What Therapists Get Wrong About HIPAA Compliance AI Tools
Most therapists using AI in their practice think they’ve got HIPAA compliance covered. HIPAA compliance AI tools are more complicated than most of us realize, and in 2026, the landscape has shifted enough that the old rules no longer cover what we’re actually doing.
In this episode of Run Your Private Practice with AI, I’m walking through the blind spots I keep seeing, from AI agents that can see your screen to browser extensions sitting in the same profile as your EHR. These are the exact questions that keep coming up in my mastermind calls, and they’re the reason I’m bringing in HIPAA compliance consultant Samantha Schalk for a free 90-minute webinar on May 5th so you can get real answers to the scenarios you’re actually dealing with.
AI Tips You Don’t Want to Miss:
- Why having a BAA doesn’t automatically cover every tool or feature that company offers.
- What actually counts as PHI and why removing a client’s name isn’t enough.
- How browser sidebar assistants create HIPAA exposure even when the base platform is compliant.
- Why AI agents on your computer may have access to more than you realize.
- How browser extensions can quietly access clinical content in your profile.
Mentioned in this episode:
Run Your Private Practice with AI FB Group: https://www.facebook.com/groups/aiprivatepractice
AI + HIPAA: Where Therapists Are Getting It Wrong. Free Webinar: https://kymtolson.kartra.com/page/AI-and-HIPAA
Samantha Schalk: https://www.guardianclinicalessentials.com/
Connect with me:
- Instagram: @thetravelingtherapist_kym
- Join the Clinical AI Club: www.clinicalaiclub.com
Sponsored by Alma: www.helloalma.com/kym
Sponsored by Berries:www.heyberries.com/therapists
Sponsored by Auralink Pro: Start your free trial and use code KYMTOLSON for 20% off www.auralink.com/pro
Transcript:
[00:00:00] Okay, welcome back to another episode of Run Your Private Practice with ai. If you’re using AI in your practice right now, and I know most of you are in at least some capacity, I need you to hear something that completely reframed how I think about HIPAA compliance with these tools that we’re using out there.
[00:00:17] A lot of you all in the clinical AI club that their AI hub, when we have the mastermind meetings, I always get the question, is it okay to use ChatGPT to write my progress notes? That sort of thing. You know, and I’ve talked about this ad nauseum on this podcast. Yes, you can kind of, but it has to be super de-identified and really generic.
[00:00:35] Of course, I would never actually recommend that, but that’s just scratching the surface these days. A lot of things have changed in 2026 with the AI landscape. We have a lot of new things, and if you listen to this podcast at all, you know, I’m obsessed with perplexity comment browser and computer, and I’m using like the computer versions, which are essentially like these agents that you can give multi-stage tasks to, to do things for you.
[00:01:02] I’m using them for everything, but this question starts to come in like, okay, if I’ve got a browser tab open with my EHR, like. Say, use simple practice or something. Simple practice is open in a screen, but then you are opening like Claude Cowork or something on your computer, which has access to your entire computer.
[00:01:20] Essentially it can see everything. Now, a lot of them do ask for permission to be able to see certain web tabs and that sort of thing, so you do have control that way, but it’s getting more and more fuzzy, like the boundaries with all these different things that we’re using. For example, Gemini has a HIPAA compliant workspace with A BAA, but they also have these agents and they’ve got Gemini Gems and they’ve got Gemini. You can chat with Gemini.
[00:01:48] Now when you’re in Google Workspace, a lot of those tools are accessible to you, but are they HIPAA compliant? So these are questions that really, I mean, my brain doesn’t work that way, that well. So nuanced and so in depth. I don’t always know the answer, so people ask me almost every time I have one of the masterminds inside of the club hub meetings that I have every month.
[00:02:10] Somoeone will ask, is it okay to use that? Is that HIPAA compliant? A lot of times I’m like, yes, I think so. But I’m also like, I am not a hundred percent sure because it changes every day and there’s, perplexity commet, I’ve got the enterprise pro level where the whole browser is HIPAA compliant and SOC two level compliant.
[00:02:27] And then somebody in the free group around your private practice with ai Facebook group asked the other day, like somehow they got an ad on their Facebook for perplexity saying, run your whole private practice with perplexity Comet, she bought it. You know, I haven’t even seen that ad. I never even thought to try to use it to run my entire private practice, but when you think about it in a lot of ways, you probably could because the whole entire browser is HIPAA compliant.
[00:02:52] Okay. Anyway, this is like HIPAA compliance type level stuff that I am just not really an expert at at all. So what I did, you guys know, I love to try to find experts to help us with this stuff. I ran across Samantha Shock. She has a website called Guardian Clinical Essential. So she’s a therapist, but she’s also like a HIPAA compliant consultant.
[00:03:18] I ran across her work. I was like, this is exactly what I need. Like I one need an expert to go to, to be able to say, is this HIPAA compliant? ’cause people are asking me and I really don’t know. After talking to her a little bit, I was like, you know what? I wanna do a webinar. At first I was. Is gonna do it for the clinical AI Club and the Thera AI hub.
[00:03:36] A lot of times inside of those memberships, I’ll bring in guest experts. When I can’t exactly answer a question about ai, I’ll bring in a guest expert over there, and I’m gonna do that on May 5th. I’m bringing her in. But I felt like it was way too important to just kind of keep it to the membership. So I’m gonna invite everyone to come to this as a free webinar.
[00:03:55] Samantha’s agreed. She’s like, great, let’s just offer it for free. She’s gonna come for 90 minutes and she’s going to talk to us about all of these little nuances of what’s coming up now in 2026 with ai. So it’s not as simple as it was before. Like just don’t put any PHI to ChatGPT, you’re good. It’s way more advanced than that now.
[00:04:16] So Samantha’s gonna come in, she’s gonna do a presentation, which I’m really excited about, and then she’s going to take your questions essentially. So if you’ve got one of these questions, like really specific like I’m using. Google Workspace, but I’m also using ChatGPT or I’m using the agents inside of Google Workspace and I wanna be able to like talk to these agents here, but I also wanna take it outside and talk to the agents somewhere else.
[00:04:41] Are you breaching confidentiality? Are you exposing yourself to a HIPAA breach by doing that? I honestly don’t know the answer to that and that’s why I brought Samantha in. So I am really excited to have her. She’s gonna talk about a lot of that. These are some of the main things that come up really with the questions I’m getting.
[00:04:57] It’s like I have a B, a, A with this company, so I’m totally covered. And that’s not actually how it works. Like Anthropic Claude does have a BAA for their like enterprise level, but not for their entry level. And a lot of people will say, well, I think it’s HIPAA compliant. I’m pretty sure I read that somewhere.
[00:05:14] And they’re using it. They’re putting their information in there, their client’s information. They’re getting like way too detailed with the information that they’re putting in, thinking they’ve got a BAA or they’re protected and they’re not. So that’s one question that comes up all the time. Another one I hear all the time is I don’t put client’s names in, so it’s fine.
[00:05:30] Samantha’s gonna talk about that some. PHI is way broader than names calendar event that says session with JS trauma follow up or something like that is still not okay if you’re using a Google workspace calendar, but it connects to your public Google calendar and then you know that’s exposed on just like a regular Chrome browser.
[00:05:50] Something like that. Like those are like three layers that might be violating HIPAA that you might not even be thinking about. So she’s gonna talk about that sort of thing in the presentation. Another example, right? A lot of the browsers now, like Claude Gemini, they’ve all got these sidebar browser assistance now that you can kind of open up, they can see your computer screen and you can like interact with it and it’s like interacting with your screen.
[00:06:14] Is that HIPAA compliant? No, it’s not. But a lot of people are using that now. They’re like hitting it like, you know, like almost every website’s got like a chat feature that pops up and you can kind of talk to it about what’s going on. But those things have access to the screen that you’re on. So if you open up your assistant and you’ve got simple practice open on that screen, that assistant now has access to the content that’s on that screen.
[00:06:36] So these are things that people aren’t really thinking about that you’re like unknowingly probably violating HIPAA or, sharing PHI and you might not even realize that you’re doing it. She’s gonna talk about some things, and this is just my own research on it, and again, I’m not a compliance expert, but for example, do like an audit of your browser.
[00:06:55] Okay? What extensions do you have installed? Are any of them AI powered? Are they in the same profile that you use for your clinical work? Like if you’re logged in under your personal Gmail and you’re opening up your EHR and then you’ve got some other AI powered app that has permission like Grammarly or something like that has permission to access everything.
[00:07:16] Are you violating HIPAA by doing that? She’s gonna talk about a lot of that stuff, which just, it actually just makes my brain hurt thinking about it, and all the layers. Even if you have your cell phone in your session, right? Our cell phones are always listening. We give access to cookies. We approve it to be paying attention to like what we’re talking about, right?
[00:07:35] If you ever said like cheezit crackers or whatever, then all of a sudden you’ve got an ad across Facebook, Google, everywhere you go, you’re seeing ads for cheezit crackers. That’s because even our devices are listening, so technically even having our phones on during the session is a HIPAA violation because it’s listening.
[00:07:53] It can pick up on what we’re talking about with our clients. So even that’s a HIPAA violation that a lot of us don’t think about, and that reminds me I should ask Samantha about that one. Maybe I’ll ask her about that in our training. Anyway, so that’s what’s going on. I don’t know if you’ve ever had burning questions like that.
[00:08:06] If you’re listening to this episode, email me at info@kymtolson.com, kymtolson.com, and let me know. Do you have a question? Are you always logging into something you’re like, I think this is HIPAA compliant, but I’m not exactly sure. Send that back. I like tried to stockpile questions too that we can ask her during the presentation to just get all these questions answered so I can give you that information later.
[00:08:29] The other thing I wanted to say, and this is for Thera AI hub members, if you’re listening to this, you guys know I recently put a skills directory inside the Thera AI hub where you can just log in and you can literally download skills that you could put into any of the ais that you’re using. What I thought would be fun to build like around this whole thing, and I’ll probably release it after Samantha’s presentation is
[00:08:52] a skill that you can take and just upload on any AI you want and consult the skill. So it’s almost like a HIPAA compliance officer that you can consult and go in and ask it and basically just say like, look, this is my tech stack that I’m using right now. Do you see any glaring HIPAA compliance issues here?
[00:09:12] So I thought that’d be like a really cool tool to give you guys inside of the Thera AI hub. So you should expect to see that after Samantha’s presentation on May 5th. So Samantha’s website is guardian@clinicalessentials.com. She’s the real deal. 25 years in mental health. She runs her own practice.
[00:09:30] She specializes in making HIPAA actually doable for, small group practices and solo practices for clinicians. So I hope you’ll check her out. I’m gonna put the link under this episode for you to come join us for free in that 90 minute presentation that she’s gonna give.
[00:09:47] And again, if you’ve got questions about any of this stuff, there’s so many scenarios that come up all the time and people are always saying, is this okay, Kim? And I’m like, I just, I don’t know. I don’t wanna say I am not a lawyer. I’m not a HIPAA compliance expert, but that’s why I wanted to bring Samantha to you so you guys could talk to her and ask her these questions. And of course you could go hit her up on her website and ask these questions too.
[00:10:07] And if you can’t come to the webinar, there will be a replay. So I would suggest signing up and going and checking it out and learning about everything we’re doing, especially I know every time you guys listen to this episode, I’m talking about a new cool tool. Just to let you guys know, I’ve got Claude on my browser.
[00:10:26] I’ve got Manus on my browser. I’ve got ChatGPT new Codex, I think that just came out today. Today is April 17th. Just came out and I haven’t even gotten a chance to play with it, but it looks like it’s very similar to the other computers. All of these are living on my computer, so they have access, like they can sort of like see everything going on and know they are not HIPAA compliant.
[00:10:48] So what I am actually doing client work right now. I’m making sure I’m using my Comet browser when I open up Berries is where I record my sessions through Berries and then, you know, I use Zoom. I had the BAA version of Zoom, so I’m fine there.
[00:11:01] That’s all running through my comment perplexity browser. But what I do is I close those computers down on my toolbar right now and I’ll have to ask Samantha if that’s good enough. ’cause I, you know, I don’t know. I think it is, but I really don’t know. And these are things we don’t think about.
[00:11:16] Like are there apps just sitting open listening that could be recording client information or taking note of client information or storing it somehow that we don’t know about right? Inadvertently we might be violating HIPAA and don’t even know it. So anyway, I, I hope that helps. I hope that gets you thinking. Let me know what you think. Send me your questions so I can give them to Samantha for May 5th.
[00:11:38] And I hope you guys enjoy the webinar if you come to it live. And if not, sign up below. You’ll get access to the replay forever. Okay? I hope y’all have a great week, and please send me your HIPAA compliance ai questions that are sort of outside of the box. Talk to you later. Bye.