Compliance · October 6, 2026 · 8 min read

HIPAA-Compliant AI for Small Therapy Practices: What You Can Use

Small practice owners are discovering what AI can do, often through a general-purpose assistant they started using for reports and emails. Then they try it on the work that actually eats their evenings, billing, referral faxes, intake, and hit the same wall: that work involves patient information, and the tool they are using is not set up for it. The enterprise plans that are, often look built for a company ten times their size.

The BAA is the line

Under HIPAA, any vendor that creates, receives, stores, or transmits protected health information on your behalf is a business associate, and you need a signed Business Associate Agreement with them before sharing that information. Pasting a referral fax, a claim, or a session summary into an AI tool shares protected health information with that vendor. Without a BAA, that is a disclosure HIPAA does not permit, however secure the tool is in practice. The general question of whether AI can be HIPAA compliant is covered in is AI HIPAA compliant?

Why general-purpose AI plans rarely fit small practices

The general-purpose AI assistants most people start with are built for everyone. Their consumer and individual plans generally do not come with a BAA. Some vendors offer BAAs, typically for enterprise plans or API access, sometimes with seat minimums, sales review, or technical setup that assumes an IT team. For a 15-person practice, paying for a large organization's plan to process referral faxes is hard to justify. Terms change, so check each vendor's current BAA policy directly rather than relying on what you heard.

Matching the work to the right option

Most of what small practices want AI for falls into a few categories, and each has a sensible home:

• Billing and claims. Involves patient information. Use AI built for behavioral health billing under a BAA, such as AI billing that works inside your EHR.
• Reading referral faxes. Involves patient information. Use fax referral intake designed for it, under a BAA.
• Phones, texts, and intake. Involves patient information. Use a behavioral health AI front desk under a BAA.
• Clinical notes. Involves patient information. Many EHRs now offer note-taking features covered by the agreement you already have with them.
• Policies, job posts, website copy, reports without patient data. No patient information. A general-purpose assistant is fine here, and it is where many practices get their best early value.

Removing a name is not de-identification

It is tempting to strip the name and paste the rest. HIPAA's de-identification standard is far stricter: the Safe Harbor method requires removing eighteen kinds of identifiers, including dates more specific than the year, small geographic areas, phone numbers, and record numbers. A referral fax with the name blacked out is still protected health information. If the work needs the patient's details to be useful, it needs a BAA.

Substance use records need more

If your practice treats substance use disorders, records covered by 42 CFR Part 2 carry restrictions beyond HIPAA, including specific consent requirements for disclosure. Ask any AI vendor how they handle Part 2 records, not just HIPAA.

Six questions to ask any AI vendor

• Will you sign a BAA with a practice our size? Not someday, and not only on an enterprise plan.
• Is our data used to train your models? The answer should be no, in writing.
• Where is our data stored, and for how long? Retention should be limited to what the work requires.
• Who at your company can see our patients' information? Access should be restricted and logged.
• Do you handle 42 CFR Part 2 records? Essential if you treat substance use disorders.
• Does it work inside our EHR? Copying patient data between systems by hand is where errors and exposure creep in.

Where Stable fits

Stable is built for behavioral health practices, signs a BAA, and works inside the EHR you already use, including SimplePractice and TherapyNotes. It handles the patient-information work small practices most want to hand off: answering calls and texts, reading referral faxes, verifying insurance, and preparing and working claims. For a fuller vendor checklist, see HIPAA-compliant AI: what it means and how to choose it.

Frequently asked questions