Behavioral Health Compliance Is Moving Fast: What’s Changing in 8 States
There is a lot happening in behavioral health compliance right now, and it isn’t all coming from the same place.
States are passing laws, updating administrative rules, and considering legislation that affects psychotherapy, artificial intelligence, telehealth, client records, confidentiality, and how behavioral health services can be delivered.
The impact varies. A new requirement may apply directly to therapists, regulate a technology company, or only apply within a particular behavioral health system. Some changes are already in effect. Others are still proposed.
And that distinction matters when you’re trying to figure out whether something actually requires a change in your practice.
Guardian Clinical Essentials is monitoring federal and state compliance developments affecting behavioral health practices and taking a closer look at changes that may affect therapists.
Here are eight state developments currently being monitored by GCE.
A quick note: This article provides general educational information, not legal advice. Applicability can depend on your profession, license, services, practice setting, and other circumstances. Proposed legislation can also change significantly before becoming law.
Maine: AI and Mental Health Services
Status: Enacted
Maine enacted LD 2082, An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services, in April 2026.
The law prohibits AI from providing therapy or psychotherapy services unless those services are provided by a licensed professional and establishes boundaries around how licensed professionals may use AI in practice.
For therapists using AI documentation and transcription tools, there is another piece to pay attention to. The law addresses supplementary uses of AI when a therapy or psychotherapy session is recorded or transcribed, including requirements involving disclosure and consent.
A vendor’s claim that a product is “HIPAA compliant” doesn’t tell you whether state law places additional requirements on how you use it.
Before You Change Anything in Your Practice
A new behavioral health law or rule does not automatically mean it applies to you. Check who it regulates, which licenses and practice settings are covered, whether it has actually been enacted, and when it takes effect.
Rhode Island: New Requirements for AI in Mental Health Care
Status: Enacted
Rhode Island enacted legislation in June addressing permitted and restricted uses of AI in mental health care.
The law maintains therapeutic decision-making with licensed professionals while addressing uses of AI for administrative support, notetaking, supplementary support, and therapeutic communication.
It also establishes informed-consent requirements for certain uses of AI companion models in therapy or psychotherapy sessions and applies confidentiality protections to covered AI tools used in mental health care.
Rhode Island draws a line between AI used to assist a clinician and AI performing work reserved for a licensed mental health professional.
Tennessee: AI Cannot Present Itself as a Mental Health Professional
Status: Enacted
Tennessee’s approach is different from Maine’s and Rhode Island’s.
Public Chapter 647 prohibits a person from developing or deploying an AI system that advertises or represents to the public that it is, or is able to act as, a qualified mental health professional. Violations can be addressed under Tennessee’s consumer protection law.
This law primarily regulates those developing and deploying these systems rather than creating a new AI-use checklist for individual therapists.
A behavioral health law involving AI doesn’t automatically create new requirements for therapists. Who the law actually regulates matters.
Vermont: AI and Professional Mental Health Services
Status: Enacted
Vermont enacted Act 156 in June 2026 specifically regulating the use of artificial intelligence in the provision of mental health services.
The law establishes boundaries around the role AI can play in professional mental health services and incorporates prohibited AI use into Vermont’s professional regulatory framework.
For therapists, this means AI use may fall under professional licensing and practice requirements in addition to privacy and security requirements.
In other words, checking whether a technology meets HIPAA requirements may only answer one of the compliance questions you need to ask.
New York: Proposed Psychotherapy AI Requirements
Status: Pending
New York is one of the states where the requirements may still change.
Senate Bill S8484, along with its Assembly companion A9106, would regulate the use of artificial intelligence in therapy and psychotherapy services.
The proposal addresses certain administrative and supplementary uses of AI, informed consent, confidentiality, and restrictions on AI performing therapeutic functions.
As of August 31, 2026, S8484 remains active in the Senate Rules Committee.
New York’s bill is still pending, so these aren’t current practice requirements. Bills can be amended, stalled, replaced, or never enacted at all.
A proposed bill is not a compliance requirement.
It is, however, something GCE will continue monitoring.
Oregon: Client Record Retention Rules Changed
Status: Effective August 12, 2026
Oregon’s Board of Licensed Professional Counselors and Therapists recently amended its client-record requirements.
Covered licensed professional counselors, marriage and family therapists, registered associates, and certain other practitioners must maintain client records for at least seven years from the last date of service unless another state or federal law requires a different retention period.
The amended rule also clarifies how that retention period works when someone other than the original treating provider maintains the record. The seven years are calculated from the treatment provider’s last date of service, regardless of whether the record is currently maintained by the provider or by a custodian of record.
This can come up when a therapist leaves a group practice, a practice closes, records are transferred, or another person assumes responsibility for maintaining them.
Record retention isn’t only about knowing how many years to keep a chart. Practices also need to know who is responsible for maintaining the record and how that responsibility continues when the original provider is no longer the person holding it.
Ohio: Behavioral Health Rules Updated
Status: Effective August 1, 2026
Ohio updated administrative rules this summer governing certain certified behavioral health services and supports.
The rules address areas including confidentiality, security of clinical record systems, and telehealth. For covered services, Ohio’s telehealth rule states that an in-person visit isn’t necessary to initiate telehealth services. Decisions about providing services through telehealth are tied to factors including client choice, clinical decision-making, professional responsibility, and applicable licensing requirements.
The updated rules also address access to and disclosure of client information, storage and security of records, and secure transmission and storage of electronic communications.
These rules have a defined scope. They apply to providers offering or seeking to offer specified certifiable behavioral health services or supports and shouldn’t automatically be interpreted as new requirements for every independently practicing Ohio therapist.
When a new behavioral health rule is announced, one of the first questions should be:
Does this actually apply to my practice?
Colorado: Psychotherapy AI Requirements Are Now in Effect
Status: Effective August 12, 2026
Colorado’s HB 26-1195 established new requirements and restrictions around the use of artificial intelligence in psychotherapy.
The law applies to professionals legally permitted to provide psychotherapy services in Colorado and restricts AI from independently performing certain clinical functions.
Among other provisions, regulated professionals cannot allow an AI system to engage clients in therapeutic communication without the required synchronous, real-time professional involvement or generate therapeutic recommendations or treatment plans without review and approval by the regulated professional.
The law also distinguishes these clinical uses from certain educational, administrative, simulation, training, and research uses.
Colorado isn’t the only state that enacted behavioral-health-related AI legislation this year. Maine, Rhode Island, Tennessee, and Vermont have also taken action, while New York is considering its own approach.
The requirements aren’t identical, and neither is who they apply to.
This Is Bigger Than AI
Several of these developments involve AI, but Oregon and Ohio are good reminders of how much more falls under behavioral health compliance.
Record retention, telehealth, confidentiality, record security, licensing requirements, and professional practice rules can all change at the state level.
Behavioral health compliance requirements come from a lot of different places.
Federal law matters. So do state statutes, licensing rules, administrative regulations, payer requirements, professional standards, and requirements connected to the services and technology a practice uses.
Those requirements don’t necessarily change together, and the rules affecting one behavioral health professional may not be identical to those affecting another.
“HIPAA Compliant” Doesn’t Answer Every Compliance Question
A product may meet HIPAA requirements and still be subject to additional requirements under state confidentiality law, licensing rules, informed-consent requirements, or laws governing a particular clinical use.
The same principle applies beyond technology. Meeting one compliance requirement doesn’t automatically satisfy every other requirement that applies to a behavioral health practice.
HIPAA compliance is one part of compliance. It isn’t the whole thing.
Want to Keep Up With What Changes Next?
Guardian Clinical Essentials is monitoring federal and state developments affecting behavioral health practices and will continue taking a closer look at changes that may affect therapists.
Not every introduced bill will become law, and not every new requirement will apply to every therapist. When something warrants a closer look, GCE will focus on what changed, who it applies to, when it takes effect, and what it may mean for behavioral health practice.
Because you already have enough to keep track of.
Join the Guardian Clinical Essentials newsletter for compliance updates, practical guidance, new resources, and articles developed specifically for therapists and behavioral health practices.
What Does This Mean for Your Practice?
Eight states appearing in one compliance review doesn’t mean every therapist suddenly has eight new laws to follow.
What matters is what applies to your practice.
That means knowing the requirements in the state or states where you practice, paying attention to the rules governing your particular license and practice setting, distinguishing proposed legislation from enacted law, and checking effective dates before assuming something has changed.
When new technology is involved, the review also needs to include how the tool will actually be used in your practice, not only what the vendor says about HIPAA.
Compliance isn’t something a practice completes once and never revisits. Laws, regulations, technology, and the way behavioral health services are delivered change.
Guardian Clinical Essentials Resources
Guardian Clinical Essentials develops HIPAA, privacy, technology, and compliance resources specifically for therapists and behavioral health practices. GCE also monitors federal and state developments that may affect behavioral health practice and reviews existing resources when relevant requirements change.
For practical compliance resources, articles, tools, and free resources, visit Guardian Clinical Essentials.
This article is provided for educational and informational purposes and does not constitute legal advice. Laws, regulations, licensing requirements, and professional obligations may change. Mental health professionals should review the requirements applicable to their practice and consult qualified legal counsel when needed.
Frequently Asked Questions
Do all of these state compliance changes apply to every therapist?
No.
Applicability depends on the specific law or rule, your license, where you practice, the services you provide, and your practice setting. Some of the developments discussed here apply directly to licensed behavioral health professionals, while others apply to certain providers, services, or technology companies.
Are therapists required to follow a bill that has been introduced but has not become law?
No.
Proposed legislation is not a current compliance requirement. Bills can change significantly during the legislative process and may never become law. New York’s legislation discussed in this article is still pending as of August 31, 2026.
If an AI tool is HIPAA compliant, can a therapist use it?
Not necessarily.
HIPAA is only one part of the compliance analysis. State laws, licensing requirements, confidentiality rules, informed-consent requirements, and professional standards may also affect whether and how a therapist can use a particular AI tool.
Are states starting to regulate therapists' use of AI?
Yes.
Several states have enacted laws in 2026 addressing AI and behavioral health, but they do not all regulate the same activities or the same people. Maine, Rhode Island, Vermont, and Colorado have enacted requirements affecting AI in mental health or psychotherapy services, while Tennessee’s law primarily addresses AI systems being represented as qualified mental health professionals.
How can therapists keep up with changing state and federal compliance requirements?
Start with the requirements that apply to your license, services, and practice setting, and verify changes through the applicable state licensing board, legislature, regulatory agency, or federal agency. Guardian Clinical Essentials also monitors developments affecting behavioral health practices and publishes articles and resources when changes may warrant a closer look.
Related GCE Compliance Articles
Behavioral health compliance doesn’t stop with state law. Explore additional GCE resources on HIPAA, AI, privacy, documentation, and technology.
Related topics include:
- AI + HIPAA: Resources Hub & Next Steps
- Is AI HIPAA Compliant for Therapists?
- Can Therapists Use ChatGPT for Progress Notes?
- Does a Business Associate Agreement Make AI HIPAA Compliant?
- What AI Risks Belong in a HIPAA Security Risk Analysis?
- Can Therapists Paste Client Information Into AI Tools?
- What Should an AI Policy Include for a Therapy Practice?
- Can Group Practices Allow Staff to Use AI Documentation Tools?
- Are AI Therapy Note Tools Safer Than Recording Sessions?
- What Happens to Client Information After AI Processes It?
- Do You Need Client Consent to Use AI?
- Building AI for Therapy Practices: Behind the Scenes with Uriah Guilford
- Colorado’s New AI Law for Therapists: What Mental Health Practices Need to Change Now
Sources & Resources
Maine: LD 2082, An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services — Maine Legislature. Enacted April 13, 2026.
Rhode Island: H 7349 Substitute A, Oversight of Artificial Intelligence Technology in Mental Health Care Act — Rhode Island General Assembly.
Companion: S 2197 Substitute A.
Tennessee: HB 1470 / SB 1580, Public Chapter 647 — Tennessee General Assembly. Effective July 1, 2026.
Vermont: H.816 / Act 156, An act relating to regulating the use of artificial intelligence in the provision of mental health services — Vermont General Assembly. Approved June 17, 2026.
New York: S8484, Oversight of Technology in Mental Health Care Act — New York State Senate. Companion bill A9106. Pending as of August 31, 2026.
Oregon: Permanent Administrative Order BLPCT 3-2026 — Oregon Board of Licensed Professional Counselors and Therapists. Includes amendment to OAR 833-075-0070 regarding client-record retention. Effective August 12, 2026.
Ohio: Ohio Administrative Code Chapter 5122-26, Policies and Procedures for the Operation of Mental Health Services Agencies — Ohio Laws. Includes updated confidentiality, clinical-record security, and telehealth rules effective August 1, 2026.
Colorado: HB 26-1195, Psychotherapy Artificial Intelligence Restrictions — Colorado General Assembly. Signed June 3, 2026; effective August 12, 2026.
About the Author
Samantha Schalk, LMSW-C, LMSW-M, CAADC, CIMHP, BCP3
Samantha is a licensed mental health professional, private and group practice owner, and the founder of Guardian Clinical Essentials™.
Her work focuses on helping therapists and behavioral health practices understand and implement requirements involving HIPAA, privacy, documentation, technology, and practice operations.
Drawing from her experience in clinical practice, supervision, practice ownership, and compliance consulting, Samantha develops practical compliance resources, training, and implementation guidance specifically for behavioral health professionals.
Learn more about Samantha and Guardian Clinical Essentials™.
Continue Exploring Guardian Clinical Essentials™
Looking for additional compliance, privacy, AI, documentation, and practice operations resources?
Explore the Guardian Clinical Essentials™ Resource Library for educational articles, implementation guidance, training opportunities, and practical resources designed specifically for mental health professionals.