--- title: "Therapy practice AI rules: data, approvals, and spend" description: "Set therapy practice AI rules for protected records, psychotherapy notes, outgoing approvals, and function budgets before any patient data enters a tool" canonical: "https://scalewithsearch.com/articles/therapy-practice-ai-data-approval-spend-rules" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # Therapy practice AI rules: data, approvals, and spend A therapy practice's AI rules should begin with a data boundary and an accountable reviewer. Write down which records a function may read, which decisions it may prepare, and who approves anything sent or changed. Set a budget that can stop processing. Use this article as a worksheet for a nonclinical office function. Have the practice's privacy, security, and clinical owners review the actual design. The [therapy and outpatient health overview](/for/therapy-and-outpatient-health) connects these controls with the wider operating record. Start planning and testing with invented material. Do not move real patient information into a new tool while the practice is still deciding whether the tool and use are permitted. ## Determine coverage and identify the data Ask the privacy lead to establish the practice's obligations and the proposed function's data categories. Record the conclusion and the sources used. Do not decide from a software vendor's marketing label. HIPAA covers specified entities, including providers conducting certain electronic transactions. Its protected information includes identifiable health, care, and payment information. [HHS Privacy Rule summary, checked 2026.10.26](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html). This means a scheduling or billing task deserves a privacy review even when its purpose is administrative. Do not assume removing a diagnosis makes an identifiable record unrestricted. Have the privacy lead approve the exact fields and intended processing. | Material | Proposed first-function boundary | | --- | --- | | Public office hours and contact instructions | Use the current approved record | | Patient messages and scheduling references | Exclude until the specific processing path is approved | | Clinical records | Exclude from the administrative pilot | | Psychotherapy notes | Keep outside the pilot and escalate special handling | | Payment credentials | Keep in the approved payment workflow | | Invented test cases | Use for design after checking that no real data was copied | Map each copy of permitted data, including exports, temporary processing, drafts, monitoring, and backups. Assign an owner to the map. Require another review before adding a new category. ## Review the service and arrangement together HHS says a cloud provider handling ePHI for a covered entity is a business associate, even without a decryption key. [HHS cloud guidance, checked 2026.10.26](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html). The same guidance requires an appropriate BAA and compliance with the HIPAA Rules. Have the reviewer assess the actual service configuration, permitted uses, subcontractor arrangements, safeguards, and the practice's own responsibilities. A signed document should be part of the review, not a substitute for understanding the workflow. Confirm which account and services the arrangement covers. Do not assume a staff member's separate personal account has the same terms. Keep unapproved services outside the data path. A fallback after a failed call must not send information to a different processor automatically. Make any processor change a documented review event before resuming. ## Keep psychotherapy notes on a separate track HHS describes special authorization rules for psychotherapy notes, with specified exceptions. [HHS psychotherapy-notes discussion, checked 2026.10.26](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html). Have the responsible clinician and privacy reviewer determine which records fall into that category and how they may be used. Do not let a general office function classify its own access. Exclude these notes from a first administrative pilot. Avoid treating ordinary authorization for an administrative activity as permission for every clinical record. Preserve the purpose and scope of any approved use. If the function encounters excluded material, stop processing and follow the practice's incident procedure. Do not build the test collection from real notes with names casually removed. Use invented content for acceptance exercises. Any de-identification process intended for real data needs its own qualified review. ## Limit inputs to the approved purpose HHS's minimum-necessary standard has exceptions, including certain treatment disclosures. [HHS limits and exceptions, checked 2026.10.26](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html). Have the privacy lead determine what applies to the particular use. Separately adopt a narrow-source design for the function: approved fields, named locations, and no access to unrelated patient files. A recommendation to minimize inputs should not be confused with a complete legal analysis. For a paperwork queue, use an approved status record rather than clinical contents when the task permits. For an office report, ask whether approved aggregate figures answer the question. Do not add detailed records merely to make a narrative richer. Keep receipts narrow too. An internal reference, source version, status, model identifier, and cost may be sufficient. Have the reviewer confirm that receipts and identifiers receive the handling they require. ## Approve the exact communication or change Require review before a patient message, appointment offer, record update, billing explanation, or public reply leaves the preparation stage. Define the authorized role for each action. A receptionist's administrative approval does not establish clinical approval. Show the reviewer the intended recipient, channel, contact preferences, source version, attachments, and final text. If a material fact or recipient changes, invalidate the preview. Keep the exact accepted version available in the approved record. Do not let the function respond to urgent or clinical questions from general knowledge. Follow the practice's established human escalation process. The function's operating scope should say what happens when such material is encountered. For public messages, review disclosure separately from tone. A friendly reply can still reveal private context. The [therapy review-privacy guide](/articles/therapy-practice-negative-review-privacy) covers the public response boundary in more detail. ## Exclude payment secrets from prompts Keep card data and credentials in the payment provider's approved workflow. Give the office function only the permitted status needed for its task. Do not retain a customer's volunteered payment code in test records. PCI DSS forbids storing card verification codes after authorization, even encrypted. [PCI Security Standards Council FAQ 1280, checked 2026.10.26](https://www.pcisecuritystandards.org/faqs/1280/). Inspect rejected inputs, error logs, and support exports for copied sensitive content. Have the approved handling procedure address unexpected payment data. A function that refuses the visible task still needs to avoid repeating the prohibited value elsewhere. ## Enforce spend limits within the approved environment Assign each function a monthly allowance, per-run ceiling, retry limit, and named budget owner. Separate paperwork preparation from office reporting so the practice can identify which work consumed its allowance. Check remaining allowance before each paid request. Reserve enough for the configured bounded operation and reconcile actual cost afterward. Include failed requests and retries. Stop new processing when the allowance or retry ceiling is reached. Send an operational alert without patient content. Keep the manual continuation path available. Do not reduce cost by moving protected information to an unreviewed service or broadening the permitted use. Keep the model and processor configuration dated. A model replacement must pass the same privacy boundary and output checks. Changing that setting should not change access rights, retention rules, or sending permissions silently. ## Verify the policy with invented cases Test a wrong-recipient draft, conflicting patient references, excluded note content, a failed cost receipt, and an exhausted allowance. Define the expected denial or stop before running each case. Check what appears in logs as well as the visible output. Require the checker to trace each prepared fact back to its approved source. Add a new case when staff find a recurring failure. Record who accepted the correction and whether it changed a source fact or a processing rule. Have the practice's owners inspect the evidence and resolve failed checks. Train a backup to stop the function and continue work through the existing office process. Keep accepted rules, corrections, and receipts in practice-controlled records. Use the [approval matrix guide](/articles/ai-agent-approval-matrix) to record who may approve each action in this operating policy. Bring Scale With Search the administrative scope and privacy-approved samples. Read the [AI systems approach](/ai-systems), then [send your requirements](/work#send-your-brief) for a written function definition. Continue the website review: [AI-native therapy practices: the first functions to build](/articles/ai-native-therapy-practice-first-functions); [Therapy website: make estimate information findable](/articles/therapy-good-faith-estimate-website-notice); [Therapy Google profiles: review the shared-office setup](/articles/therapy-google-practitioner-profile-shared-office); [Therapy privacy notices: publish the approved version](/articles/therapy-notice-of-privacy-practices-website); [Therapy office directions: explain the final approach](/articles/therapy-office-directions-website-page); [Therapy paperwork downloads: check the actual files](/articles/therapy-patient-paperwork-download-page); [Therapy insurance page: publish checked plan details](/articles/therapy-practice-insurance-website-page); [Therapy review replies: protect private information](/articles/therapy-practice-negative-review-privacy); [Therapy practice provider bios: publish checked facts](/articles/therapy-practice-provider-bio-pages); [Therapy waitlist pages: state what a request means](/articles/therapy-practice-waitlist-website-page); [Therapy telehealth pages: state your service area](/articles/therapy-telehealth-service-area-page); [Therapy website forms: review fields and tracking](/articles/therapy-website-intake-form-tracking-review). [therapy and outpatient health practices](/for/therapy-and-outpatient-health): website and search resources. ## Related: therapy and outpatient health practices - [Therapy insurance page: publish checked plan details](/articles/therapy-practice-insurance-website-page) - [Therapy review replies: protect private information](/articles/therapy-practice-negative-review-privacy) - [Therapy practice provider bios: publish checked facts](/articles/therapy-practice-provider-bio-pages) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```