A telehealth AI documentation checklist: recording consent scripts, BAAs down the whole vendor chain, where audio lives, de-identification, SOAP/DAP templates, modality and location fields, audit trail, and device security.
A telehealth-only practice has more places for session data to leak than an in-person one: a video platform, a capture tool, a transcription vendor, an AI drafting vendor, cloud storage, and an EHR, often across two states. This checklist covers the eight things to have in place before AI documentation touches a remote session: recording consent, a BAA with every vendor in the chain, a known home for audio, de-identification before any general-purpose model, telehealth-ready note templates, modality and location fields, an audit trail, and device security.
In-person, the session and the note both happen in rooms you control. Telehealth spreads them across a video platform, a browser, a home office, a client's kitchen, and sometimes a state line, and AI documentation adds two more hops: transcription and drafting. Every hop is a place data can sit and a vendor who may or may not be under a Business Associate Agreement.
This is a governance checklist, not a setup guide; for the mechanics of getting clean audio out of Zoom or Google Meet, read how to record a telehealth session for AI notes first.
Documenting a session with AI is one act. Recording it is another, and recording has its own law.
The state question. Most states allow recording with one party's consent; a meaningful minority require every party's consent. For telehealth, follow the stricter of the two states involved, yours and the client's, because which one governs a cross-state call is not settled everywhere. This is general guidance, not legal advice. If you see clients across state lines, have a healthcare attorney confirm the rule for your specific states.
What the form should say. A consent form that says "sessions" may not clearly cover a recorded video call or AI-assisted drafting. Name all three: sessions may be recorded, a transcript is produced, and software drafts the note for clinician review. State that declining will not affect care.
Say it again on the call. A short script before the first recorded session, and whenever you are unsure the client remembers:
"Before we start, a reminder that I record our sessions so that software can draft my notes, which I review and edit myself. The recording stays encrypted and I delete it once the note is done. Are you still comfortable with that today?"
Document the answer in the note. Over video it is harder to read hesitation, so treat an ambiguous answer as a no. Our guide on talking to clients about AI documentation covers the longer conversation.
Draw the path a session takes: video platform → capture tool → transcription → AI drafting → storage → EHR. Each arrow is a vendor that can see protected health information, and every one of them has to be covered by a BAA. That does not mean you sign each one yourself: you sign with the vendors you contract with directly, and each of those must bind its own subprocessors (a transcription engine, a model provider, a storage host) on terms at least as protective. What you cannot do is assume coverage: a BAA with your EHR does not extend to your video platform or to the consumer cloud folder where you saved the recording.
The two gaps practices most often find: the video platform (business tiers will sign a BAA; the free consumer tier typically will not, so check which you are on) and storage (a recording in a personal Google Drive or the laptop's Downloads folder has left every BAA you signed). If a vendor will not sign, PHI does not go through it.
PsyFi signs a BAA on every paid plan, executed by clickwrap at signup and covering the whole product line, and every sub-processor that may touch PHI is bound by a BAA on terms at least as protective. Details are on the trust center.
Audio is the most sensitive artifact in the chain and the least useful once the note is signed. For every recording, know where it is captured, where it is stored and whether it is encrypted, and when it is deleted and by whom. Set a written retention window, then confirm your tool's behavior matches it rather than assuming. In PsyFi Notes, audio is captured in the browser extension or the iOS app, sent over TLS to AWS US regions, transcribed on PsyFi's own infrastructure rather than a third-party audio API, encrypted at rest with AES-256, and kept under your account's control. The retention policy is still yours to set.
The most common failure is not a hack. It is a clinician pasting a transcript into a consumer chatbot to "clean it up," with no BAA and full names in the text.
If any step of your workflow uses a general-purpose model, including AI features inside other tools, identifiers need to be stripped before the text reaches it. HIPAA's Safe Harbor list of eighteen identifier categories is a workable definition of what to remove.
Purpose-built tools do this for you. PsyFi de-identifies transcripts and chat messages before any model call, replacing identifiers with structural tokens such as [CLIENT_NAME], and application logs are scrubbed of PHI. Anything else, de-identify by hand first. For what goes wrong with consumer chatbots, see what therapists should know before using ChatGPT for notes.
SOAP and DAP work as well remotely as in person; the difference is what the Objective or Data section can honestly contain when you see a client from the shoulders up on a small, lagging window. Do not let a template imply observations you could not make.
A telehealth-ready template adds a short header on top of the format you already use:
| Field | Example |
|---|---|
| Modality | Synchronous video (or audio-only, and why) |
| Client location | State and setting (home, workplace) |
| Clinician location | State and setting |
| Identity and consent | Identity verified; recording consent reaffirmed |
| Technical issues | Audio drop at 20 min, resumed; none affecting content |
Then the SOAP or DAP body as usual. PsyFi Notes supports SOAP, DAP, BIRP, GIRP, and Narrative with a per-account default; SOAP vs DAP vs BIRP covers how to choose.
Payers generally expect telehealth claims to carry the modality and where each party was; the codes, modifiers, and place-of-service conventions vary by payer and state. A note that records both gives you the evidence for whatever the claim needs, so build the fields into the template rather than reconstructing them at billing time.
Two habits keep this defensible: confirm the client's location every session, because a client in a state where you are not licensed is a problem to catch before the session; and document audio-only sessions as audio-only, with the reason, since many payers bill them differently. The contracts you bill under are the source of truth.
If a payer audit or a records request lands, you need to show who did what to the note, and when. Your EHR is the chart of record: signed notes, amendments, and signatures belong there with their own history. The AI tool should log account-level actions (sign-in, recording, note generation, team administration) without putting PHI in the log; PsyFi emits structured audit events for those actions with PHI excluded by schema.
A reviewer will also want evidence that a qualified clinician read and edited the draft. Every generated note in PsyFi Notes carries a banner requiring clinician review before signing; drafts signed unedited, session after session, is exactly the pattern auditors look for.
Telehealth means the practice's hardware is a laptop at a kitchen table. On every device that records, drafts, or opens a note: full-disk encryption and a short screen lock; a separate user account for practice work on a shared machine; multi-factor authentication on the documentation tool, the EHR, and the email tied to both; automatic updates on; and a headset, so a client's voice does not carry through a home.
Vendors cannot do this part for you; HIPAA places it on the practice. Write a one-page device policy and have every clinician sign it.
A solo clinician licensed in two states sees a returning client by video at 6:30 pm.
The software portion took a few minutes. The clinician review took longer, and it should have.
Most of this is one-time setup with an annual re-read; the per-session parts — confirm location, reaffirm consent, edit the draft — are short enough to become habit. Put the annual review on the calendar now, with the eight headings above as the agenda.
PsyFi Notes is HIPAA-aligned clinical documentation software backed by a Business Associate Agreement. For questions about AI documentation for telehealth practices, contact our onboarding team at hello@psyfitechnologies.com.
