An AI tool is only safe for client notes if the company will sign a Business Associate Agreement (BAA) with you, for the plan you're actually on. Free and personal accounts usually won't. No BAA? You can still use AI, just never with protected health information. Strip the identifiers first, or use it for work that has none.

That's the whole answer. The rest of this post is how to check it in five minutes, so you can stop worrying and start getting your evenings back.

This is educational, not legal advice. Check your own state rules and payer contracts.

The one question that settles it: will they sign a BAA?

A BAA is a contract. The company agrees to protect client information the way HIPAA requires, and it takes on responsibility if something goes wrong.

No BAA, no client information. Full stop.

Here's the catch most people miss: it's per plan. The same company can say yes on a business plan and no on the free one. Check the plan you're on, not the brand name.

What counts as PHI in an SLP note (it's more than the name)

Most of us know to remove the name. HIPAA's list is longer. It includes birthdates, addresses, dates of service, photos, voice recordings, and anything else that points to one specific person.

SLP notes have their own traps:

"The only bilingual 4-year-old in Ms. Rivera's class"
A rare diagnosis plus a neighborhood
A school name plus a grade
A voice recording of a session

None of those have a name in them. All of them can identify a child.

Three safe ways to use AI right now

1. A BAA tool for real notes. A documentation tool or AI platform that signs a BAA on your plan. This is the one for actual client notes.

2. De-identified drafting. Write "Client, age 4, goal: /s/ blends, 14/20 with minimal cues" and let AI build the structure. Add identifying details back in your EHR afterward.

3. No-PHI work. Parent handouts, home practice ideas, session plan templates, email drafts. Most SLPs should start here. It's the biggest time savings with the least risk.

A 5-question checklist before you pick a tool

Will you sign a BAA on my plan?
Is my data used to train your model?
How long do you keep recordings and transcripts?
Can I delete everything, and how?
Does it work with my EHR, or will I be copy-pasting?

If they hesitate on question one, you have your answer.

What I do in my own practice

[JOCELYN: add 3 to 5 sentences on your real workflow here. Which kinds of tasks you run through AI, which you never do, and how you handle notes. Keep it to workflow, no client details. This is the section only you can write, and it's the one readers will remember.]

FAQ

Is ChatGPT HIPAA compliant for speech therapy? A personal ChatGPT account doesn't come with a BAA, so don't put client information in it. Business plans may offer BAA terms, so check the vendor's current documentation for the exact plan.

Is there a free HIPAA-compliant AI for therapists? Rarely. Free tiers usually skip the BAA. Free is fine for no-PHI work like handouts and templates.

Can I use AI if I remove the client's name? A name is only one of the 18 identifier types HIPAA lists. Remove all of them, or use a tool with a BAA.

What do SLPs on Reddit recommend? The same themes keep coming up: ask about the BAA first, and prefer tools that connect to your EHR over copy-pasting. Brand names change fast, so use the checklist above instead of anyone's top-5 list.

You don't have to figure this out alone

Every month inside AI Happy Hour, we test tools live so you know what's safe before you try it. It's $37 a month. Peace of mind included, evenings back.

Join AI Happy Hour