To evaluate an AI tool for a therapy practice, examine the specific workflow, agreement, data handling, and safeguards. A vendor's name or a "HIPAA-compliant" label cannot answer those questions on its own.
Who wrote this: I'm Kamal Grewal, founder of Therapy Companion. This vendor-authored guide helps you organize a buying conversation. It does not determine your practice's legal obligations or approve a particular use of client information. Sources were checked October 2, 2026.
Start with the information you plan to use
Write down the intended task: drafting a general office policy, organizing appointment information, or preparing a note from a clinician's account of an encounter. Those tasks can involve different information and vendors.
HHS explains who is a covered entity or business associate. A provider's covered-entity status depends on the relevant electronic transactions, not simply the job title "therapist." Other privacy and professional obligations may also apply.
For an initial demo, use fictional information. Do not treat deleting a client's name as a reliable way to make a real narrative anonymous. HHS de-identification guidance describes Safe Harbor and Expert Determination, including information that can identify someone indirectly.
Check the exact agreement and service
When a vendor handles PHI on a covered entity's behalf as a business associate, the required agreement needs to address that relationship. An agreement for one product does not establish coverage for every feature, integration, or account the same company sells.
Use the HHS business-associate contract guidance to frame questions about permitted uses, safeguards, incident reporting, subcontractors, and information access. Return or destruction at termination is subject to feasibility; "delete everything instantly" is not a sound universal promise.
Keep the agreement, product scope, relevant settings, and the vendor's written answers together so the practice can revisit its decision when the workflow changes.
Questions to bring to a vendor demo
These are buying questions, not a certification checklist.
| Topic | Ask the vendor | Make the answer concrete |
|---|---|---|
| Product scope | Which subscription, features, and integrations are covered by the agreement? | List the exact services you intend to enable. |
| Data flow | What happens to typed input, attachments, drafts, and diagnostic logs? | Request a description of the systems and providers involved. |
| Reuse | Can information be used for model training, product improvement, or human review? | Ask how the contractual terms and settings address each use. |
| Access | What can clinicians, supervisors, billers, and support staff access? | Walk through the roles your practice will actually use. |
| Retention | What is retained after deletion, including backups and logs? | Ask for the retention periods and any exceptions. |
| Incidents | Who contacts the practice and through which channel? | Review the reporting obligations and operational contact process. |
| Leaving | What can you export, and in what format? | Inspect a sample export and the termination terms. |
| Clinical review | How does a clinician check and correct a draft before signing? | Demonstrate editing, review, and completion with fictional material. |
A provider's answers should distinguish the practice's responsibilities from the vendor's. If a material answer remains unclear, resolve it before adding client information to that workflow.
Assess safeguards beyond the contract
The HHS Security Rule summary describes administrative, physical, and technical safeguards and risk analysis. A list of encryption algorithms does not establish that all of those obligations are met.
In your evaluation, ask how accounts are provisioned and removed, access is reviewed, records are protected and recovered, and incidents are handled. Document which settings the practice must configure and who will maintain them. Revisit the assessment when vendors, features, or data flows change.
Do not use country of incorporation as a shortcut. HHS cloud guidance permits overseas hosting subject to applicable requirements and risk assessment. It also explains that a cloud provider storing encrypted ePHI can be a business associate even if it cannot decrypt the information.
Check how the AI draft fits clinical work
Keep privacy evaluation and documentation review connected. A privacy agreement does not establish that a generated note is accurate.
During a demo, compare a draft with the fictional source information. Look for unsupported statements, missing context, and confusion between what was reported, observed, and inferred. Measure drafting and review rather than accepting a promised completion time.
Our SOAP workflow guide provides a fictional teaching example and review questions. The documentation checklist explains its custom scoring and limits; it does not assess a note's clinical quality or payment eligibility.
Evaluating Therapy Companion
Apply the same questions to Therapy Companion. Start with our security information and the trust portal and BAA information. Request the current documents and confirm the scope for your practice.
The clinical workflow answers describe typed-input drafting and clinician review. In a workflow demo, ask to see the roles, source material, draft corrections, and export requirements that matter to your practice. Keep the evaluation tied to the work you intend to do.
Questions therapists ask
Does every AI tool used by a therapist need a BAA?
The relevant questions are whether HIPAA applies to the practice and whether the vendor handles PHI as a business associate. Using a tool only for general material that contains no PHI is a different situation from sending it identifiable clinical information. Review the actual workflow.
Does signing a BAA make an AI workflow compliant?
No. A BAA addresses the business-associate relationship. The practice still needs to address permitted uses, security risks, configuration, access, and its own procedures. A contract or a product label is not a complete assessment.
Is removing a client's name enough to de-identify a note?
No. Narratives may contain dates, locations, relationships, or unusual events that identify someone. HHS describes two HIPAA methods: Safe Harbor and Expert Determination. Replacing a name with initials is not, by itself, either method.
Does HIPAA require all cloud hosting to be in the United States?
No. HHS allows overseas cloud storage when the applicable HIPAA requirements are met. Location can change the risks and enforcement considerations the practice must assess. U.S. hosting alone does not establish compliance.
What should I ask before buying an AI documentation tool?
Ask which product and features the agreement covers, where information goes, who can access it, how it is retained or reused, and how a clinician reviews the draft. Test the proposed workflow with fictional information before introducing client data.