Can Therapists Use AI
to Write Treatment Plans?
AI tools for therapists have moved well beyond progress notes. Some can take information from an intake, assessment, progress note, or clinical summary and turn it into a treatment plan with goals, objectives, interventions, and measures for tracking progress.
If treatment plans are one of those documentation tasks you would happily make a little faster, that probably sounds pretty appealing. But there is an important difference between using AI to help organize a treatment plan and handing client information to an AI tool and asking it to decide what treatment should look like.
So, can therapists use AI to write treatment plans? Potentially, yes. But you need to look at both sides of the equation: what client information the AI receives and what you are asking the AI to do with it.
Is It Okay for Therapists to Use AI for Treatment Planning?
HIPAA does not prohibit therapists from using AI to assist with treatment planning. If protected health information (PHI) is involved, however, the practice still has to meet the same HIPAA requirements that apply when other technology vendors create, receive, maintain, or transmit PHI on its behalf.
The answer is not simply based on whether the product calls itself an AI treatment plan generator or advertises itself as HIPAA compliant. You need to know what information you are giving the tool, how that information is handled, whether the appropriate contractual protections are in place, and what happens to the information after the AI processes it.
There is also a separate clinical issue. A treatment plan is part of the clinical record and should reflect the actual client, assessment, treatment goals, interventions, and care being provided. AI may be able to help draft the documentation, but the treating professional remains responsible for the final treatment plan.
What Can AI Actually Do With a Treatment Plan?
“Using AI for treatment plans” can mean several very different things.
A therapist might use AI to brainstorm examples of measurable objectives for a particular type of treatment goal without entering any client information. AI could also help improve the wording of goals the therapist and client have already developed or organize clinician-selected information into a clearer format.
A very different use would be uploading an entire intake assessment and asking AI to determine the client’s problems, goals, objectives, interventions, or even what treatment approach should be used.
Using AI to help organize or word clinical decisions you have already made is different from asking AI to make those decisions for you. As AI moves from helping with documentation toward recommending diagnoses, goals, interventions, or treatment approaches, it begins moving into clinical decision-making.
AI Assistance vs. Clinical Decision-Making
AI can help you write a treatment plan. That does not mean AI should decide what the treatment plan should be.
There is a meaningful difference between using AI to organize or improve documentation and relying on AI to make clinical decisions about your client.
AI-generated information can sound polished and clinically appropriate while still being generic, inaccurate, unsupported, or simply wrong. A treatment plan that sounds impressive is not necessarily an individualized or clinically appropriate treatment plan. If AI helps create the draft, the therapist still needs to decide what actually belongs in the client’s plan.
What If AI Needs Client Information to Write the Treatment Plan?
This is where HIPAA becomes much more relevant.
You could ask an AI tool:
Give me examples of measurable treatment objectives that might be appropriate when treating generalized anxiety.
That could potentially be done without providing any client information.
Now compare that with uploading a client’s assessment, diagnosis, trauma history, medications, family information, treatment history, symptoms, and previous notes and asking AI to generate the treatment plan. That scenario may involve a substantial amount of PHI.
If an AI vendor creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered practice, the practice needs to determine whether the vendor is acting as a business associate and whether an appropriate Business Associate Agreement (BAA) is required.
You also need to understand what happens to the information. Is it stored? How long is it retained? Can anyone else access it? Is another vendor or subprocessor involved? Is the information used to train or improve AI models? Can it be deleted? Does the BAA actually cover the service and functionality you are using?
A BAA is important when one is required, but a signed BAA does not answer all of those questions.
Related: Does a Business Associate Agreement Make AI HIPAA Compliant?
Related: What Happens to Client Information After AI Processes It?
Can I Remove the Client’s Name Before Putting Treatment Information Into AI?
Removing a client’s name does not automatically make the remaining information de-identified under HIPAA.
Therapy records can contain an enormous amount of information about a person. Age, location, occupation, diagnosis, family structure, dates of treatment, trauma history, unusual circumstances, or a distinctive event may identify someone even when their name never appears.
HIPAA has specific standards for de-identification. Simply deleting a client’s name from a detailed clinical narrative should not be treated as though the information is automatically de-identified.
This is especially important with treatment planning because the information that makes an AI-generated plan more individualized may also be the information that makes the client more identifiable. Before entering client information into an AI tool, look at the information as a whole rather than relying on whether the obvious identifiers have been removed.
Related: Can Therapists Paste Client Information Into AI Tools?
Does an AI Treatment Plan Generator Need a BAA?
If an AI vendor is creating, receiving, maintaining, or transmitting PHI on behalf of a HIPAA-covered practice and meets the definition of a business associate, an appropriate BAA is generally required.
This is also where therapists need to look beyond the phrase “HIPAA compliant.” An AI company may offer different products, plans, features, or integrations. A BAA may apply only to certain services or account types, and a new AI feature added to software you already use may handle information differently from the rest of the platform.
The question is not only whether the company will sign a BAA. You need to know whether the agreement covers the specific service, account, and function you are actually using with PHI.
That is particularly important when an AI treatment planning feature connects directly with an EHR, pulls information from existing records, processes assessments, or relies on session recordings or transcripts.
Can Therapists Use ChatGPT to Write Treatment Plans?
Possibly, but asking whether therapists can use “ChatGPT” is still too broad to answer the compliance question.
There is a significant difference between using AI to generate generic examples of treatment objectives without providing client information and entering identifiable clinical information so the AI can generate a client’s actual treatment plan.
If PHI is involved, the specific service, account, functionality, contractual protections, configuration, and data handling all matter. The fact that a product is made by a particular company does not automatically tell you whether your particular use of it is appropriate for PHI.
This is also why copying a client’s intake or assessment into whatever AI tool happens to be open in your browser is not a good way to approach this.
What Should Therapists Review Before Using an AI-Generated Treatment Plan?
Even when the privacy and security pieces are handled appropriately, the finished treatment plan still needs clinical review.
Look at whether the plan actually reflects the client’s assessment, presenting concerns, diagnosis when applicable, goals, current functioning, and treatment being provided. Goals and objectives should make sense for that individual rather than simply sounding clinically sophisticated.
Pay particular attention to anything the AI added that you did not specifically provide. Did it introduce symptoms the client never reported? Suggest an intervention you are not actually using? Create a goal that was never discussed? Make assumptions about the diagnosis or level of impairment? Produce measurable objectives that look good on paper but have little connection to the work happening in treatment?
AI can make documentation faster while also making it easier to create a polished record that does not accurately reflect the client. The final treatment plan remains the therapist’s clinical documentation, so it should be reviewed with the same care you would give documentation you wrote yourself before it becomes part of the record.
What If the AI Creates the Treatment Plan From a Session Recording or Transcript?
A tool that records or transcribes a therapy session raises additional considerations because it may create copies of client information that would not otherwise exist. The practice needs to understand what happens to the recording and transcript, where they are processed, whether they are retained, who can access them, and whether additional privacy, consent, or state-law requirements apply.
A traditional treatment plan contains selected information that belongs in the clinical record. A recording may capture an entire therapy conversation. If an AI treatment-planning feature depends on recording sessions, the recording and transcription process also needs to be evaluated rather than focusing only on the treatment plan that comes out at the end.
Related: Are AI Therapy Note Tools Safer Than Recording Sessions?
Do Clients Need to Consent to AI Treatment Planning?
There is not one universal consent rule that applies to every AI tool, therapist, and jurisdiction.
Whether additional consent or disclosure is required can depend on what the technology does, what information it collects, whether sessions are recorded, where the therapist and client are located, and which state and professional requirements apply.
Using AI to help improve the wording of a treatment objective is not the same as recording a psychotherapy session and sending the recording to an AI system to generate documentation. Those differences need to be considered when determining what requirements apply.
Who has time to track every new AI, HIPAA, and privacy law? Apparently, I do. And I love it!
Sign up for the Guardian Clinical Essentials newsletter and get important compliance updates for behavioral health practices delivered straight to your inbox. No fluff, just the developments worth knowing about.
The Bottom Line
Therapists can potentially use AI to help write treatment plans, but there is a significant difference between using AI to assist with documentation and allowing it to make clinical decisions.
If client information is involved, you need to know where that information is going, how it is handled, whether an appropriate BAA is in place when required, and whether the particular AI function is appropriate for PHI. The therapist also remains responsible for making sure the final treatment plan is accurate, individualized, clinically appropriate, and consistent with the care actually being provided.
AI can be useful here. The important part is understanding what the technology is doing with client information and reviewing what it produces before that content becomes part of the clinical record.
Guardian Clinical Essentials Resources
Guardian Clinical Essentials develops HIPAA, privacy, technology, and compliance resources specifically for therapists and behavioral health practices. GCE also monitors federal and state developments that may affect behavioral health practice and reviews existing resources when relevant requirements change.
For practical compliance resources, articles, tools, and free resources, visit Guardian Clinical Essentials.
This article is provided for educational and informational purposes and does not constitute legal advice. Laws, regulations, licensing requirements, and professional obligations may change. Mental health professionals should review the requirements applicable to their practice and consult qualified legal counsel when needed.
Frequently Asked Questions
Is It a HIPAA Violation for Therapists to Use AI for Treatment Plans?
Not automatically.
HIPAA does not prohibit the use of AI for treatment planning. If PHI is involved, however, the practice needs to evaluate how the AI vendor handles that information and comply with applicable HIPAA requirements, including business associate requirements when they apply.
Can I Use ChatGPT to Write a Treatment Plan?
Potentially.
Using ChatGPT or another AI tool without client information is different from entering PHI to generate an actual client’s treatment plan. If PHI is involved, the specific service, account, functionality, contractual protections, configuration, and data handling need to be evaluated.
Does an AI Treatment Plan Generator Need a BAA?
If the vendor is acting as a business associate by creating, receiving, maintaining, or transmitting PHI on behalf of a HIPAA-covered practice, an appropriate BAA is generally required. The practice should also confirm that the BAA applies to the particular service and AI functionality being used.
Can I Remove a Client's Name Before Using AI for a Treatment Plan?
Removing the client’s name alone does not necessarily make the information de-identified under HIPAA. Clinical information may contain other details that identify the client, and HIPAA has specific standards for de-identification.
More AI + HIPAA Resources for Therapists
This article is part of Guardian Clinical Essentials™’ AI + HIPAA Resources Hub, created to help therapists and behavioral health practices understand how privacy, security, and compliance requirements apply when AI enters the practice.
You may also want to read:
Sources
U.S. Department of Health and Human Services, Office for Civil Rights
Summary of the HIPAA Security Rule
Guidance on HIPAA & Cloud Computing
Guidance Regarding Methods for De-identification of Protected Health Information
About the Author
Samantha Schalk, LMSW-C, LMSW-M, CAADC, CIMHP, BCP3, CHPSE
Samantha is a licensed mental health professional, private and group practice owner, Certified HIPAA Privacy Security Expert (CHPSE), and the founder of Guardian Clinical Essentials™.
Her work focuses on helping therapists and behavioral health practices understand and implement requirements involving HIPAA, privacy, security, documentation, technology, and practice operations.
Drawing from her experience in clinical practice, supervision, practice ownership, and compliance consulting, Samantha develops practical compliance resources, training, and implementation guidance specifically for behavioral health professionals.
Learn more about Samantha and Guardian Clinical Essentials™.
Continue Exploring Guardian Clinical Essentials™
Looking for additional compliance, privacy, AI, documentation, and practice operations resources?
Explore the Guardian Clinical Essentials™ Resource Library for educational articles, implementation guidance, training opportunities, and practical resources designed specifically for mental health professionals.