Work through the ten steps, tick each box, and fill in the blanks. When every box is checked, you are using AI the way it is meant to be used.
A Business Associate Agreement (BAA) is the contract that makes a vendor legally responsible for protecting your clients' data. No BAA means no PHI goes in. This applies to every link in the chain, your video platform, your transcription tool, and the AI itself.
List your tools and confirm the BAA for each:
| Tool | What it is used for | BAA signed? (date) |
|---|---|---|
Here is the part that trips everyone up: the popular plans cannot be made compliant. A BAA is only available on the enterprise and developer tiers. Below is exactly which plan carries a BAA, and how to sign it.
baa@openai.com with your company and use case. They typically reply within one or two business days, and review case by case."Just get Enterprise" is technically true and practically brutal: 20 seat minimums, sales calls, and enterprise procurement, all so you can write your progress notes. For most independent EMDR clinicians, standing up ChatGPT Enterprise or Claude Enterprise on your own is not realistic. So you have two paths that actually work:
Plans, pricing and BAA terms move fast in this space, so always confirm the current terms on the vendor's own compliance page before you sign.
This is the number one mistake. The moment identifiable client information lands in consumer ChatGPT, Claude, Gemini or Copilot, you have made an impermissible disclosure. Speed is never worth it.
A BAA covers legal responsibility, and you also want your clients' words kept out of the next model. Ask every AI vendor these four questions, and get the answers in writing:
Two separate consents: to record, and to use AI. Keep it separate from your general intake form, and make clear that the client can say no at any time without it affecting their care.
The four things every client must hear about a recording:
"I record our sessions so a secure AI tool can help me draft notes. I review and finalize every note myself. It is encrypted and private, and you can say no at any time, without it affecting your care."
If you ever use a tool without a BAA, the only thing that may go in is text with all 18 HIPAA Safe Harbor identifiers removed. Careful: free text notes hide identifiers, so automatic anonymization before the model sees the text is far safer than doing it by eye.
The golden rule, from Prof. Ad de Jongh: you stay the owner of the clinical process. AI never makes the clinical decision, never interacts therapeutically, and never finalizes the record unchecked. You do. Every output gets your five point pass:
Keep ePHI encrypted in transit and at rest, inside systems covered by a BAA, with real access controls. Review your security every year.
The good news: the new state AI laws require exactly what this workbook teaches, which is that a licensed human stays responsible for anything clinical. Admin use and note taking, with consent, are explicitly fine.
This is a fast moving patchwork across more than 30 states, so confirm your own state's current rules. Nothing here is legal advice.
If data is exposed, you must notify affected clients and HHS within 60 days, plus a media notice if 500 or more people are affected. Write down the plan now, while you are calm.
A written risk analysis is a HIPAA requirement, not a nicety. Do it once, then put a yearly reminder in your calendar. One more discipline: if clients use AI themselves, keep it to support and psychoeducation, never positioned as the therapist.
All boxes ticked? Then AI drafts, and you decide and sign. Keep the judgment, lose the paperwork.
Do all of this in one compliant workflow →No advice, no relationship. This workbook is general educational information published by Moovd B.V. and its WeMind product. It is not legal advice, not compliance advice, not regulatory advice, not medical or clinical advice, and not a professional opinion. It does not create a client relationship, an advisory relationship, a fiduciary relationship or a duty of care of any kind between you and Moovd B.V., WeMind, or any of their affiliates, officers, directors, employees, advisers, contributors or licensors, together referred to as the Providers.
No warranty. This workbook is provided "as is" and "as available", without warranty or representation of any kind, whether express, implied or statutory, including any warranty of accuracy, completeness, currency, merchantability, fitness for a particular purpose, non infringement, or conformity with HIPAA, the HITECH Act, state or federal law, professional licensing rules, payer requirements or any other legal or regulatory obligation. Laws, regulations and professional guidance on artificial intelligence in healthcare change frequently, vary by jurisdiction, and may have changed since publication. Vendor plans, pricing, feature exclusions and BAA terms change without notice. No part of this workbook is guaranteed to be accurate, complete or current at the moment you read it.
No rights, no binding effect, no reliance. No right, claim, entitlement, expectation or obligation may be derived from this workbook, from its use, or from any statement contained in it. Nothing in it is binding on the Providers. Completing this workbook, in whole or in part, does not make you, your practice, your workflow, your vendors or any tool compliant with any law or standard, and it may not be presented or relied upon as evidence of compliance, certification, accreditation, approval or due diligence before any regulator, auditor, court, licensing board, insurer, payer, employer or client. Any use of this workbook is at your own discretion and entirely at your own risk.
Your sole responsibility. You are solely and exclusively responsible for your own legal and regulatory compliance, for your clinical judgment and clinical decisions, for the security and lawful processing of client information, for obtaining valid consent, for your agreements with vendors, and for verifying every point in this workbook with qualified legal counsel licensed in your own jurisdiction, and with your own professional body and insurer, before acting.
Limitation of liability. To the fullest extent permitted by applicable law, the Providers accept no liability whatsoever, whether in contract, tort including negligence, statute or otherwise, for any loss or damage of any kind, whether direct, indirect, incidental, special, consequential, punitive or exemplary, including without limitation loss of profit, loss of revenue, loss of business, loss or corruption of data, regulatory investigation, fine, penalty or enforcement action, breach notification cost, disciplinary or malpractice claim, loss of licensure, or reputational harm, arising out of or in any way connected with this workbook, its contents, any omission from it, or any use of or reliance on it, even if the Providers have been advised of the possibility of such loss. Where liability cannot lawfully be excluded, the aggregate liability of the Providers is limited to the minimum amount permitted by applicable law.
Third parties and references. References to named products, vendors, statutes, agencies, professional bodies or individuals are illustrative only. They are not endorsements, are not warranted to be accurate, and imply no affiliation, sponsorship or approval. Named trademarks remain the property of their respective owners. The Providers are not responsible for the content, availability, terms or conduct of any third party site or service linked from this workbook.
Your entries stay on your device. Anything you type into the online version is stored in your own browser only. It is not transmitted to, collected by, or accessible to the Providers, and it is not a medical record. Do not enter client identifying information into this workbook.
Severability and governing law. If any provision of this disclaimer is held to be invalid or unenforceable, the remaining provisions stay in full force. This disclaimer is governed by the laws of the Netherlands, without prejudice to any mandatory protection available to you under the law of your own jurisdiction.
© 2026 Moovd B.V. All rights reserved. WeMind is a product of Moovd B.V., registered in the Netherlands. Reproduction or redistribution of this workbook, in whole or in part, without written permission is not permitted. The golden rule is referenced with attribution to Prof. Ad de Jongh, Ph.D., which does not imply his endorsement of this workbook or of any product.