the right one depends on what you already have:
| Add a statement to your existing consent | Use a standalone AI consent form |
|---|---|
| Best when your intake paperwork already covers technology and third party vendors | Best when your current forms predate AI tools or do not mention recording |
| One or two paragraphs naming the vendor and the BAA | A full page covering all eight elements, with its own signature |
| Fastest to roll out to existing clients | Clearest record if consent is ever questioned |
| Recording acknowledgment must still be separate and visible | Recording acknowledgment sits inside the form as its own checkbox |
Whichever format you use, the recording acknowledgment should never be buried in a general technology clause. A client should be able to find it in seconds.
A sample consent form template for AI note-taking in therapy
The template below is a vendor-neutral sample, not a finished form. It is not legal advice, it does not account for your state, license, or client population, and it should be reviewed by someone qualified to do that before you use it. Replace every bracketed item.
Consent for AI assisted clinical documentation
What is used. [Practice name] uses [tool name], an AI documentation tool provided by [vendor name], to help create clinical notes from therapy sessions. [Vendor name] handles protected health information under a signed Business Associate Agreement with [Practice name].
How it works. [Choose one: Sessions are audio recorded and the recording is transcribed / Sessions are transcribed in real time without a stored recording / Your clinician dictates a summary after the session and the tool drafts a note from it.] The tool produces a draft note. Your clinician reviews and edits every draft and remains responsible for your clinical record and all clinical decisions.
Your information. The tool may process everything discussed in session, including sensitive mental health information and information about other people you talk about. [Vendor name] stores [audio / transcripts / draft notes] [where] and [deletes audio once the note is generated / retains audio for X days / other]. [Vendor name] [does not use your session data to train AI / uses your session data to improve its AI only if you separately agree to that below].
Risks. AI tools add risks beyond ordinary record keeping, including unauthorized access, transcription errors, and inaccurate or incomplete draft notes. Your clinician's review is intended to catch errors before they reach your record. Your rights regarding your records do not change because this tool is used.
Your choice. Using this tool is voluntary. You can decline now or withdraw consent at any time by telling your clinician or contacting [contact]. Declining or withdrawing will not affect the care you receive. If you decline, your clinician will [describe the alternative, for example: write notes by hand after the session].
☐ I consent to my sessions being [recorded / transcribed] and processed by [tool name] as described above.
☐ I do not consent. I understand my clinician will document sessions without the AI tool.
☐ [Only if the vendor offers this] I separately agree that de-identified session data may be used to improve the AI.I have had the chance to ask questions and I understand how AI assisted documentation will be used, its risks and benefits, and my right to decline or withdraw.
Client or guardian signature: ____________ Date: ________
Clinician signature: ____________ Date: ________
If you use Upheal, you do not have to start from this sample. Upheal maintains its own consent statements and templates for US providers, kept current with regulatory changes such as 42 CFR Part 2. Whichever form you use, check that it covers all eight elements above.
How to introduce the consent conversation
The form works better when it follows a conversation rather than replacing one. We recommend talking your client through it first, then sharing the form for their signature. A version that takes under a minute:
"I use a tool that helps me write my notes after our sessions, so I can pay attention to you instead of my notepad. It [records / transcribes] the session, drafts a note, and I review and edit everything before it goes in your file. Your session isn't used to train anything unless you separately agree to that. You can say no, now or later, and it won't change anything about our work together. Here's what it says in writing. What questions do you have?"
The conversation is the consent. The form is the record of it.
What consent does not do
A signed consent form does not make your AI documentation compliant on its own. Four things stay separate:
- It does not replace the vendor's BAA. Consent is the client agreeing to the use of the tool. The BAA is the vendor agreeing to protect the PHI you share with it. You need both, and the form should reference the BAA rather than stand in for it. Our HIPAA BAA checklist for an AI therapy scribe covers what the vendor side needs.
- It does not cover other people in the session. A partner, parent, or family member who is present is a participant in the recording and needs to consent as a participant, whether or not they are your client.
- It does not change your confidentiality limits. Mandatory reporting, duty to warn, and court orders apply exactly as before. The form should say so rather than implying the AI tool adds or removes any of them.
- It does not cover other purposes. Consent to record for note taking does not extend to supervision, AI model training, or research use of the same recording. Each new purpose and audience needs its own disclosure.
Consent obtained once at intake is common practice, and it holds as long as the arrangement does not materially change. However, consent has to stay revisitable: the client can decline any individual session. When a client declines or withdraws, stop the tool for that client, document the refusal in the record, and confirm what happens to any recordings already made under the vendor's deletion terms.
How Upheal handles client consent
Upheal, an AI-native EHR and note-taking platform for mental health clinicians, treats consent as a workflow rather than a document you have to build alone. As of September 2026:
- Upheal signs a BAA with every practice.
- Upheal can email a consent form to your clients from inside the platform, or you can use your own documents.
- For practices with existing paperwork, Upheal publishes a short statement to add to those forms, and for practices that need a new form, downloadable templates for US providers, including a version that incorporates the 42 CFR Part 2 rules in effect since February 16, 2026. Both are in Upheal's support center.
- Session audio is deleted by default once your notes are generated.
- Upheal does not use session data to train AI unless you and your client both choose it. That second consent is a separate request, so it never rides inside the general consent to use the tool.
- You can dictate or type a session summary instead of recording, including on the free plan, so a client who declines recording can still be documented with the tool.
The statement Upheal provides for existing forms reads, in part: "[Name of the practice] has signed a Business Associate Agreement (BAA) to protect data that is shared with Upheal. Under the BAA, Upheal adheres to regulations such as the HIPAA Security Rule and Privacy Rule." Consent forms themselves live alongside your intake paperwork in Upheal's practice forms, so the signed record stays with the client's chart.
If you want a consent flow that is already built, try Upheal free.
Frequently asked questions
Is client consent required to use AI note-taking during sessions?
Yes, because professional ethics codes and state recording laws require it, even though HIPAA itself does not mandate a separate form. A vendor BAA covers HIPAA. Client consent covers the ethics of recording and the client's right to know how their words are processed.
Can therapists legally record sessions without client consent?
No, as a practical rule. Roughly a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, make recording without every party's consent illegal, and every professional ethics code requires permission before recording a client regardless of state law. Written consent before the first recorded session meets the strictest standard and resolves both.
Do I need a separate consent form for AI note-taking, or can I add it to my intake paperwork?
Either works, as long as the recording acknowledgment is a separate, visible consent. A statement in existing paperwork is faster to roll out. A standalone form is the clearer record if consent is ever questioned. Both must cover the eight elements above.
What happens if a client declines AI note-taking?
You document the session another way, and their care does not change. The form should name the alternative, such as notes written by hand or from a dictated summary, and your workflow should make that alternative real rather than theoretical.
Is consent still needed if the AI works from my dictated summary rather than a recording?
Recording consent is not needed if nothing is recorded, but disclosure to the client still is. Ethics codes expect clients to know when a third party tool processes information about their care, so the form should still name the tool and describe what it does, even when the input is your own dictation.
Do I need to get consent every session, or again if I switch tools?
Once at intake is the standard, and new consent is needed when the arrangement changes. Consent stays revisitable, so a client can decline any single session. A new vendor, a change in what is captured, or different retention or training terms are all new arrangements that need fresh consent.
The bottom line
The form is not the hard part. The hard part is being able to answer, in plain language, what the tool captures, where it goes, and what happens if the client says no. Get those answers from your vendor first, put them in a form that covers the eight elements above, and have the conversation before the signature. Done that way, consent protects the client, protects you, and usually makes the client more comfortable with the tool, not less. The clinicians who end up in front of a board are rarely the ones who never asked. They are the ones who asked once and assumed it covered everything after.
Upheal gives you the templates, the in platform consent request, and the answers to the vendor questions in one place. Start free, no credit card required.
Last updated September 22, 2026. The template on this page is a sample and not legal advice.
