Yes, for phrasing, structure, and psychoeducational material. The constraint is what goes into the box rather than whether the tool is used at all. Professional codes require client information to stay confidential in any medium, and the clinical substance you usually want help with is separable from the person it belongs to.
Your existing obligations already cover this
Most of what governs this predates generative assistants and did not need updating to reach them. A confidentiality standard that says client information is not disclosed to third parties without a lawful basis already covers pasting a note into a website, because pasting into a website is a disclosure to whoever operates it. The technology is new. The obligation being tested is not.
The American Psychological Association's Standard 4.01 puts the obligation on information "obtained through or stored in any medium", which is the phrase that does the work here. The American Counseling Association's Standard B.1.c permits disclosure "only with appropriate consent or with sound legal or ethical justification". In Canada, the Canadian Psychological Association's Standard I.45 asks that confidential information be shared "only to the extent reasonably needed" and with informed consent.
Your own regulator is the one that binds you, and these three are not interchangeable. Read this page as a way to structure the question rather than as a statement of your rulebook.
Has any professional body addressed AI directly?
Several have, and the notable thing is how consistently they reaffirm the existing duty instead of writing a new one. The APA's ethical guidance for AI in professional practice tells psychologists to ensure any tool they select can be used in a way that complies with health-privacy regulation. The CPA's briefing paper on AI and psychology states that those using AI in practice "have a duty to obtain consent that is both voluntary and informed". In Ontario, the College of Registered Psychotherapists tells registrants they may use AI to create or summarize notes while remaining responsible for protecting privacy, obtaining consent, and reviewing outputs with their own judgement.
None of them prohibits the category. All of them keep the responsibility with you rather than transferring it to the tool.
What counts as identifying in a therapy note?
Formal identifier lists are a floor rather than a ceiling, and clinical notes are unusually good at re-identifying people through detail that no list names.
Direct identifiers are the easy part: name, date of birth, address, phone, email, health or insurance number, file number. The harder part identifies by combination: an employer, a job title in a small organization, a rare diagnosis, a court date, a town, a referral source, the name of a family member, the date of an incident that was in the local news. A note stripped of names can still describe exactly one person in a community of several thousand.
Two consequences follow. Taking the name out is not the same as making the note non-identifying. And the clinical substance you actually want help with, meaning presentation, intervention, response, and plan, is usually separable from all of it.
Which drafting tasks actually need the client's identity?
Almost none. Sorting the task first is what makes the privacy question tractable rather than agonizing.
| Task | Needs identifying detail? | Practical handling |
|---|---|---|
| Tightening language in a note you wrote | No | Replace identifiers before pasting; restore them in your record. |
| A treatment-plan skeleton for a presentation | No | Describe the presentation, not the person. |
| Psychoeducational material for a client | No | Write to the topic; personalize it yourself afterwards. |
| Summarizing a session from rough notes | Not once identifiers are removed | Cover the identifiers, paste, then restore locally. |
| A letter addressed to a named third party | At the final step only | Draft it covered; add identifying details in your own document. |
| Transcribing or summarizing session audio | Yes, inherently | Only with a vendor under an appropriate agreement. |
Does a signed agreement change the answer?
It changes which account may receive identifying material, and it is account-specific rather than product-specific. OpenAI publishes that only sales-managed ChatGPT Enterprise or Edu customers are eligible for a business associate agreement covering ChatGPT, and states plainly that it does not offer one for ChatGPT Business. The API platform and its healthcare-specific products are covered separately.
The practical reading: the plan you are personally signed in to is usually not the plan an agreement covers. Ask a vendor whether it will sign for the plan you are on, what happens to your input afterwards, whether the input trains a model, who the subprocessors are, and where processing happens. A vendor that cannot answer in writing has answered.
Does the client have to consent?
Consent and permissibility are different questions and they are easy to conflate. Consent can make a disclosure appropriate that would otherwise not be. It does not create an agreement with a vendor that has not signed one, and it does not relieve you of a minimum-necessary judgement about what you send.
There is a plain clinical dimension too. If a client would be surprised to learn their session material was typed into a commercial assistant, that surprise is itself information about whether the practice belongs in your informed-consent conversation.
What to do with the note in front of you
- Write the note the way you normally write it. The record you keep is the identified one.
- State what you want as a task rather than a document. Tightening a note into a structured format needs the content, not the person.
- Cover identifiers before the paste, including the combination-identifying detail above.
- Read what you are about to send as a stranger would, and ask whether the person is still recognizable.
- Paste, take the draft, and put identifying detail back in your own record rather than in the assistant.
- Note what you did, in whatever way you already document your process.
The step carrying the most weight is the fourth, and it is the one no software performs for you.
Where PHI Mask fits
PHI Mask does the covering step in one pass. Paste a note, a screenshot, or a PDF, and it marks the names, dates, and identifiers it finds so you can take a covered copy straight to the assistant. It works in your browser on text, screenshots, and PDFs, so the typed note and the exported report go through the same tool.
The map between real values and their stand-ins stays in that tab, which is what makes the round trip work: the draft that comes back restores to the real details in one step instead of being retyped. Detection results by document type are published openly on the benchmark.
Review before sharing.
Start with text, a PDF, or a screenshot.
Sources and review notes
Reviewed against the APA Ethical Principles of Psychologists and Code of Conduct, the ACA Code of Ethics, the Canadian Code of Ethics for Psychologists, published AI guidance from the APA and CPA, the College of Registered Psychotherapists of Ontario, and OpenAI's published agreement eligibility.
Common questions
- Can I paste a client's progress note into ChatGPT?
- Not while it still carries identifying information, unless your account is covered by a signed agreement with the vendor. Cover the identifiers first, or use an account that is covered.
- Is it acceptable to use an assistant for treatment plans and psychoeducation?
- Generally yes, because those tasks need the clinical topic rather than the client's identity. Write to the presentation, then personalize the result in your own record.
- Does covering identifiers make a note de-identified?
- Not by itself. The Safe Harbor method requires every listed identifier category to be gone and no actual knowledge that what remains could still identify the person. Expert determination is a separate formal route.
- Do I need an agreement with PHI Mask?
- A business associate agreement covers a vendor that creates, receives, maintains, or transmits protected health information for you. Your file stays in your browser, so there is nothing held to cover.
- Do I have to tell clients I use an assistant to help draft notes?
- That depends on your regulator's informed-consent standard. Canadian guidance treats consent for AI use as voluntary and informed, and where a requirement is unclear, disclosure is the more defensible choice.