Posted July 23, 2026

By Danielle Kelley, MSW, MSJ
| Mental Health Compliance Consultant | DLH Enterprises LLC

AI is rapidly transforming mental healthcare.

California clinicians - take note! Pause before immediately activating an AI notetaker during a psychotherapy session with a minor under 18.

Yes, this article applies to adults clients as well.

Imagine this scenario…

A California clinician provides psychotherapy to a 16-year-old adolescent (telehealth or in-person). The parents signed consent forms for treatment and telehealth services. During the session, the therapist activates an AI note-taking platform that listens to the conversation and generates word for word documentation.

There is only one problem.

The consent forms never mention AI.

Has the therapist created a HIPAA violation?

Probability is high.

More importantly, have they created a California privacy law violation?

Absolutely.

HIPAA Is Only the Starting Point

Many clinicians believe that if an AI platform is HIPAA compliant and a Business Associate Agreement (BAA) has been executed, no further consent is required. Wrong.

HIPAA establishes the minimum federal privacy standard.

Now, let's talk California laws on privacy protections.

Current California lawsuit to follow right now is Saucedo v SharpHealth Care. The lawsuit seeks damages and a court order blocking the use of the AI tool without proper written consent. It estimates that more than 100,000 Sharp patients may have been recorded during the rollout.

Using an AI platform to capture and transcribe psychotherapy conversations implicates several California legal frameworks, including:

• California Confidentiality of Medical Information Act (CMIA)
• California Invasion of Privacy Act (CIPA)
• California Penal Code §632
• California Constitution, Article I, Section 1 (Right to Privacy)
• California laws governing minors' consent to mental health treatment

Under CMIA (Cal. Civ. Code §56.10), providers should ensure that their intake disclosures and privacy notices clearly explain:

• That ambient or live AI transcription technology is used during treatment;
• The identity or nature of third-party vendors handling protected information; and
• Data retention practices, including how long audio recordings or raw transcripts are retained before deletion.
• Opt out option – without losing access to their therapist.

Inform Consent means providing your client with a form clearly detailing what is involved with the telehealth therapy session in regards to technology.

What About the 16-Year-Old?

This is where California law becomes especially significant.

Therapists should obtain the 16-year-old patient's assent—and where legally appropriate, consent—to the AI transcription process before the technology is activated.

And don't forget if the parents or legal guardian consented to treatment, the parent should provide signed informed consent regarding the therapist's use of AI documentation technology...before.

Fact not to be underestimated: California is an all-party consent state.

Under California Penal Code §632, part of the California Invasion of Privacy Act (CIPA), intentionally recording or electronically capturing a confidential communication without the consent of every participant may constitute both a criminal offense and a civil privacy violation.

A psychotherapy session—whether conducted in person or by telehealth—is the very definition of a confidential communication under Penal Code §632(c). Patients have a reasonable expectation that their conversations are private and limited to those participating in treatment.

Modern AI documentation systems- ie. Abridge- actively capture, process, and convert live conversations word for word into clinical documentation. Because these systems electronically process confidential communications word for word; therapists should obtain signed informed consent before activating AI transcription technology. And that form should clearly state that there is an opportunity to ...opt out.

Opt out means - an opportunity for the patient to decline AI transcription without jeopardizing access to treatment, since AI documentation is an administrative convenience rather than a clinical necessity.

Another Privacy Issue: Psychotherapy Notes

HIPAA distinguishes progress notes maintained in the electronic health record from psychotherapy notes protected under 45 C.F.R. §164.508(a)(2).

Yes, psychotherapy receives special protections under HIPAA because these notes are separated from the rest of the patient’s medical records (known as the EMR or EHR).

In contrast, complete AI-generated transcripts most likely will contain detailed clinical dialogue that goes well beyond traditional progress notes. So, we highly highly recommend your consent form explicitly address if the AI generated note platform is protected under HIPAA's special protections for psychotherapy notes…or not.

The Bottom Line

Artificial intelligence is reshaping mental healthcare.

But underestimate signed informed consent!

Before activating an AI documentation platform during psychotherapy—particularly when treating minors—clinicians should carefully evaluate whether they have satisfied their obligations under HIPAA, CMIA, California's all-party consent law, and professional ethical standards.

Now...the question is whether your consent forms are keeping pace with the technology.

About DLH Enterprises LLC

DLH Enterprises LLC - reducing regulatory risk through specialized consulting in HIPAA, California privacy law, AI governance, telehealth compliance, patient rights, and behavioral health risk management.

Yes, DLH will create privacy compliant forms.,, in addition to …

Our Weekly HIPAA Challenge™ delivers real-world compliance scenarios that strengthen staff decision-making before small mistakes become OCR investigations, licensing complaints, or litigation.

Visit: www.dlh-enterprises5150.com

Educational purposes only. This article does not constitute legal advice. Consult qualified legal counsel regarding compliance with applicable federal and California laws.