1. Please listen to the episode carefully before you take the quiz and do the course evaluation.

    2. Quiz: Is Your Client Data Safe with AI? What Therapists Need to Know About HIPAA, BAAs, and Session Transcripts

    3. Evaluation: "Is Your Client Data Safe with AI? What Therapists Need to Know About HIPAA, BAAs, and Session Transcripts" Curt Widhalm, LMFT, Katie Vernoy, LMFT, and Ali Hartley, JD
  • Free

Course Description

If you use an AI scribe in your practice, or you are weighing whether to add one, you probably wondered where your session content actually goes. Does a business associate agreement cover everything? What happens to a transcript after the note is written? And is anyone using your clients' words to build something you never agreed to?

In this law and ethics podcourse, Curt Widhalm, LMFT, and Katie Vernoy, LMFT, talk with Ali Hartley, Chief Legal Officer at SimplePractice, about how HIPAA’s Privacy, Security, and Breach Notification Rules apply to the AI tools therapists are adopting. Ali maps the points in an AI documentation workflow where protected health information is most vulnerable, explains what a BAA does and does not guarantee, and compares HIPAA’s two de-identification methods alongside data decoupling.

The conversation also separates training a large language model from refining the prompts that guide a product, compares native EHR integrations with browser extensions and copy-and-paste workflows, and closes with a practical framework for vetting any vendor that touches client data. You will leave with clear questions to ask your vendors, a sense of your own responsibilities as the covered entity, and a view of the emerging risks to watch as AI becomes part of everyday practice.

Course Details

Format: Home study podcourse (audio podcast episode), followed by a post-test and course evaluation

Episode length: Approximately 70 minutes

CE hours: 1.0

Content area: Law and Ethics

Instructional level: Intermediate

Target audience: Licensed and prelicensed mental health clinicians in private practice, group practice, and agency settings (including LMFTs, LPCCs, LCSWs, LEPs, and professional counselors), as well as clinical supervisors and practice owners who select, approve, or oversee EHR and AI documentation tools

Presenters: Curt Widhalm, LMFT; Katie Vernoy, LMFT; Ali Hartley,JD, Chief Legal Officer, SimplePractice

Provider: Therapy Reimagined, via the Modern Therapist Learning Community (moderntherapistcommunity.com)

Partnership Disclosure

This course was produced as part of Therapy Reimagined’s partnership with SimplePractice. Ali Hartley is SimplePractice’s Chief Legal Officer, and portions of the course describe SimplePractice’s own data handling practices as a case example. Curt Widhalm and Katie Vernoy are SimplePractice customers. The learning objectives and post-test were developed by Therapy Reimagined, and the vetting principles taught in this course apply to any vendor that handles client data.

Continuing Education Objectives

After completing this course, participants will be able to:

  1. Differentiate among three data handling safeguards relevant to HIPAA compliance: business associate agreements (BAAs), Safe Harbor de-identification, and data decoupling protocols.

  2. Evaluate security vulnerabilities and data pathways across three AI documentation workflows: native EHR integration, browser extensions and overlays, and manual copy-and-paste.

  3. Formulate a clinician-centered vetting framework to audit third-party software and AI tools used in clinical practice.

Instructors

Curt Widhalm

LMFT

Curt Widhalm is in private practice in the Los Angeles area. He is a member of the California Association of Marriage and Family Therapists (CAMFT) ethics committee, an Adjunct Professor at Pepperdine University, lecturer in Counseling Laws and Ethics at California State University Northridge, a former Law & Ethics Subject Matter Expert for the California Board of Behavioral Sciences, and former CFO of CAMFT. Learn more at: www.curtwidhalm.com

Katie Vernoy

LMFT

Katie Vernoy is a Licensed Marriage and Family Therapist, with a Master’s degree in Clinical Psychology from California State University, Fullerton and a Bachelor’s Degree in Psychology and Theater from Occidental College in Los Angeles, California. Katie’s experience spans many leadership and management roles in the mental health field since getting her license in 2005: program coordinator, director, clinical supervisor, hiring manager, recruiter, and former President of the California Association of Marriage and Family Therapists. Learn more at: www.katievernoy.com

Ali Hartley, JD

Chief Legal Officer, SimplePractice

Ali Hartley, JD, is the Chief Legal Officer at SimplePractice and an accomplished general counsel and healthcare attorney with nearly two decades of experience in corporate law, regulatory compliance, and people leadership. She helps SimplePractice remove administrative burdens for clinicians while enabling responsible innovation and protecting sensitive healthcare data.

Timed Course Outline

Times are approximate and based on the episode transcript.

Time

Minutes

Content

0:00 – 4:05

4

Introduction, CE information, and learning objectives

4:05 – 7:08

3

Guest introduction and partnership disclosure

7:08 – 10:34

3.5

HIPAA foundations: the Privacy, Security, and Breach Notification Rules; what compliance requires of a solo or small group practice (risk assessment, written policies, encryption at rest and in transit, audit logs, incident planning, annual review)

10:34 – 17:58

7.5

How HIPAA applies to AI: technology-neutral law; four vulnerability points in an AI scribe workflow (capture, transcription, note generation, retention); what a BAA covers and why it is necessary but not sufficient

17:58 – 20:03

2

Native EHR integration versus browser extensions and overlays: page access, third-party tracking, and automatic updates

20:03 – 24:16

4

Vetting vendors: published BAAs, subprocessor commitments, breach history, and transparency as a signal

24:16 – 29:43

5.5

HIPAA de-identification: Safe Harbor (18 identifiers) versus Expert Determination; concerns about re-identification

29:43 – 36:55

7

Training a base large language model versus evaluating and refining prompts; walled-off model instances and zero data retention policies

36:55 – 42:38

5.5

Case example of transcript handling at SimplePractice: audio deletion, transcript retention, decoupling and subpoena implications, opt-out at the global, client, and session levels, and who reviews de-identified transcripts

42:38 – 45:30

3

Comparing three workflow architectures, including copy-and-paste risks: clipboard access, unencrypted transit, and no audit trail

45:30 – 51:41

6

Best practices for multi-tool workflows: a BAA with every vendor, mapping data flow end to end, the minimum necessary standard, encryption, and identifying the underlying model

51:41 – 56:09

4.5

A clinician vetting checklist: the BAA as a compliance floor, independent security certifications, breach history, transparency, clinical alignment, clinician oversight, and onshore data storage

56:09 – 1:02:40

6.5

Emerging risks: vendor sprawl, free tools without BAAs, the shifting federal and state regulatory landscape, liability for AI-generated notes, and overreliance on AI output

1:02:40 – 1:10:00

7.5

Ethical considerations and informed consent with clients about AI use; closing reflections, contact information, and CE instructions

Total: approximately 70 minutes (1.0 CE hour)

Your learning starts here

Sign Up Now

Continuing Education Information

CAMFT CEPA

Therapy Reimagined is approved by the California Association of Marriage and Family Therapists to sponsor continuing education for LMFTs, LPCCs, LCSWs, and LEPs (CAMFT CEPA provider #132270). Therapy Reimagined maintains responsibility for this program and its content. Courses meet the qualifications for the listed hours of continuing education credit for LMFTs, LCSWs, LPCCs, and/or LEPs as required by the California Board of Behavioral Sciences. We are working on additional provider approvals, but solely are able to provide CAMFT CEs at this time. Please check with your licensing body to ensure that they will accept this as an equivalent.

Course meets the qualifications for 1 hours of continuing education credit for LMFTs, LCSWs, LPCCs, and/or LEPs as required by the California Board of Behavioral Sciences.