Transcription for Therapists: Notes, Review, and the BAA Gate

Any recording or transcript that contains identifiable client information is protected health information (PHI). That means progress notes generated from session audio, supervision recordings reviewed with a supervisor, and research recordings involving real clients all fall under HIPAA, and the transcription vendor you use must sign a Business Associate Agreement before you upload a single file.

This post focuses on the practice side: how progress note workflows and supervision review actually work, where the compliance gates sit, and what the major ethics codes require.

Does Your Use Case Involve PHI?

The first question is not "what tool should I use" but "what kind of content am I transcribing."

Progress notes from session recordings are PHI. Audio of a client speaking, AI-generated transcripts of that audio, and any structured note derived from it all carry PHI. The fact that the final note may be de-identified does not change the status of the source recording during processing.

Supervision recordings are PHI. When a trainee or licensed therapist records a session for supervisor review, the recording retains its PHI status. The supervisor becomes an additional authorized accessor, not a reason the content loses its protected status.

Fully de-identified teaching content is not PHI. If you create composite scenarios drawn from multiple clients, with no names, dates, locations, or details that could identify anyone, that material falls outside HIPAA's reach. The same applies to your own CE recordings, podcasts, and professional development content.

The practical split: HIPAA-compliant BAA vendor for anything clinical; general AI transcription for everything else.

What HIPAA Actually Requires of Transcription Vendors

For any transcription involving PHI, your vendor must:

Sign a Business Associate Agreement. Required. No exceptions. OCR has settled cases for significant sums where the sole violation was a missing BAA. Per HIPAA guidance, both the covered entity and the vendor are in violation if PHI is processed without one, even if no data breach occurs.

Encrypt data at rest and in transit. The current standard is 256-bit AES for storage and TLS for transmission.

Maintain access controls and audit logs. Only authorized personnel should be able to access recordings and transcripts.

Cover subprocessors. If the transcription vendor uses cloud storage or AI infrastructure from a third party, that subprocessor must also be covered under the compliance chain.

Support your retention policy. Recordings should be deleted per a defined schedule. Mentalyc, for instance, auto-deletes session recordings after three days while keeping the generated note, which aligns well with the "minimum necessary" principle.

See the HIPAA compliant transcription post for a full breakdown of BAA requirements and what to look for in vendor agreements.

Tools That Work for Progress Notes and Supervision

The therapy-specific AI note tools have rebuilt the compliance stack from the ground up. The general-purpose platforms have not.

Mentalyc is built specifically for therapy practice. It generates SOAP, DAP, BIRP, and intake notes from session audio. BAA is included on every plan (from $19.99/month for 40 notes to $119.99/month for 330 notes, verified on the Mentalyc pricing page July 2026). Recordings auto-delete after three days. SOC 2 Type II certified. Suitable for solo and group practices.

Upheal combines an AI note writer with built-in EHR features including scheduling and telehealth. HIPAA-compliant with BAA on all paid accounts (per Upheal documentation, verified July 2026). Notes are drafted in seconds; recordings are deleted by default unless you choose to retain them.

Eleos Health serves larger behavioral health organizations rather than solo practitioners. HIPAA, SOC 2 Type II, HITRUST, and ISO 27001 certified; BAA available via enterprise contract. Deploys as a browser overlay on existing EHRs without replacing them. Implementation takes two to three months, which reflects its target market.

Lyssn is oriented toward clinical training and quality assurance rather than billing documentation. HIPAA-compliant with BAA, hosted on AWS infrastructure. Well-suited for training programs and group practices running supervision workflows at scale, not for the solo practitioner generating progress notes each evening.

SimplePractice Note Taker is the built-in AI note feature inside the SimplePractice EHR. HIPAA-compliant, HITRUST-certified, covered under the SimplePractice BAA. As of June 2026, SimplePractice retains de-identified transcripts for model improvement unless you opt out, which is worth reviewing before using the feature (per SimplePractice's published retention policy).

EHR-integrated options (TherapyNotes, TheraNest). If you already use one of these platforms, check whether their AI note feature is live, what the BAA coverage looks like, and whether you need a separate add-on.

For supervision recording review in a training context, Lyssn is the most purpose-built option. For solo or small group practice progress notes, Mentalyc and Upheal are the most straightforward to set up.

What the Ethics Codes Require

HIPAA covers the data security layer. Professional ethics codes add a consent and purpose layer on top.

APA Standard 4.03 (Recording): Before recording the voices or images of individuals to whom they provide services, psychologists must obtain permission from all such persons or their legal representatives. This is separate from general informed consent to treatment; it must specifically cover recording.

APA Standard 4.04 (Minimizing Intrusions on Privacy): Psychologists include in written and oral reports only information germane to the purpose for which the communication is made. This applies to what you do with transcripts after you have them, not just whether you record.

ACA Section B.6.c (Permission to Record): Counselors must obtain client permission prior to recording sessions through electronic or any other means. Section B.6.d adds that permission is also required before allowing any third party to review transcripts or session recordings, which directly covers supervision use.

NASW Section 1.07 (Privacy and Confidentiality) and Section 3.04 (Client Records): Confidential information may only be disclosed with valid consent. Section 3.04 addresses how client records, including recordings, must be documented, stored, and protected.

AAMFT Section 1.11 (Written Consent to Record): Marriage and family therapists must obtain informed consent and written authorization before recording images, video, or audio, using any transcription services, or permitting third-party observation. This is the most explicit of the major codes on transcription services specifically.

Common thread across all four: consent must be specific to recording, must name the purpose, and must name who else will have access. A general treatment consent form that does not mention recording or AI tools does not satisfy these requirements.

If you work with substance use disorder clients, 42 CFR Part 2 adds a federal layer beyond HIPAA. The 2024 final rule (effective February 2026) aligned Part 2 more closely with HIPAA, but SUD records still carry additional restrictions on disclosure. Any recording workflow that includes SUD clients needs a compliance review specific to Part 2.

For the sibling post covering the ethics considerations in more depth, see transcription for therapy sessions ethics.

The Progress Note Workflow in Practice

A realistic progress note workflow with a HIPAA-compliant tool looks like this:

Before the first recorded session: Update your informed consent form to cover recording, name the AI tool you are using, describe who will have access, and state your retention policy. Have the client sign it. Document the signed consent in the record.

During the session: Record via the tool's app or upload audio immediately after. Most tools process the audio and return a draft note within a few minutes.

After the session: Review and edit the AI draft before signing. No AI-generated note should go into the record unsigned and unreviewed. The edited note is the clinical record; the source recording is interim.

Retention: Set a retention schedule for recordings. For most practices, the recording has no clinical value once the note is finalized and signed. Deleting it promptly limits exposure.

Annual review: Vendor compliance postures change. Review your BAA and the vendor's data practices at least once a year.

The Supervision Recording Workflow

For trainees or licensed therapists recording sessions for supervision:

The client's informed consent must specifically state that the supervisor (or supervision group) will have access to the recording or transcript. General supervision consent is not sufficient if AI transcription is part of the workflow.

The supervisor takes on the same confidentiality obligations as the treating clinician. The transcript or recording should be shared only with the authorized supervisor, reviewed for the stated supervision purpose, and not retained beyond that use.

For programs running formalized supervision with multiple trainees, Lyssn's session review features are worth evaluating. For a solo supervisor working with one or two supervisees, a shared Mentalyc or Upheal account configured with supervisor access may be simpler.

Where General Transcription Tools Fit

Therapists produce substantial non-PHI professional content where a general AI transcription tool works well and a therapy-specific platform is unnecessary.

Continuing education presentations, keynote recordings, and podcast episodes about therapy concepts contain no client PHI. The same applies to professional development recordings, conference session notes, and supervision conversations about your own clinical growth rather than specific client cases. For all of this content, a tool without a BAA is appropriate.

If you produce a podcast or regular audio content for colleagues or clients, ConvertAudioToText handles that cleanly: upload the audio file and get a formatted transcript back without an account requirement for basic use. The audio to text tool also works for conference recordings, CE content, and any audio where no client information is present.

The line to keep clear: PHI-bearing content goes to the BAA vendor, full stop. Non-PHI professional content can go anywhere that works for you.

Common Mistakes That Create Compliance Gaps

Three patterns that have caused real problems:

Using a consumer AI tool for client session content. A therapist uses a general transcription or summarization tool to process a recorded session. The client's information is now in a system with no HIPAA compliance and no BAA.

Conflating practice use with personal use. Recording your own reflections on your clinical work can shade into describing client situations. If your "professional development" recordings include recognizable client details, they carry PHI.

Inadequate informed consent forms. Recording sessions with a consent form that addresses general treatment but says nothing about AI tools, recording retention, or who will access transcripts. Clients have not given informed consent to what is actually happening.

The fix for all three is the same: clear policy on which content uses which tool, consent forms that match the actual workflow, and annual review when tools change.

Frequently Asked Questions

Can a therapist use a general AI transcription tool for session notes?

No, not for identifiable client sessions. Session audio and transcripts containing client information are protected health information (PHI). Processing PHI with a general AI transcription tool that does not sign a Business Associate Agreement is a HIPAA violation, regardless of how the tool markets itself. Use a therapy-specific platform that explicitly signs a BAA for all clinical documentation.

What is a Business Associate Agreement and why does it matter for transcription?

A BAA is a contract required by HIPAA between a covered entity (the therapist or practice) and any vendor who processes PHI on their behalf. Without a signed BAA, using a vendor to process client audio is a HIPAA violation even if no breach occurs. For transcription, the BAA must cover the transcription vendor and any subprocessors they use, such as cloud storage providers.

Do ethics codes require informed consent before recording therapy sessions?

Yes, across all major codes. APA Standard 4.03 requires psychologists to obtain permission from clients or their legal representatives before recording. ACA Section B.6.c requires counselors to obtain client permission prior to recording through any means. AAMFT Section 1.11 requires informed consent and written authorization before recording or using any transcription services. Consent must cover the specific purpose, who will have access, and how long the recording will be kept.

Are supervision recordings subject to the same HIPAA and ethics rules as session recordings?

Yes. Supervision recordings of client sessions are still PHI. The client must specifically consent to the supervisor having access, and the transcription tool used must be HIPAA-compliant with a BAA. The supervisor has the same confidentiality obligations as the treating therapist. The consent form used with clients should explicitly state that supervision review is a purpose for which recordings may be used.

What therapy content is safe to transcribe with a general AI transcription tool?

Non-PHI professional content is appropriate for general AI transcription tools. This includes continuing education presentations, conference recordings, podcasts about mental health concepts with no client information, fully de-identified teaching scenarios (no names, no identifying details, composites drawn from multiple clients), and your own professional reflection or career planning recordings. If there is any doubt about whether content could identify a client, treat it as PHI.

Sources

• APA Ethical Principles of Psychologists and Code of Conduct (Standards 4.03 and 4.04, verified July 2026)
• ACA Code of Ethics 2014, Section B.6 (B.6.c Permission to Record, B.6.d Permission to Observe, verified July 2026)
• AAMFT Code of Ethics (Section 1.11 Written Consent to Record, verified July 2026)
• NASW Code of Ethics (Sections 1.07, 3.04, verified July 2026)
• 42 CFR Part 2 Final Rule, HHS.gov (2024 rule, enforcement began February 2026)
• Mentalyc Pricing Page (plan tiers and BAA inclusion, verified July 2026)
• Mentalyc Security and BAA (BAA included on all plans, verified July 2026)
• Upheal AI Clinical Notes (HIPAA compliance and BAA, verified July 2026)
• Eleos Health (HIPAA, SOC 2, HITRUST certifications, verified July 2026)
• Lyssn (HIPAA BAA, supervision-focused platform, per vendor documentation)
• SimplePractice Note Taker FAQs (BAA coverage and data retention policy, verified July 2026)