Can therapists use AI note-takers? What the new state laws allow

If you run a small therapy practice, your evenings probably go to progress notes, insurance paperwork and scheduling emails. AI note-takers promise to take a lot of that away. But this year, more states passed laws on AI in mental health care, and many therapists now wonder whether the tools they use, or want to use, are still allowed.

The question got sharper on September 30, 2026, when California Governor Gavin Newsom vetoed SB 903, a bill that would have restricted how licensed professionals use AI in psychotherapy. Meanwhile, Colorado’s law took effect in August, and Illinois, Nevada, Maine, Vermont and Rhode Island already have their own.

This guide explains what those laws let you do with AI, what they don’t, and how to set up an AI note-taker the careful way. Hellospark, a small AI consultancy for US solo professionals, explains how the tools work and what the state texts say — we read each law on the state’s own website. We are not a law firm or a health care provider. The legal and clinical calls are yours.

What do the new state laws actually ban?

The short version: AI can help you run your practice, but it can’t be the therapist. The laws we read share a common pattern. They stop AI from making therapeutic decisions or talking to clients as if it were the clinician, and they allow AI for admin and record-keeping under your supervision.

State	What AI may help with	What the clinician may not let AI do	Consent when a session is recorded or transcribed
Illinois (Public Act 104-0054)	Administrative support and supplementary support, including therapy notes, with the clinician keeping full responsibility	Make independent therapeutic decisions, interact directly with clients in therapeutic communication, generate recommendations or treatment plans without your review and approval, or detect emotions or mental states	Written notice that AI will be used and for what purpose, plus written consent the client can revoke
Nevada (AB 406, 2025)	Administrative support, including scheduling, billing, managing records and “organizing, tracking and managing files or notes relating to an individual session”	Use AI in connection with providing professional mental and behavioral health care directly to a patient	No consent rule in the text. You must independently review the accuracy of AI-generated notes and billing records
Colorado (HB26-1195, effective August 12, 2026)	Administrative and supplementary support, including therapy notes, if you review the outputs	Engage in therapeutic communication without synchronous, real-time interaction with you and the client, or generate recommendations or treatment plans without your review and approval	Advance written notice and written consent. Refusing or withdrawing consent cannot be a basis to deny services
Maine (LD 2082, approved April 13, 2026)	Administrative and supplementary support, including therapy notes, with full responsibility for outputs and data use	Make independent therapeutic decisions, interact directly with clients in therapeutic communication, or generate recommendations or treatment plans without your review and approval	Written notice, including how session data will be stored, retained, used for training and deleted, plus consent. You may not deny services solely because a client says no
Vermont (Act 156 of 2026, signed June 17, 2026)	HIPAA-compliant AI tools, provided you review and approve any mental health services	Not listed the same way. The law bars companies and other entities from offering mental health services, including through AI, unless a mental health professional provides them, and prohibited AI use by a professional is unprofessional conduct	No consent rule in the text
Rhode Island (H 7349, enacted June 22, 2026)	Administrative and supplementary support, including therapy notes	Make independent therapeutic decisions, determine recommendations or treatment plans, or interact directly with clients in therapeutic communication without an established clinical relationship	Written notice and consent before certain AI is used where a session is recorded or transcribed

Two details stand out. Illinois is the only one of these laws that bars clinicians from letting AI “detect emotions or mental states.” And Colorado requires you to give clients written information about its AI restrictions during the initial client contact.

Does an AI note-taker count as “supplementary support”?

Mostly, yes. Illinois, Colorado, Maine and Rhode Island all define supplementary support to include “preparing and maintaining client records, including therapy notes.” Nevada lists managing notes relating to an individual session as an allowed administrative task.

Administrative support

Tasks that don't involve therapeutic communication, such as scheduling and reminders, billing and insurance claims, and general messages about therapy logistics without therapeutic advice.

Supplementary support

Other behind-the-scenes help that doesn't involve therapeutic communication, such as preparing client records and therapy notes, tracking progress (subject to clinician review) and organizing referrals.

Therapeutic communication

Interactions meant to diagnose or treat, including reflecting a client's thoughts and emotions, offering strategies or interventions, and offering emotional support or reassurance. This is the part AI may not do on its own.

Business associate

Under HIPAA, a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity. HHS lists the vendor of an app that provides transcription services as an example.

There is one gray area worth flagging, and this is our reading, not a ruling. Many AI note-takers add mood or risk labels to their drafts. In Illinois, a feature that labels a client’s affect could arguably count as AI detecting emotions or mental states, which the law bars outright. If you practice in Illinois, ask your vendor whether those features can be switched off, and ask your board or a lawyer how to treat them.

What does valid consent look like?

The consent rules are stricter than a checkbox. Illinois, Colorado, Maine and Rhode Island all say consent does not include accepting a general or broad terms-of-use agreement that mentions AI alongside unrelated information. It also doesn’t count if it comes from hovering over, muting, pausing or closing digital content, or from deception.

Here is what the texts ask for:

• Illinois: tell the client in writing that AI will be used and its specific purpose, and get written consent the client can revoke.
• Colorado: tell the client in advance, in writing, and get written consent. Consent is needed for the first use, not every session, unless the purpose or manner of use materially changes.
• Maine: tell the client in writing that AI will be used, its purpose, and how session data will be stored, retained, used for training and deleted. Consent can be given by initialing a specific section of your consent-to-treatment agreement.
• Rhode Island: written notice that AI will be used and its specific purpose, plus consent, before certain AI is used where a session is recorded or transcribed.

Practical advice, not a legal requirement in every state: even if your state has no consent rule, a short, separate AI consent is good practice, and it’s an easy way to build trust with clients.

What does HIPAA add?

The state laws sit on top of HIPAA, and Colorado and Nevada say so explicitly: AI use must comply with HIPAA and other privacy laws.

The key HIPAA point is the business associate agreement (BAA). HHS explains that a covered entity may share protected health information with a business associate only after getting satisfactory assurances, in a BAA, that the business associate will safeguard it. HHS’s list of business associate examples includes the vendor of an app that provides transcription services and a third-party AI chatbot on a patient portal that handles patient information.

In plain terms: a consumer chatbot that won’t sign a BAA is not the place for session notes. Choose a tool built for clinical use, and keep the signed BAA on file.

What happened in California?

On September 30, 2026, Governor Newsom returned SB 903 without his signature. In his veto message, he said he supports guardrails for AI in health care, but that the bill “is overly broad and would drastically limit a clinician’s use of tools that benefit the delivery of care today.” He encouraged the author and stakeholders to revisit the issue next year.

So SB 903 did not become law, and California has no therapy-specific AI statute. But one AI law is already in force for every California health profession. AB 489 (Business and Professions Code §§ 4999.8–4999.9) has applied since January 1, 2026. It bars AI from implying that a licensed professional is giving the care or advice, and it lets your licensing board enforce that. HIPAA and your board’s rules still apply either way.

How much more AB 489 asks of you depends on which board licenses you. The California Board of Psychology’s AB 489 advisory tells psychologists and its registrants that any AI use ‘must be transparent and appropriately disclosed.’ It also says AI-generated content, including treatment summaries, reports and automated messages, must be clearly identified and reviewed by the licensee. That advisory covers Board of Psychology licensees only. The Board of Behavioral Sciences, which licenses LMFTs, LCSWs and LPCCs, has discussed AI rules (December 2025 staff memo), but as of October 25, 2026 we found no adopted BBS rule. If you hold a BBS license, follow AB 489 itself and check bbs.ca.gov for updates.

What about other states?

Not every board answered with a restrictive statute. In Idaho, the Board of Psychologist Examiners adopted non-binding guidance on September 23, 2026 (published October 26, 2026) that says AI “may be utilized by licensees, provided such use complies with Idaho law and the applicable standard of care.” The Board does not preapprove tools. This covers psychologists only, and the document itself says it is general guidance and non-binding. Its checklist asks whether protected health information stays confidential, whether a business associate agreement is needed or data is de-identified first, how outputs will be independently verified, whether bias could skew a recommendation, and whether the nature and extent of AI use should be disclosed to the patient or documented in the record. A psychologist “remains professionally accountable for all care they provide, direct, or oversee.” That is a different posture from the Illinois-to-Rhode Island laws above, which spell out what AI may and may not do and, in several states, when written consent is required.

Counseling boards in two more states took a similar line. Virginia’s Board of Counseling adopted Guidance Document 115-4 on October 17, 2025 (effective January 15, 2026). It says the regulations “do not prohibit the use of AI,” but the licensee “remains accountable and responsible for all decisions.” It also points to the existing rule that counselors get the client’s informed consent before audio recording a session, and it urges caution because AI can be biased. This is board guidance for licensed counselors, not a new law; the Board notes similar standards apply to marriage and family therapists and substance abuse treatment practitioners.

In Kentucky, the Board of Licensed Professional Counselors issued a statement on February 12, 2026 saying AI “cannot be a licensed professional” and that using it in any part of a client’s care “requires explicit and transparent informed consent,” including telling clients they can opt out. It also says AI use, such as generating notes, must be documented in the client’s record. This applies to licensed professional counselors, and the statement itself says it is for “informational purposes only” and is not official guidance from the board.

How do you set up an AI note-taker safely?

1. Check where your clients are. List the states your clients are located in, including telehealth clients, and read those states’ laws. Our practical advice: when in doubt about which state’s rules apply, ask your licensing board.
2. Pick a clinical-grade tool. Choose a note-taker built for health care that will sign a BAA. Read how it stores, retains and deletes recordings, and whether it trains on your data. Maine’s notice requires exactly those details.
3. Sign the BAA and save it. Keep a copy with your HIPAA records.
4. Switch off what you don’t need. Turn off features that label emotions or suggest diagnoses or treatment plans, especially in Illinois. Turn on multifactor authentication.
5. Write a separate AI consent form. Name the tool, say it records or transcribes the session, explain its purpose and how data is handled, and explain how to withdraw. Keep it separate from your general intake terms.
6. Offer a no-AI option. Be ready to take notes manually for any client who says no. In Colorado and Maine, a refusal can’t be held against the client.
7. Review every draft before you sign it. Check for things the client never said, symptoms you never assessed and plans you didn’t decide on. The note is yours, not the AI’s.
8. Start with the admin. Scheduling reminders, billing follow-ups and logistics emails are the lowest-risk place to begin, and none of these laws bans them.

Where to go from here

These laws draw a clear line: AI handles the paperwork, and you handle the therapy. Set up well, an AI note-taker can still give you your evenings back without putting your license or your clients’ trust at risk.

If you want help choosing a HIPAA-ready tool, switching off the risky features and drafting a plain-English consent form, that’s what a 1-hour, 1:1 AI setup session ($100) is for: we work through it with you on video, in your own accounts. Not sure yet? Book the free 15-minute fit call. For which ChatGPT plans can hold patient data, read Is ChatGPT HIPAA compliant?, and for picking which tasks to automate first, see What is an AI agent, and which tasks should you automate first?

Sources

• Office of the Governor of California, SB 903 veto message (September 30, 2026)
• California Legislature, AB 489 (Bonta), Chapter 615, Statutes of 2025, B&P §§ 4999.8–4999.9 (operative January 1, 2026)
• California Board of Psychology, AB 489 legislative advisory
• California Board of Behavioral Sciences, Policy & Advocacy Committee memo on AI regulation (December 23, 2025)
• Illinois General Assembly, Public Act 104-0054: Wellness and Oversight for Psychological Resources Act (HB 1806)
• Nevada Legislature, AB 406 (2025), enrolled text
• Colorado General Assembly, HB26-1195: Psychotherapy Artificial Intelligence Restrictions and signed act text
• Maine Legislature, LD 2082: An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services (Public Law 2025, chapter 687)
• Vermont General Assembly, Act 156 of 2026 (H.816), as enacted
• Rhode Island General Assembly, Public Law 2026, chapter 373 (H 7349 Substitute A): Oversight of Artificial Intelligence Technology in Mental Health Care Act (enacted June 22, 2026)
• U.S. Department of Health and Human Services, Business Associates (HIPAA guidance)
• Idaho Division of Occupational and Professional Licenses, Board of Psychologist Examiners, Use of Artificial Intelligence in Clinical Practice Guidance Document (adopted September 23, 2026; published October 26, 2026)
• Idaho DOPL press release, Board of Psychologist Examiners – Guidance on Artificial Intelligence in Clinical Practice (October 26, 2026)
• Virginia Board of Counseling, Guidance Document 115-4: Use of Artificial Intelligence (AI) as a Tool in Practice (adopted October 17, 2025; effective January 15, 2026 per the Board’s guidance documents list)
• Kentucky Board of Licensed Professional Counselors, Statement regarding the use of Artificial Intelligence in the counseling profession (February 12, 2026; informational only, not official board guidance)