Resources / AI Use Policy Guides / Healthcare & Life Sciences
AI Use Policy GuidesHealthcare & Life SciencesBehavioral Health Centers
AI Use Policy Guide for Behavioral Health Centers
What a behavioral health center’s AI use policy must cover, from HIPAA and 42 CFR Part 2 to state laws restricting AI in therapy.
Aligned withNIST AI RMF · GovernISO/IEC 42001 · AI policy
The short answer
A behavioral health center’s AI policy must protect some of the most sensitive data in health care and keep clinical judgment with licensed staff. It should limit AI tools that handle protected health information to vendors under a business associate agreement, treat substance use disorder records under 42 CFR Part 2, prohibit AI from providing therapy or making treatment decisions, and account for state laws such as Illinois’s WOPR Act, Nevada AB 406, and Utah HB 452.
What the policy must cover
| Policy section | What it should say |
|---|---|
| Scope | Covers all staff, contractors, and volunteers, and every AI tool, including AI features inside your EHR and phone systems. |
| Approved tools | Only approved tools may be used with client information, and any tool handling protected health information requires a business associate agreement. |
| Prohibited uses | AI may not provide therapy, make treatment decisions, or communicate clinical advice to clients without clinician review. Client information may never be entered into consumer chatbots. |
| Clinical documentation | AI note-taking and drafting tools may support clinicians, but a licensed clinician reviews and signs every note, and client consent is obtained where required. |
| Substance use disorder records | Records covered by 42 CFR Part 2 are identified and processed by AI only in ways your Part 2 consents and vendor agreements allow. |
| Client-facing AI | Any AI tool clients interact with is clearly disclosed as AI, and crisis language triggers immediate routing to a person. |
| Oversight | A named owner approves new AI tools, keeps an AI register, and reviews the policy at least annually. |
| Training and incidents | Staff are trained before using AI tools, and suspected misuse or data exposure is reported right away. |
State laws on AI in mental health care
| Law | What it does |
|---|---|
| Illinois Wellness and Oversight for Psychological Resources Act (2025) | Prohibits AI from providing therapy or making therapeutic decisions without licensed professional involvement. Licensed professionals may use AI for administrative and supplementary support, with limits. It applies to services provided to Illinois residents, wherever the provider is located. |
| Nevada AB 406 (2025) | Forbids AI systems from providing mental or behavioral health care or claiming they can. Providers may use AI for administrative functions, with independent review of the output. |
| Utah HB 452 (2025) | Requires mental health chatbots to clearly disclose that they are AI, and adds privacy protections and advertising limits. |
Federal requirements
HIPAA applies to every AI tool that creates, receives, or stores protected health information for your center. Those vendors need a business associate agreement, your security risk analysis should include them, and staff should share only the minimum necessary information.
Records from federally assisted substance use disorder programs carry added protections under 42 CFR Part 2. A 2024 rule aligned Part 2 more closely with HIPAA, with compliance required by February 16, 2026. Your policy should identify Part 2 records and restrict how AI tools use them.
Sample policy language
- “Staff may use only AI tools listed on the approved tools register. No client information may be entered into any tool not on the register.”
- “AI tools may assist with documentation and administrative tasks. They may not provide therapy, make treatment decisions, or communicate clinical recommendations to clients.”
- “Every AI-assisted clinical note must be reviewed, edited as needed, and signed by the treating clinician.”
Frequently asked questions
Can therapists use AI scribes or note-taking tools?
Generally yes, as administrative support, if the vendor signs a business associate agreement, the clinician reviews and signs every note, and you meet any state consent requirements. Illinois and Nevada both allow administrative uses while restricting AI in the therapy itself.
Can staff use ChatGPT or similar tools to write treatment plans?
Not with client information in a consumer version of the tool. Treatment decisions must stay with licensed clinicians, and any tool that receives client data must be approved and covered by a business associate agreement.
Do we need client consent to use AI?
It depends on the use and the state. Some state laws require consent for certain AI uses in therapy, and recording sessions for AI transcription typically needs consent. Your policy should spell out when consent is required.
More Guides for Behavioral Health Centers
Sources
- HIPAA Privacy and Security Rules, 45 CFR Parts 160 and 164
- Confidentiality of Substance Use Disorder Patient Records, 42 CFR Part 2, as amended by the 2024 final rule
- Illinois Wellness and Oversight for Psychological Resources Act, Public Act 104-0054
- Nevada AB 406 (2025)
- Utah HB 452 (2025)
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Use Policy Guide for Behavioral Health Centers. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-use-policy-guide-behavioral-health-centers
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
AI Acceptable Use Policy
A clear, written policy that tells your people which AI tools they can use, for what work, and with what data.
Team AI Workshop
A practical workshop that gets your team using AI productively and within your policies.
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.