117. Your Therapist Can’t Be Subpoenaed, But ChatGPT Can

By /

Your Therapist Can’t Be Subpoenaed, But ChatGPT Can

A headline stopped me mid-coffee this week: your therapist can’t be subpoenaed, but ChatGPT can. Of course, therapists can be subpoenaed too, so it’s really just a catchy headline. But it got me thinking, because I know how many of you are still dictating notes into ChatGPT between clients, venting about a tough case, or asking it for a new intervention idea. You tell me about it constantly, in coaching calls and emails.

In this episode of Run Your Private Practice with AI, I get into why that headline is pointing at something real, the other AI privacy stories that landed in my inbox this same week, and the specific settings and tools I actually use to keep client information off anything that could ever be subpoenaed.

AI Tips You Don’t Want to Miss:

  • Why what you type into a regular consumer AI doesn’t get the same protection your own head or your locked EHR does.
  • What it actually takes to verify and turn on the free HIPAA-compliant version of ChatGPT built for clinicians.
  • How to block specific websites from an AI agent like Claude Cowork so it can never reach your EHR.
  • The hidden risk of ambient AI notetakers like Granola sitting in on a session without the other person even knowing.
  • A five-minute gut check to run on your own AI chat history before you assume none of this applies to you.

Mentioned in this episode:
Berries Academy: https://heyberries.com/academy

Connect with me:

Sponsored by Alma: www.helloalma.com/kym
Sponsored by Berries:www.heyberries.com/therapists
Sponsored by Auralink Pro: Start your free trial and use code KYMTOLSON for 20% off www.auralink.com/pro

Transcript:

[00:00:00] Hey, everybody. Welcome back to another episode of Run Your Private Practice with AI. So I have this whole system where I get these Google alerts sent to my inbox every morning on AI stuff, therapy stuff. I’ve got, like, insurance billing alerts ’cause I, you know, run a membership called Bill Like A Boss for therapists to learn how to bill insurance.

[00:00:20] So I get all these alerts, and if you go to google.com/alerts, you can set them up too. They’re really helpful for automating workflows. In fact, in the TheraAI hub next week, I’m gonna show them how to set up Google alerts and have it automate where it pulls the Google alerts and then creates a newsletter for them based on one of the skills I made for the members in the TheraAI hub.

[00:00:43] But anyway, I get these alerts and, I go through them in the mornings usually while I’m drinking coffee before I start working that day. And this morning, there was one that really caught my attention.

[00:00:54] It was” your therapist can’t be subpoenaed, but ChatGPT can.” Now, first of all, we know we can be subpoenaed, of course, so this is just a catchy headline. But it did catch my attention. It got me thinking, because I know how many of you all are still just using ChatGPT for your notes. I know this because you tell me in coaching sessions you send me emails, that sort of thing.

[00:01:16] So it’s taboo, right? You’re not supposed to do it. Everybody knows that. At this point, I think everybody knows that it’s not HIPAA compliant, all that good stuff. But therapists are doing it. They’re de-identifying, or they think they’re de-identifying the information enough that it doesn’t matter.

[00:01:31] they’re, you know, dictating their sessions in through the voice-activated thing on ChatGPT, like de-identified and saying, “Turn this into a progress note for me,” or, ” Make it into a treatment plan,” something like that. Or you’re venting, right? I mean, lot of people are using AI to vent about problems.

[00:01:48] They’re having mental health problems. We know that. But anyway, you’re venting about maybe, like, a hard client that you had, or maybe you’re like, “God, this client, I don’t know. I’ve tried this, this, this, and this, and I just need some new ideas. I can’t think of what to, what to do to help them at this point. What do I do?” That is happening every single day by therapists, believe it or not, and I get it.

[00:02:11] It’s fast, right? You can, like, dictate to ChatGPT while you’re out for a walk between clients or something. If you get a cancellation, you can just do it real quick. It’s right there, and it does help. But the headline this morning that I read is really pointing to something real, and I wanna talk about it a little bit with you guys just to sort of bring awareness, but also get your thoughts.

[00:02:32] If you’re listening, hit me back. I love to, to get your emails. I get a ton of emails about these podcasts or these AI episodes that I really enjoy responding back to you guys. So, you can always hit me up at info@kimtolson.com. Anyway, I don’t think enough people are talking about it in our world that really therapists are using non-HIPAA compliant AIs to help them with their clinical work.

[00:02:54] It’s just a thing, right?

[00:02:56] So we know this, but the thing that makes therapy different, right, is that what your client says in the room is privileged, right? I mean, we write down notes, they can be subpoenaed, but our brains can’t be, right? Like, all the information that we’re, like, keeping in there about our clients that we never write down, there’s laws around it.

[00:03:15] It’s protected. We have to make sure we don’t tell people about our clients and what we’re working on with our clients and all that stuff

[00:03:20] But think about what happens when you take that same session, like out of your head and just like vomit it into ChatGPT or something just to get help or feedback, or just type it into a regular consumer chatbot anywhere, right? ChatGPT, Claude Perplexity. I mean, my Perplexity is HIPAA compliant, but most people don’t have that tier.

[00:03:41] Manus, you know, all of that, that’s not HIPAA compliant

[00:03:44] And it’s not sitting, like, protected inside of our client files anymore, like our locked EHR files, right? It’s sitting on a company’s server somewhere, and that company can be ordered by a court to hand over records. I don’t know what situation would happen that somebody would, you know, ask for your ChatGPT records, but you literally just never know, right?

[00:04:08] Now your notes app, if you’re using an AI notes app like Berries, that’s what I use of course. If you’re using something like that, that’s built for healthcare. It has like a whole legal wall around it and a general chatbot or just one of these large language model bots doesn’t have that same protection around it.

[00:04:27] And I’m saying this, some of you are probably like, “Yeah, duh, we know.” But actually there are a lot of therapists that don’t even know that. They, they think it’s fine to put stuff in there, which kind of blows my mind every time I hear it, but it’s true.

[00:04:39] So anyway, that was the gap that the article is really pointing at, right? That your ChatGPT can be subpoenaed. Okay? So keeping that in mind, we have to be more careful about this stuff. It’s not just the courtroom stuff either. Let me pile on a few other things that have shown up in my alerts in my inbox just this week, because it’s kind of wild how much of this is like converging at once in my little AI world that I’ve set up with all these Google alerts

[00:05:04] There was this piece about ChatGPT now can connect to iMessage, which pretty cool, right? You can just go into your iMessage and talk to ChatGPT that way if you want to But also think about like where your data is flowing when you’re doing that, right? Like who knows, right? I don’t know. Who knows?

[00:05:22] iMessage, is Apple getting it? Who knows where that information’s going? But anything we put in there is eligible to be seen, read, you know, looked at by who, who knows? Who knows who could see it, right?

[00:05:34] Then there was another one about like the hidden liability of ambient AI, which is like those tools that listen to your session in the background and write like, like meeting notes for you, right? So like on my computer, I do have a tool called Granola. It’s not the HIPAA-compliant version of Granola, but it is something that you can turn on, and it’ll literally record all of my meetings, but you can’t see it in the room, right?

[00:06:01] So like I do have Fathom, I use Fathom, but I’ve been trying out Granola lately because Fathom malfunctions sometimes. It doesn’t come to the meeting like I want it to sometimes, so I’m like, “You know what? I ne- I need a better solution.” So Granola, you turn that on, it records the whole meeting, and the other person doesn’t even know that there is an ambient AI listening, taking notes, like keeping track of everything that’s going on in the meeting.

[00:06:23] In Granola, you can even like talk to it in real time if you want to in these meetings, and people don’t even know that that’s going on. So that was another thing that’s kinda coming in with this, and if your ambient Granola app is listening to a Zoom session with a client or you know, who knows what?

[00:06:39] I mean, who knows what all of this stuff is doing in the background and who’s listening and who can really access it in the long run?

[00:06:46] So it’s like a whole new category of like, wait, where did that recording even go? Who has access to it? I don’t read like the fine terms and conditions of all the AIs that I use. I just don’t. I don’t put PHI in there, but I know a lot of people do

[00:07:03] And then this is also converging with this other thing that’s happening right now. It’s like a bigger fight happening in the US where the government is backing OpenAI in a copyright case, which tells you that the ground under all of this is really still moving. Like, we don’t know where this is gonna land.

[00:07:19] Nobody’s really settled on who owns what you put into ChatGPT or Claude or whatever, right? I mean, that’s an active government lawsuit that’s happening right now around copyright issues with AI. So these are all things you just have to really consider. So I guess I’m preaching to the choir, but I, I just…

[00:07:37] I’m floored every week by somebody that says, “Well, I just put it into ChatGPT,” or, “I just talked to ChatGPT about it.” We have to be more mindful of this stuff, I guess is my, my ultimate point with it.

[00:07:47] So anyway, that’s a lot. That’s heavy. That’s a lot to think about. Just be careful, I guess is what I’m saying. But let me bring it back down to what you can actually do this week about this stuff. So on our last Clinical AI Club Thera AI Hub call, I’m still calling it Clinical AI Club. I’m merging the two.

[00:08:04] You guys have probably heard me talk about this on the podcast. The two are being merged into the Thera AI Hub. But anyway, this came up, and I walk everybody through the settings I actually use to help protect me a little bit. We were doing a Claude 101 walkthrough all together, setting up our brand brain.

[00:08:21] So, the members all have a project they can go to, and it already knows their brand and everything. So we set that up. So the settings, right? For first, if you’re using Claude, and I know a lot of you are moving to Claude from ChatGPT, if you go into your settings, there’s a spot where you can block certain websites from the AI that you’re using.

[00:08:43] So in the meeting, I walked everybody through, like, how to find that setting inside of Claude, go into it, and then it’s literally like you could put in URLs that you want to block Claude from ever being able to get ahold of or to access, especially if you’re using Claude Cowork that lives down in your browser.

[00:09:01] So that’s an important setting. And the other setting is there’s like, you could turn off, “Do not allow this AI to use my information to train their model.” You could turn that on in Claude also. Now, I don’t know. I mean, does it work? Who knows? But I’ve got that turned on, and you could block websites too.

[00:09:19] Now, I’m not going to any… I’m not going to my EHR or anything like that with my Claude or where I’m using Claude in my Chrome browser. But if you are doing that, that’s a next step you can do to just try to, like, protect yourself a little bit better or anywhere that you’ve got PHI. If it’s your Google, your Gmail, you know, you could block that if you wanted to just by entering those domains to protect yourself and your clients a little bit more

[00:09:46] Basically, like if I’m using the agent feature in Cowork or Code, it’s gonna be blocked from being able to even go like try to open my EHR

[00:09:55] Now the second one, I did a full episode on this two weeks ago. So if you go back in the episodes, I already talked about all the details of this, but there is a free HIPAA-compliant version of ChatGPT built for clinicians. You verify with your NPI number, you sign the BAA in the settings, and now you’ve gotten a version where you’re actually covered to put protected information in, supposedly, right?

[00:10:18] They say it’s HIPAA compliant and protected. Hopefully it is. If you’re gonna use ChatGPT for anything that touches a real client, that’s the lane you should be using. Use the HIPAA-compliant ChatGPT. And I’m sure Claude and the rest are gonna follow through with something like this down the road, but right now, ChatGPT is the only one that I know can do that.

[00:10:37] My Perplexity browser, I’ve got Perplexity. It’s, it’s like a Chrome browser, but it’s called Perplexity Comet, and it has different tiers that you can purchase. I have the HIPAA-compliant SOC 2 tier of that browser. So if I’m doing anything in an EHR or anything like that, I always use my Perplexity browser.

[00:10:58] If I’m using agents like Claude Cowork or something in Manus, I always use my Chrome browser, which is separate, and my EHR is never opened up in that Chrome browser. So that’s some precautions I take to kinda keep those two separate also

[00:11:11] And then the note-taking piece

[00:11:13] clinical notes, use something built for it with compliance already baked in. For me, that’s Berries. That’s heyberries.com. If you’re, if you didn’t know, I’m the clinical consultant for Berries, so that’s the one I recommend for everybody, and I’ve helped them build it from the ground up. It’s safe. It’s not VC-backed.

[00:11:32] We’re not using any information that clinicians put into the sessions to train the model, nothing like that, so it’s completely safe to use. So I would definitely recommend something like Berries if you’re gonna be doing notes or any kind of analysis on client-facing information

[00:11:49] And I mean, you guys know me, right? I run a full practice and business with 15 income streams, basically from the road, living in Airbnbs, my little travel setup. I’m all over the place. So I’m not saying this is somebody that’s, like, scared of using these tools. I use all of them every single day. I just got a little more careful about the door between me and them because I realized I’d even gotten comfortable, like, just popping into certain sites or a place where there might be PHI and not thinking about it.

[00:12:21] I– Or maybe I might, like, be in ChatGPT and not be thinking to say, “Hey, what’s a good intervention for somebody that’s struggling with their dog that just died?” I mean, that’s not PHI, but you just never know, right? I mean, what if something happened to that client and somehow my ChatGPT got subpoenaed, right?

[00:12:39] I mean, I don’t know if that would ever happen, but I’m just, like, being more mindful and careful of this stuff, and I wanted to pass it on to you guys too. Because even in the Clinical AI Club, one of the members w-was bringing up the topic of you know, if you’re using Cowork, that sort of thing, should you have a totally separate computer?

[00:12:56] A lot of people do that. They get those little Mac Minis that, like, sold out over the summer, but I think they’re back in stock now. But the Mac Minis, putting Claude Cowork on there, only opening up you know, a browser that doesn’t have access to any of your EHR stuff or, or the ability to even know that there’s stuff related to client information.

[00:13:17] So it’s, like, a totally safe way to do you know, to, to be able to use agents and not have to worry about PHI. That is a thing that people do all the time. And it also protects you from the AI taking over your computer and knowing everything about you too, if you’re worried about that sort of thing. So we were talking about that in the meeting as well

[00:13:35] So anyway, here’s the mindset I’ve kind of landed on with that, and you could take it or leave it, but I assume now that anything I type into a regular consumer AI could someday in some situation that I can’t predict be read by somebody who’s not me. Not because I think these companies are like evil and they’re gonna like monitor us or anything like that.

[00:13:55] I mean, maybe they are, who knows? Just because I know data exists and the things that exist can be subpoenaed, it could be breached, hacked, leaked, handed over to people. So I just keep the client’s stuff on the protected side of the wall, and I use the open tools for everything that isn’t a real person’s private information.

[00:14:17] Okay. Now, am I being a little paranoid? Maybe. I don’t know. What do you guys think? Part of me thinks most of us will never see the day where any of this even matters, and it’ll get all sorted out with better laws, clearer rules, and we’ll look back and go, “Remember when we used to worry about that so much?”

[00:14:33] That might be true. I hope that’s true. But part of me also looks at how fast this is moving and goes like, “I’m not gonna be that cautionary tale. I don’t wanna be that person that has the big HIPAA breach or accidentally releases a lot of client information

[00:14:49] I don’t wanna be that therapist in the article that’s going around Facebook two years from now, the one who typed a client’s whole history into a chatbot because it was, like, convenient. You know? I just don’t wanna be that person. So anyway the laws behind the technology right now are way behind. It can’t keep up.

[00:15:06] Legislation takes a long time to get through and process, get signed into law, and the rules are still being written, so I’ll be careful now and won’t be the test case, I guess, is what I’m saying.

[00:15:19] So anyway, here’s what I want you to do this week, just this one thing. Go to the AI that you use most and actually look at what’s in your history. Read a few of your past chats with fresh eyes after listening to this, and ask, “Is there anything in here that names a client, describes a session close enough that somebody could figure out who it was?”

[00:15:38] If yes, go clean it up. And then move that kind of work over to a protected setup like Berries or the HIPAA compliant ChatGPT, and at Berries, we actually have a free CE that I will put down in the comments under here. We have a free CE that you can go watch. It’s a four-part series that I recorded for Berries that talks about how to vet an AI vendor to make sure you’re being HIPAA compliant all the ethical considerations you need to think about, and just a ton of other really helpful information.

[00:16:11] And you get… It’s an ethics CE, so you can use that towards your CEs. It’s an NBCC CE. So I’ll put that down below. You can go check it out, get the CE, and you’ll feel more prepared. It’s along the lines of this episode that I just did for you guys. Okay. Go check your h- chat. Go check your chat history, and I’ll talk to you guys later.

[00:16:33] Bye-bye.