Hello Reader,

Tuesday Telehealth Tip: Security and AI, Minus the Fine Print Headache

Welcome to the finale of our October series on tech in behavioral health. So far we’ve connected your systems, put measurement-based care on autopilot, and made sure every client can get into a session, flip phone included.

This week we’re covering the topic everyone loves until someone reads the terms of service: security and AI.

First, a reality check. AI note-takers are great. Clinicians who use them often say they’ve gotten their evenings back, and plenty of them are no longer writing notes in the car. That matters. But a therapy session is about as private as a conversation gets. Before software listens in, you should know exactly where those words end up.

Here are three takeaways for behavioral health organizations:

1. Ask where the recording goes before it goes anywhere

Every AI scribe pitch sounds about the same: “Secure, HIPAA-compliant, and it basically writes itself.” Maybe so. Before you sign anything, get clear answers to these questions:

• Will you sign a Business Associate Agreement that covers the AI features, not just the video platform?
• Is the audio stored, and if it is, for how long, and who can access it?
• Is session data used to train your models? (Look for “no” in writing, not “not currently.”)
• Can I delete a client’s recording and transcript on request?

If the sales rep has to “circle back” on all four, you’ve learned something.

This applies to Zoom too. Turning on an AI feature inside a platform you already trust is still a new decision, so confirm that the features you enable are covered under your agreement.

2. Consent is becoming the law, not just good manners

A growing number of states now regulate AI in therapy. Illinois requires written, revocable consent before AI records or transcribes a session, and it states that accepting general terms of use doesn’t count. Colorado, Maine and Rhode Island have added their own consent rules this year. Texas requires disclosure when AI is used in care, and more states have bills pending.

Even if your state hasn’t acted yet, the safest and most respectful approach is the same: tell clients in plain language what the AI does, get their consent in writing, and make “no thanks” an easy answer that doesn’t affect their care. Some clients will say no, and that’s fine. Trust is the whole job.

​See the state-by-state AI therapy law tracker →​

3. The boring stuff is still what gets you in trouble

AI gets the headlines, but most breaches start the old-fashioned way: someone clicks a convincing email. In February, a substance use treatment center in Illinois paid a $103,000 settlement after a phishing attack exposed nearly 2,000 patients’ records. Regulators focused less on the phishing email and more on the fact that the organization had never done a thorough risk analysis.

That’s the theme of HHS enforcement right now. When something goes wrong, the first question is “where’s your risk analysis?” The good news is that it’s a fixable gap, and HHS offers a free tool to help small practices get started.

​Read about the settlement →​
​Get the free HHS Security Risk Assessment Tool →​

Where Secure Telehealth comes in

This is the part of tech that keeps people up at night, and it shouldn’t. Secure Telehealth helps you vet AI tools before you commit, set up your Zoom for Healthcare account with the right protections turned on, write a client-friendly AI consent form, and complete a risk analysis that’s actually useful instead of one that sits in a drawer. You get the time savings of AI without wondering what happens to the recordings.

This week’s tip: List every tool in your practice that can hear, see or store a client’s words. That includes video, AI scribes, voicemail, texting and the “free” transcription app someone downloaded. Next to each one, write whether you have a BAA. Any blank spot goes to the top of your to-do list.

That’s a wrap on October! If you missed any part of the series, here it is:
Part 1: Your EHR Should Play Well With Others →​
Part 2: Outcomes Without Spreadsheets →​
Part 3: Telehealth for Every Patient →​

Thanks for spending your Tuesdays with me. Hit reply and tell me what you want covered next. I read every one, without an AI summary.

Talk soon,
Dan Mountain

P.S. Thinking about adding an AI scribe but not sure how to evaluate it? Fill out this form if interested in a Virtual Care Operations Assessment → We’ll review your setup, your consent process and your risk gaps together, before a client asks.

Before you take advantage of the offer below, take a look at this week's sponsor - especially if you have little ones at home!

We talk a lot about Healthcare for Humans in this newsletter, but don't forget about your pets! Before you take advantage of the offer below, Check out this week's sponsor!

$499.00 / month Profit and Freedom: Your roadmap to more revenue and less headaches using Telehealth Gives your organization an operations expert on call, so you can spend your time with clients instead of wrestling with... Read more Get it now!

​