Therapy notes AI that has your draft written before the next client sits down

Why there is no vendor agreement to sign, and where that stops being true

HHS answers the first half of this directly in HIPAA FAQ 256: "The mere selling or providing of software to a covered entity does not give rise to a business associate relationship if the vendor does not have access to the protected health information of the covered entity." When the recording and the transcription both happen on your Mac, that is the situation you are in, and there is nothing to sign because no vendor holds the session.

The same FAQ names two things that do create that relationship, and they belong in the same breath as the sentence above. Hosting the data on the vendor's server creates it, and so does the vendor accessing the data while troubleshooting. Those two triggers are the right questions to put to any documentation tool, including this one, and the honest answer here is that the boundary is one you can move yourself. If you switch on Pro's hosted AI models or fast cross-session chat, transcript text is sent to that model provider and the paragraph above stops describing what is happening. The audio still never leaves the Mac, but transcript text is the content of a therapy session, so treat that switch as a clinical decision rather than a settings toggle. In local mode nothing is sent at all.

We make no compliance claims and cannot make one for you, because compliance turns on your practice, your policies and what you do with these files. What we can describe is the architecture. The tools you are comparing us against will sign an agreement with you; we do not offer one, because we are not receiving the data that would call for it. That is a real difference in what you are buying, and not automatically the better side of it. If your policy is that every piece of clinical software must produce a signed agreement, that is a legitimate requirement and this is not the product for you.

Two other rules shape how it fits a practice. If your practice is a HIPAA covered entity, 45 CFR 164.508(a)(2) treats psychotherapy notes as a separate category needing specific authorisation for most uses and disclosures. That only applies to material meeting the narrower definition at 45 CFR 164.501, and keeping a file apart from the rest of the record is necessary for it to qualify rather than sufficient on its own: a raw transcript or a machine summary is not automatically a psychotherapy note. Because Ghosty Notes writes markdown into a folder you nominate rather than into a records system, where a note sits is your decision, and neither the separation nor the status is something the software creates or guarantees for you. APA Ethics Code 4.03 is plain about the recording itself: "Before recording the voices or images of individuals to whom they provide services, psychologists obtain permission from all such persons or their legal representatives." That rule is written for psychologists, so if you are licensed under a different professional code, check your own code and your state law. A note-taker nobody can see does not soften the duty. If anything it sharpens it, because the client has no visual cue to prompt the question.

HHS HIPAA FAQ 256

Selling or providing software does not by itself create a business associate relationship where the vendor has no access to protected health information; hosting the data on the vendor server, or accessing it during troubleshooting, does.

45 CFR 164.508(a)(2)

In a HIPAA covered practice, psychotherapy notes require a separate, specific authorisation for most uses and disclosures. It applies only to material meeting the narrower definition of psychotherapy notes at 45 CFR 164.501, so a transcript or summary does not qualify by being filed separately.

APA Ethics Code 4.03

Psychologists obtain permission from the person or their legal representative before recording their voice or image. Other clinicians are bound by their own professional code and by state law.