Can You Use ChatGPT or AI for Therapy Notes? Ethics, HIPAA & the New Epic Integration

Quick Answer: Can You Use ChatGPT for Therapy Notes?

It depends on which version you use. As of April 2026, OpenAI has launched ChatGPT for Clinicians — a dedicated version designed for clinical tasks including documentation. This changes the landscape significantly, but the free consumer version of ChatGPT remains off-limits for PHI.

ChatGPT for Clinicians (NEW — launched 2026): ✅ Free for verified US physicians, NPs, PAs, and pharmacists ✅ Optional HIPAA support via Business Associate Agreement (BAA) for eligible accounts ✅ Conversations are NOT used to train models ✅ Multi-factor authentication and account security ✅ Tested by physicians: 99.6% of responses rated safe and accurate ✅ Skills for repeatable clinical workflows (referral letters, prior auth, patient instructions) ✅ Deep research across peer-reviewed medical journals with citations

Regular ChatGPT (Free/Plus — still risky for PHI): ❌ No BAA available for individual consumer accounts ❌ Data may be used for model training (unless opted out) ❌ No PHI-specific safeguards ❌ Not designed for clinical documentation workflows ❌ Severe penalties for HIPAA violations: fines up to $1.5 million/year

ChatGPT with Epic (new, September 2026): organizations that run Epic can now connect it to ChatGPT for Healthcare or a HIPAA-enabled ChatGPT Enterprise workspace, under a BAA. Clinicians can then review the Epic charts they already have access to. The connection is read-only, so it can’t write a therapy note into Epic, and it isn’t available on individual accounts, including ChatGPT for Clinicians. More in the September 2026 update below.

Bottom line: If you are a verified US clinician, ChatGPT for Clinicians with a BAA is now a legitimate option for clinical documentation support. For everyone else — or if you want a fully integrated EHR workflow — purpose-built clinical AI like ClinikEHR's Clinical Note AI remains the safest and most practical choice. If you work in a health system on Epic, ask your IT or compliance team whether it has approved the new ChatGPT integration: it helps you review the chart before a session, but the note is still written and signed in Epic.

The Complete Guide: Why This Matters for Your Practice

It’s the question every tech-savvy therapist in the United States, UK, Canada, Australia, and Africa is asking: “Can I just use ChatGPT to write my therapy notes?” The temptation is understandable. Public AI tools are powerful, accessible, and seem like a quick fix for the endless burden of documentation. But the answer is far more complex than a simple yes or no, and getting it wrong can have serious consequences for your practice and your clients.

Using the wrong AI tool can expose you to significant legal and ethical risks. However, using the right AI tool can be transformative. This guide will clarify the misconceptions, explain what HIPAA really says, and show you how to use AI for documentation ethically and safely, with purpose-built solutions like ClinikEHR’s Clinical Note AI.

Why This Question Keeps Coming Up: The Allure of Easy Documentation

The rise of generative AI has been meteoric. Tools like ChatGPT, Gemini, and Claude are now part of the public consciousness. For clinicians drowning in paperwork, the appeal is obvious: a technology that can summarize text and generate human-like prose seems like the perfect antidote to documentation fatigue. This curiosity, however, often outpaces a clear understanding of the risks involved. The convenience of a public AI tool can easily overshadow the fundamental requirements of handling Protected Health Information (PHI).

What HIPAA Actually Says About AI Tools

HIPAA doesn’t mention “ChatGPT” by name, but its principles are timeless and apply to any technology that handles PHI. The two most important concepts for a therapist to understand are:

1. Business Associate Agreements (BAA): Under HIPAA, any third-party vendor that creates, receives, maintains, or transmits PHI on your behalf is a “Business Associate.” You are legally required to have a signed BAA with them. This agreement contractually obligates the vendor to protect PHI according to HIPAA standards. Public AI tools like the free version of ChatGPT do not and will not sign a BAA. Using them with PHI is a direct violation.
2. Minimum Necessary Standard: This principle dictates that you should only use, disclose, or request the minimum amount of PHI necessary to accomplish a specific task. Pasting an entire session transcript into a public tool goes far beyond this standard.

Using a non-compliant tool for any task involving PHI is a direct violation of HIPAA in the US, and similar principles apply under GDPR (UK/EU), PIPEDA (Canada), and other data protection laws in Australia and Africa. The penalties can include severe fines, licensure issues, and irreparable damage to your professional reputation.

2026 Update: OpenAI Launches ChatGPT for Clinicians

In a significant development, OpenAI announced ChatGPT for Clinicians — a dedicated version of ChatGPT designed specifically for clinical tasks. This changes the conversation around AI and therapy notes considerably.

What ChatGPT for Clinicians offers:

• Free access to frontier AI models for verified US physicians, NPs, PAs, and pharmacists
• Optional HIPAA support via a Business Associate Agreement (BAA) for eligible accounts
• No model training on conversations — your data stays private
• Clinical workflow skills — reusable templates for referral letters, prior authorization, patient instructions, and documentation
• Trusted clinical search with real-time, cited answers from peer-reviewed medical sources
• Deep research across medical journals with source citations
• CME credits from eligible evidence reviews — no separate courses needed
• 99.6% safety rating — physician advisors tested 6,924 conversations and rated 99.6% of responses as safe and accurate

What this means for therapists:

This is a genuine step forward. For the first time, a major consumer AI platform offers HIPAA-compliant infrastructure for clinical use. However, there are important caveats:

1. Currently US-only — verified US clinicians only (expansion planned via the Better Evidence Network)
2. BAA is optional and for eligible accounts — you must specifically enable HIPAA support; the default consumer ChatGPT still has no BAA
3. Not an EHR — ChatGPT for Clinicians generates text but doesn't integrate with your scheduling, billing, patient portal, or clinical workflow
4. Still requires clinician review — OpenAI explicitly states it's "designed to support clinicians with information, not replace their judgment or expertise"
5. Therapist-specific features are limited — it's built for general clinical use, not specifically for mental health documentation formats like SOAP, DAP, BIRP, or GIRP

Our recommendation: If you're a verified US clinician, ChatGPT for Clinicians with BAA enabled is now a legitimate tool for clinical documentation support. But for a complete, integrated workflow — where AI notes flow directly into your EHR, connect to scheduling, billing, and patient records — purpose-built solutions like ClinikEHR remain more practical for day-to-day practice management.

September 2026 Update: ChatGPT Now Connects to Epic EHR

On September 1, 2026, OpenAI announced an Epic integration for ChatGPT for Healthcare. Health systems that run Epic can now bring patient context from their Epic records into ChatGPT, so a clinician can ask what has changed since a patient’s last visit, which recent results to review, or which follow-ups are still open, and get a summary that points back to the chart. UCSF Health is named as a pilot partner.

How the ChatGPT–Epic integration works

According to the help article on the Epic plugin, the organization first registers an app in its own Epic environment, and each clinician then signs in with their own Epic account. ChatGPT can read the clinical notes, medications, conditions, encounters and lab results that clinician is already allowed to see, and it doesn’t widen anyone’s access. It comes in two forms:

• Epic context in ChatGPT: bring an authorized patient’s information into a ChatGPT conversation to review their history and prepare for an appointment.
• ChatGPT inside Epic: in supported deployments, ChatGPT sits inside the Epic chart layout, so clinicians don’t have to leave the record.

Alongside it came a Healthcare Public Data plugin with connectors to nine official sources, including PubMed, DailyMed, ClinicalTrials.gov, RxNorm and CMS coverage policies. That plugin searches public data only and never touches patient charts.

OpenAI also reports its own evaluation: across 4,363 physician ratings of ChatGPT working with connected EHR data, 99.1% of responses were rated safe, over 27 clinical use cases such as pre-visit review, medication review and handoff summaries.

What the Epic integration can’t do

• It’s read-only. The Epic plugin’s help article says the connection currently can’t update medical records, place orders, message patients or override chart permissions. It can’t save a progress note into Epic.
• It isn’t for individual accounts. It needs an approved ChatGPT for Healthcare workspace or a HIPAA-enabled ChatGPT Enterprise workspace, covered by a Business Associate Agreement. Individual ChatGPT for Clinicians accounts can’t use it; they can install only the Healthcare Public Data plugin.
• Accepting the setup warning isn’t a BAA. ChatGPT shows a healthcare warning during setup. The same article states that accepting it doesn’t establish BAA coverage, and that an enabled plugin doesn’t mean every workflow is covered.
• You still own the decisions. The article also says clinicians remain responsible for checking the underlying record and making care decisions.

What it means for therapy notes

1. It helps you prepare, not write. Before a session you could ask for a summary of what has changed in the chart since the last visit. The note itself is still written in Epic, by you or by a documentation tool your organization has approved, such as Epic’s own AI charting, Chart with Art.
2. It’s built for health systems, not solo practices. Epic mostly runs in hospitals and large health systems, and the integration has to be switched on by the organization. A private-practice therapist with a personal ChatGPT account can’t connect anything to it, so for most solo and small-group therapists the answer in this guide doesn’t change.
3. Psychotherapy notes need their own check. HIPAA gives psychotherapy notes, the process notes a therapist keeps separate from the rest of the record, extra protection: with few exceptions, disclosing them needs the patient’s authorization. The Epic plugin reads the clinical notes a clinician can already see, so ask your compliance team how your organization stores psychotherapy notes in Epic, and whether its BAA and policies cover using them with ChatGPT.
4. Share the minimum necessary. Even in a BAA-covered workspace, the Epic plugin’s help article asks users to share only the patient information a task needs, which matches HIPAA’s minimum necessary standard above.

If your practice isn’t on Epic, the closest equivalent is an EHR with AI notes built in, where the note is drafted next to the chart and saved to it. That’s how ClinikEHR’s Clinical Note AI works, and ClinikEHR can also expose your practice’s own AI agents to ChatGPT through a dedicated connector: see how to connect an EHR’s AI agents to ChatGPT or Claude.

ChatGPT vs. Purpose-Built Clinical AI: A Critical Comparison (Updated 2026)

The difference between a public AI model and a HIPAA-compliant clinical AI tool is not the underlying technology—it's the entire security and privacy infrastructure built around it.

Ethical Use of AI in Clinical Documentation: A Framework

Beyond the law, our ethical codes demand a thoughtful approach to technology. The core principles of confidentiality, informed consent, and clinician accountability are non-negotiable.

• Confidentiality: Your primary ethical duty is to protect your client’s privacy. This means using only secure, HIPAA-compliant tools for any task involving PHI. There is no ethical gray area here.
• Informed Consent: While you may not need to get consent for every internal software you use, transparency is key. It's good practice to inform clients in your intake paperwork that you use secure, HIPAA-compliant software systems to manage their records, which may include AI-powered tools to assist with administrative tasks.
• Clinician Accountability: An AI is a tool, not a colleague. You, the clinician, are 100% responsible for the accuracy and integrity of the final clinical note. The AI generates a draft; you provide the expert review, clinical nuance, and final signature. Never trust an AI-generated note blindly.

Examples of Ethical vs. Risky Use Cases

Risky & Unethical Use Case: A therapist in the UK records a session on their phone, uses a free online service to get a transcript, and pastes the entire transcript into ChatGPT with the prompt, “Turn this into a SOAP note.”

• Why it’s wrong: PHI was shared with two non-compliant vendors. No BAA is in place, violating both HIPAA (if serving US clients) and GDPR principles. The data may be stored indefinitely and used for training.

Safe & Ethical Use Case: A therapist in Australia uses the integrated ClinikEHR mobile app. After a session, they dictate a 60-second summary of their thoughts into the app.

• Why it’s right: The audio is processed within ClinikEHR’s secure, compliant environment. The data is encrypted, and a BAA (or equivalent data processing agreement) is in place. The AI generates a structured SOAP note draft, which the therapist then reviews, edits for nuance, and signs—all within the same secure platform.

Product Insight: ClinikEHR’s Commitment to Ethical AI

At ClinikEHR, we believe AI should empower clinicians, not endanger them. Our Clinical Note AI was built with a security-first mindset:

• HIPAA and Global Compliance: We provide a BAA and adhere to the highest standards of data protection, including GDPR, PIPEDA, and more.
• Zero-Knowledge Architecture: Your data is encrypted in a way that even we cannot access it.
• No Data for Training: We will never use your or your clients’ data to train our AI models.
• Integrated and Secure: By keeping the entire workflow within one platform, we eliminate the risks associated with copy-pasting between different applications.

Conclusion: The Landscape Has Changed -- But Caution Still Matters

The launch of ChatGPT for Clinicians in 2026 marks a genuine shift. For the first time, a major consumer AI platform offers HIPAA-compliant infrastructure with BAA support, no model training on conversations, and physician-tested accuracy (99.6% safe rating across 6,924 test conversations). Verified US clinicians now have a legitimate, free option for AI-assisted documentation. And since September 2026, health systems on Epic can connect their records to ChatGPT for Healthcare, read-only.

However, the core principles remain unchanged: (1) The free/Plus version of ChatGPT is still not safe for PHI. (2) ChatGPT for Clinicians is US-only for now. (3) It is not an EHR -- it generates text but does not integrate with scheduling, billing, or patient records. (4) Clinician accountability is non-negotiable -- AI generates drafts, you provide expert review. (5) The Epic integration is for organizations on ChatGPT for Healthcare or HIPAA-enabled Enterprise, and it reads the chart without writing to it. (6) For integrated practice management, purpose-built solutions like ClinikEHR that combine AI notes with scheduling, billing, telehealth, and patient records remain the most practical choice.

Frequently Asked Questions (FAQs)

1. Is it ever okay to use ChatGPT for non-PHI tasks in my practice? Yes. Using ChatGPT for brainstorming blog post ideas, drafting marketing copy, or creating generic client handouts is generally acceptable, as long as no PHI is entered.

2. What are the specific penalties for a HIPAA violation involving AI? Penalties can range from thousands to millions of dollars, depending on the level of negligence. It can also lead to corrective action plans, loss of licensure, and civil lawsuits.

3. Does using a VPN make it safe to use ChatGPT with PHI? No. A VPN encrypts your internet connection but does nothing to change the fact that the service you are sending PHI to (ChatGPT) is not HIPAA-compliant and will not sign a BAA.

4. Can I de-identify notes before pasting them into ChatGPT? While theoretically possible, true de-identification is extremely difficult and prone to error. A client's story, location, or unique circumstances can be identifying. It is not a recommended or reliable workflow.

5. How do I know if an AI tool is truly HIPAA-compliant? Ask them directly: "Will you sign a Business Associate Agreement (BAA)?" If the answer is no, or they don't know what that is, the tool is not compliant and should not be used with PHI.

6. What about ChatGPT Plus, ChatGPT Enterprise, or ChatGPT for Clinicians? ChatGPT Plus ($20/month) still does not sign BAAs for individual users. ChatGPT Enterprise may offer BAAs for organizations. The newest option, ChatGPT for Clinicians (launched 2026), is free for verified US physicians, NPs, PAs, and pharmacists, and offers optional HIPAA support via BAA for eligible accounts. Conversations are not used for training, and physician advisors rated 99.6% of responses as safe. However, it is a standalone chat tool — not an integrated EHR — and is currently US-only. For clinicians outside the US, or those needing integrated scheduling, billing, and patient records alongside AI notes, purpose-built solutions like ClinikEHR remain the better choice. Source: OpenAI blog, "Making ChatGPT better for clinicians"

7. Is ChatGPT integrated with Epic EHR? Yes, for approved organizations. On September 1, 2026, OpenAI announced an Epic integration for ChatGPT for Healthcare and HIPAA-enabled ChatGPT Enterprise workspaces. Each clinician signs in with their own Epic account and can review the notes, medications, conditions, encounters and lab results they’re already allowed to see. It isn’t available on individual ChatGPT accounts, including ChatGPT for Clinicians.

8. Can ChatGPT write therapy notes directly into Epic? No. OpenAI says the Epic connection is currently read-only: it can’t update records, place orders or message patients. You can use it to review the chart before a session, but the note is still written and signed in Epic.

9. Can I use AI to help with non-clinical tasks like scheduling or billing? Yes, as long as the AI tool is HIPAA-compliant and has a BAA. For tasks involving PHI (like appointment reminders with patient names), you must use compliant tools.

10. What should I do if I've already used ChatGPT with PHI? Stop immediately. Document the breach, notify your compliance officer or supervisor, and follow your organization's breach notification procedures. You may need to notify affected clients and regulatory authorities depending on the extent of the breach.

Disclaimer: This article is for informational purposes only and does not constitute legal, medical, or compliance advice. HIPAA regulations, AI tool capabilities, and vendor compliance status change frequently. Always verify the current compliance status of any AI tool directly with the vendor before using it with Protected Health Information (PHI). Consult with a healthcare compliance attorney or your organization's compliance officer for guidance specific to your practice. Information about ChatGPT for Clinicians is based on OpenAI's announcement, and information about the Epic integration on the September 2026 announcement and help center article linked above; both may have changed since this article was last updated. ClinikEHR and its authors shall not be held liable for any decisions made based on the information provided herein.

Related Reading on ClinikEHR

State of 2026 reports:

• State of Agentic AI EHR 2026: What Works and What's Risky
• State of Behavioral Health Practice 2026: Demand, Pay and Rules

AI & Clinical Documentation:

• AI Revolution in Clinical Notes
• AI Clinical Notes for Therapists
• Top 5 AI Clinical Notes
• Free AI Clinical Notes Generator
• How to Get Started with AI Clinical Notes
• Best AI Note Taking for Psychiatry 2026
• Best AI Tools for Human-Sounding Notes 2026
• Can You Connect an EHR’s AI Agents to ChatGPT or Claude?

Compliance & Ethics:

• HIPAA Compliance in Shared Office Spaces 2026
• Can You Use Google Workspace as an EHR?
• HIPAA Compliance for Developers

Practice Management:

• 15 Best Clinical Notes Software 2026
• Best EHR for Therapists and Counselors 2027
• Reduce Documentation Time Without Cutting Corners 2026