Aug 27, 2026
2026 has been a watershed year for therapist legal risk. Three converging forces—the rapid adoption of AI in clinical practice, a landmark Supreme Court decision reclassifying talk therapy as protected speech, and the continued expansion of interstate telehealth—have fundamentally altered the compliance landscape.
The therapist who practiced defensibly in 2024 may be exposed in 2026. New state laws require written informed consent before AI records a session. The Supreme Court has subjected state therapy regulations to "strict scrutiny." Malpractice verdicts exceeding $10 million have more than doubled in less than a decade. And licensing boards are disciplining clinicians for violations that did not exist as categories five years ago.
This article maps the 2026 legal terrain: the new AI consent laws, the Chiles decision, telehealth licensure requirements, HIPAA and 42 CFR Part 2 updates, malpractice insurance realities, and the practical steps every practicing clinician should take now.
AI in Therapy — The New Consent Mandate
State Laws Requiring Written Informed Consent
The most significant legal development of 2026 is the wave of state legislation regulating AI in psychotherapy. Colorado's HB 26-1195, effective June 3, 2026, establishes clear limits: AI may not independently provide psychotherapy, counseling, diagnosis, or treatment. All clinical services must be delivered by a licensed provider. AI is limited to administrative or support roles—documentation, transcription, scheduling—provided the licensed clinician oversees and validates outputs.
Critically, the law requires that providers inform patients when AI is used in connection with their care, and that use of AI for recording or transcription requires advance disclosure of purpose and informed consent.
Colorado joins Illinois, Nevada, Tennessee, and Utah in legislating to restrict AI chatbots from acting as licensed behavioral health professionals and requiring disclosure to patients about AI use.
Washington State's proposed legislation similarly requires that the patient "is informed that AI will be used and the specific purpose of the AI tool or system" and "provides consent to the permitted use".
What This Means for Your Practice
If you use an AI scribe or documentation tool, you must:
Disclose the specific tool and its purpose in writing
Obtain written, informed consent before the tool records or transcribes a session
Ensure AI-generated content is reviewed and approved by a licensed clinician
Confirm your AI vendor operates in compliance with these restrictions
Train all staff on safe and compliant AI use in patient care settings
Chiles v. Salazar — The Supreme Court Reshapes Therapy Regulation
The Decision
On March 31, 2026, the Supreme Court issued its landmark 8–1 decision in Chiles v. Salazar, reclassifying "talk therapy" as protected speech under the First Amendment. The ruling fundamentally shifts the legal landscape, subjecting state-level regulations of clinical therapy to "strict scrutiny"—the highest level of judicial review.
What Strict Scrutiny Means
Under strict scrutiny, a state regulation of therapy must serve a compelling government interest and be narrowly tailored to achieve that interest. This limits a state's ability to regulate viewpoint-specific clinical dialogue.
Practical Implications
Therapists should understand:
Licensing boards retain authority over professional conduct, but the boundary between protected speech and regulable conduct is now contested.
Standards of care and informed consent become more important, not less, as regulatory authority shifts toward professional ethics and self-regulation.
Specific legislative bans on therapeutic content may be unenforceable.
The decision is already influencing other legal disputes, including teletherapy licensing challenges.
Telehealth Licensure — The Interstate Compact Patchwork
The Core Rule
Practicing telehealth across state lines requires a license in every state where your patient is physically located at the time of the visit—not where you are sitting.
Compact Status in 2026
Compact | Coverage | Status |
|---|---|---|
PSYPACT | Psychologists | 42 jurisdictions; allows practice without individual state licenses |
Counseling Compact | Licensed counselors | Issuing privileges in more states; significant gaps remain |
Social Work Compact | Social workers | Not yet available for clinicians to use |
MFT Compact | Marriage and family therapists | Not yet operational |
Key caveat: Compact membership does not necessarily mean clinicians can practice in a state immediately. Several compacts have many more member states than operational states.
Colorado's Telehealth Registration
Beginning January 1, 2026, Colorado began offering telehealth registrations to out-of-state mental health providers. The rule: if the patient is located in Colorado, you need a Colorado credential or registration.
HIPAA and 42 CFR Part 2 — The Dual Compliance Burden
Psychotherapy Notes Protection
Under HIPAA, psychotherapy notes receive a distinct layer of protection beyond standard PHI. They require separate, specific authorization from the patient in almost every scenario. Critically, if your session notes live inside the patient's general chart, HIPAA does not give them enhanced protection.
The 42 CFR Part 2 Alignment
The 2024 final rule aligning 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records) more closely with HIPAA has full enforcement effective February 16, 2026.
Key changes include:
A single consent for all uses or disclosures for treatment, payment, and health care operations
A new definition of SUD counseling notes mirroring the HIPAA definition of psychotherapy notes
SUD counseling notes must be maintained separately to receive enhanced protection.
What to Do Now
Separate psychotherapy notes and SUD counseling notes from the general medical record
Train all staff—including front desk and administrative personnel—on the authorization requirement
Do not release psychotherapy notes to insurers without separate written authorization
Update your Notice of Privacy Practices to reflect 42 CFR Part 2 alignment
Malpractice Liability — The Rising Stakes
Verdicts Are Getting Larger
Verdicts greater than $10 million have more than doubled between 2015 and 2023. The average award rose from $23 million to $40 million. Every U.S. state reported at least one verdict above $10 million during that period.
Insurance Coverage Realities
The average cost of defending a board complaint is approximately $7,155 and rising. Most mental health professionals carry a minimum of $1 million per claim and $3 million aggregate.
Occurrence-based coverage is generally the cleanest fit for therapists, as it covers claims made after the policy period for incidents that occurred during it.
The AI Coverage Gap
A critical issue for 2026: malpractice coverage may not extend to AI-assisted documentation. The gap may surface after a complaint arrives. Attorneys recommend a "jurisdiction-aware consent document that reflects current litigation trends".
Action step: Contact your malpractice carrier and confirm in writing whether AI-assisted documentation is covered.
Professional Boundaries and Licensing Board Discipline
The Most Common Source of Claims
Violations of the counseling relationship remain the most common source of claims against therapists. Recent disciplinary actions illustrate the pattern:
A licensed mental health counselor faced charges of "having an inappropriate relationship with a patient".
A psychologist's license was placed on probation for 18 months after a relationship with a former client.
A family therapist faced licensing issues after pleading guilty to theft and fraud.
Boundary Crossings vs. Violations
The distinction matters: "Boundary crossing occurs any time a professional deviates from the strictest professional role. Boundary crossings can be helpful, harmful, or neutral. Boundary crossings can become boundary violations when they place clients at risk for harm".
New York State's Mandatory Boundaries CE
Effective April 1, 2026, the New York State Board of Regents mandated that therapists complete continuing education in Maintaining Professional Boundaries in Psychotherapy.
Duty to Warn — The Enduring Obligation
The duty to warn remains one of the most legally consequential obligations for therapists. Under the Tarasoff framework, a therapist could be held liable for failing to disclose client confidences that indicate future risks of violence.
Key considerations for 2026:
Conduct robust violence risk assessments
Distinguish between venting and an explicit threat
Document the assessment, decision-making, and any disclosures made
Understand immunity statutes that may protect good-faith disclosures
Georgia remains the only state that has failed to definitively address the psychotherapist's duty to warn third parties.
The Practical Checklist
Area | Action Required |
|---|---|
AI Use | Written informed consent before recording; review AI outputs; verify vendor compliance |
Chiles Compliance | Update informed consent protocols; maintain standards of care |
Telehealth | Verify licensure in patient's state; check compact operational status |
HIPAA/Part 2 | Separate psychotherapy and SUD notes; train all staff on authorization |
Malpractice | Confirm AI coverage in writing; review policy type (occurrence vs. claims-made) |
Boundaries | Complete required CE; document boundary decisions |
Duty to Warn | Conduct risk assessments; document decisions; know immunity statutes |
FAQ
Do I need written informed consent before using an AI scribe in session?
Yes. Colorado, Washington, and other states now require written informed consent before AI records or transcribes a therapeutic session. The disclosure must include the specific purpose of the AI tool. Verbal consent is insufficient.
What does the Chiles v. Salazar decision mean for my practice?
The Supreme Court classified "talk therapy" as protected speech under the First Amendment, subjecting state regulation of therapy to strict scrutiny. Licensing boards retain authority over professional conduct, but specific legislative bans on therapeutic content may be unenforceable. Standards of care and informed consent become more important, not less.
Can I practice telehealth with a client in another state if I hold a compact privilege?
It depends on the compact. PSYPACT covers psychologists in 42 jurisdictions and allows practice without individual state licenses. However, many compacts have more member states than operational states. You must verify that the compact is actively issuing privileges in the state where your patient is located.
Does my malpractice insurance cover AI-assisted documentation?
Not necessarily. The gap may surface after a complaint arrives. You should contact your malpractice carrier and confirm in writing whether AI-assisted documentation is covered. Attorneys recommend a jurisdiction-aware consent document that reflects current litigation trends.
What are the new requirements for psychotherapy notes under HIPAA and 42 CFR Part 2?
Psychotherapy notes require separate, specific written authorization from the patient for most disclosures—including to insurers for payment. They must be kept separate from the general medical record to receive enhanced protection. The 2024 final rule aligning 42 CFR Part 2 with HIPAA has full enforcement effective February 16, 2026, adding a new definition of SUD counseling notes that mirrors the psychotherapy notes framework.
References
https://www.gtlaw.com/en/insights/2026/6/behavioral-health-law-ledger-june-2026
https://www.aamft.org/web/Shared_Content/Events/Event_display.aspx?EventKey=WEB260513
https://blog.hipaacertify.com/hipaa-mental-health-professionals-guide/
https://www.cmfgroup.com/blog/uncategorized/malpractice-insurance-for-therapists-and-counselors/
https://easehealth.com/blog/documentation-requirements-for-therapists
If you’re ready to spend less time on documentation and more on therapy, get started with a free trial today
Not medical advice. For informational use only.
Outline
More articles
