Is Your Client Data Safe with AI? What Therapists Need to Know About HIPAA, BAAs, and Session Transcripts - An Interview with Ali Hartley, JD

Is Your Client Data Safe with AI? What Therapists Need to Know About HIPAA, BAAs, and Session Transcripts - An Interview with Ali Hartley, JD

Ali Hartley, JD, SimplePractice's Chief Legal Officer, on HIPAA, AI scribes, BAAs, and data privacy for therapists.

Most therapists are feeling uneasy about data privacy in the age of AI, and some are terrified that their session transcripts are being used to build their replacements. In this continuing education podcourse, Curt and Katie take both concerns to Ali Hartley, JD, Chief Legal Officer at SimplePractice.

Ali explains how the HIPAA Privacy, Security, and Breach Notification Rules apply to AI scribes and other AI tools, why a business associate agreement (BAA) is necessary but never sufficient, and how HIPAA's Safe Harbor and Expert Determination methods of de-identification work. She also clears up the difference between training an AI model and refining the prompts that guide a product, including what SimplePractice does with de-identified session transcripts. This episode is part of our partnership with SimplePractice.

Whether you use an AI note taker built into your EHR, a browser extension, or a separate tool you copy and paste into, this conversation will help you protect client data and ask better questions about the software in your practice.

In this episode, we discuss:

- Why HIPAA applies to AI tools the same way it applies to every other technology

- What a BAA covers, and what stays your responsibility as the covered entity

- The four points where client data is most vulnerable in an AI scribe workflow

- How Safe Harbor, Expert Determination, and data decoupling protect session transcripts

- Why refining prompts with de-identified data is different from training an AI model

- The data privacy risks of browser extensions and copy-and-paste workflows

- What to ask before adopting any AI tool that handles client data

Timestamps:

- 07:08 - HIPAA basics for therapists

- 10:34 - How HIPAA applies to AI and where client data is vulnerable

- 15:38 - What a BAA does and doesn't guarantee

- 24:16 - De-identification: Safe Harbor vs. Expert Determination

- 29:43 - Training an AI model vs. refining prompts

- 36:55 - How SimplePractice handles session transcripts

- 42:38 - Native EHR tools, browser extensions, and copy and paste

- 51:41 - A checklist for vetting AI tools

- 56:09 - Emerging risks and liability for AI-generated notes

Guest Bio:

Ali Hartley, JD, is Chief Legal Officer at SimplePractice and a general counsel and healthcare attorney with nearly two decades of experience in corporate law, regulatory compliance, and people leadership. She helps SimplePractice remove administrative burdens for clinicians while enabling responsible innovation and protecting sensitive healthcare data.

Earn 1 CE credit for this podcourse at the Modern Therapist Learning Community: https://learn.moderntherapistcommunity.com/

Full show notes and transcript: https://mtsgpodcast.com

Join the Modern Therapist Community

Patreon: https://www.patreon.com/c/mtsgpodcast

Facebook Group: https://www.facebook.com/groups/therapyreimagined

Modern Therapist's Survival Guide Creative Credits

Voice Over by DW McCann: https://www.facebook.com/McCannDW/

Music by Crystal Grooms Mangano: https://groomsymusic.com/