Answered by Noah Watson · Updated 2026-10-15
Can a therapist use ChatGPT without breaking HIPAA?
Yes, as long as no protected health information goes into it. Strip anything that identifies a client before you paste, and ChatGPT is safe for the large part of the week that has nothing to do with a client record.
The rule that makes it safe
HIPAA protects information that can identify a patient: names, dates, contact details, record numbers, and anything else that points back to one person. If none of that reaches the tool, HIPAA has nothing to say about how you use it.
So the habit is simple. Before you paste anything, remove the identifiers. Writing a newsletter, drafting a policy, planning posts, summarising an article or rewriting your website copy all carry no client information to begin with.
What you should never paste
Session notes, intake forms, emails from clients, anything with a name or date of birth in it, and anything where details are changed but the person could still be recognised. Changing a name does not make a story anonymous if the rest of it is specific.
The consumer ChatGPT apps are not covered by a Business Associate Agreement, so treat them as off limits for anything clinical. Check the vendor's current terms before relying on any plan for patient data.
Write the rule down
Most practices already have staff using AI tools with no written rule about what may go into them. One page that says what is allowed and what is not protects the practice more than any software purchase. It is the first thing I set up with a practice.
Want this set up for your practice? See how I do it.