Implementation Guide: Ambient session documentation for therapists — draft dap/soap notes from session audio

Hardware Procurement

Software Procurement

Prerequisites

• Active EHR/Practice Management subscription (SimplePractice, TherapyNotes, Jane App, PIMSY, or equivalent) with admin credentials available for the MSP
• Reliable internet connection: minimum 25 Mbps download / 10 Mbps upload at the practice location (verify with speed test at multiple times during business hours)
• Each clinician must have a modern smartphone (iOS 15+ or Android 12+) or tablet for ambient capture app installation
• Each clinician must have a laptop or desktop with a modern browser (Chrome 90+ recommended) for EHR access and browser extension installation
• Practice must have a designated HIPAA Privacy Officer and existing HIPAA policies (if not, the MSP should conduct a full HIPAA risk assessment as a prerequisite engagement)
• Practice must have current Business Associate Agreements (BAAs) with their existing EHR vendor and any telehealth platform in use
• Legal review of state-specific recording consent requirements for every state where the practice's clients reside (critical for telehealth practices serving multi-state clients)
• Practice leadership must confirm clinician buy-in: at minimum, identify 1–2 champion clinicians willing to pilot the technology
• Practice must confirm their malpractice insurance covers AI-assisted documentation (contact carrier to verify)
• Physical access to all therapy rooms for audio environment assessment (ambient noise levels, room dimensions, HVAC noise)
• Admin access to the practice's wireless network infrastructure, or willingness to allow MSP to upgrade network equipment
• Identification of whether the practice treats substance use disorders (triggers 42 CFR Part 2 compliance requirements)

Installation Steps

Step 1: Conduct Site Assessment and Compliance Audit

Before any technology deployment, perform an on-site or remote assessment covering: (1) current EHR platform and version, (2) network infrastructure and bandwidth testing, (3) therapy room acoustic evaluation, (4) existing HIPAA policies and BAAs, (5) state-specific recording consent law mapping for all states where clients reside, (6) whether the practice treats substance use disorders (42 CFR Part 2 applicability), and (7) clinician readiness and concerns. Document findings in a Site Assessment Report.

# Network bandwidth test from a clinical workstation
speedtest-cli --simple
# Or use browser-based: https://www.speedtest.net

# Wi-Fi signal strength survey (if macOS available)
sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s

# Check DNS resolution latency
ping -c 10 api.upheal.io
ping -c 10 app.therapynotes.com

Step 2: Select and Contract with AI Scribe Vendor

Based on the site assessment, recommend the optimal AI scribe solution. Decision matrix: (A) If the practice uses TherapyNotes → recommend TherapyFuel Scribe add-on for seamless EHR-native integration. (B) If the practice uses SimplePractice → recommend Note Taker add-on. (C) If the practice uses a different EHR or wants best-of-breed AI → recommend Upheal (all-in-one) or Twofold Health (standalone scribe). (D) If budget is primary concern → recommend HealOS at $49/mo or Mentalyc starting at $19.99/mo. Initiate free trials with the top 2 candidates. Obtain and review each vendor's BAA, data processing agreement, SOC 2 report, and data retention/deletion policy BEFORE any PHI is processed.

Step 3: Deploy Network Infrastructure Upgrades

If the site assessment revealed inadequate Wi-Fi coverage, missing VLAN segmentation, or consumer-grade networking equipment, deploy HIPAA-appropriate network infrastructure. Install Ubiquiti UniFi Dream Machine Pro as the gateway/router and UniFi U6 Pro access points for wireless coverage. Configure VLAN segmentation: VLAN 10 for clinical devices (workstations, tablets, phones running scribe apps), VLAN 20 for guest/patient Wi-Fi, VLAN 30 for IoT/printers. Enable WPA3-Enterprise on the clinical VLAN if supported by endpoints, otherwise WPA3-Personal with a strong passphrase rotated quarterly.

Step 4: Build and Deploy Client AI Consent Forms

Create practice-branded informed consent forms for AI-assisted session documentation. These forms must be separate from the general intake consent and must clearly disclose: (1) that sessions will be audio-recorded by an AI system, (2) the specific purpose (generating clinical progress notes), (3) how the audio and transcript data are handled and deleted, (4) the client's right to refuse without impact on treatment, (5) that the clinician reviews and approves all AI-generated notes before they become part of the clinical record. For Illinois clients, the form must comply with Public Act 104-0054 (written disclosure of AI use and specific purpose, written consent required). For California clients, include AB 3030 disclosure language. For two-party consent states (CA, FL, IL, WA, PA, MD, etc.), ensure affirmative consent is captured before any recording.

• No CLI commands — this is a forms/policy creation step
• Deploy using JotForm HIPAA or equivalent HIPAA-compliant form builder
• Template field: Practice name and clinician name
• Template field: AI tool name and vendor (e.g., 'Upheal by Upheal Inc.')
• Template field: Description — 'This tool records audio during your session to generate draft clinical notes'
• Template field: Data handling — 'Audio is encrypted, transmitted to [vendor], processed, and automatically deleted within [X hours/days]'
• Template field: Clinician review — 'Your therapist reviews and edits all AI-generated notes before they are finalized'
• Template field: Right to refuse — 'You may decline AI-assisted documentation at any time without affecting your care'
• Template field: Signature line with date
• Template field: For IL — Additional language per Public Act 104-0054
• Template field: For CA — Additional AB 3030 disclosure language

Step 5: Configure AI Scribe Accounts and Clinician Profiles

Set up the selected AI scribe platform with practice-level and individual clinician accounts. For each clinician: (1) create an account with their professional credentials, (2) configure preferred note format (DAP, SOAP, BIRP, etc.), (3) set default session duration, (4) configure note templates and section preferences, (5) set audio retention policy to minimum/auto-delete if configurable. For EHR-native solutions (TherapyFuel, Note Taker), enable the add-on in the EHR admin panel and assign licenses to clinician accounts. For standalone solutions (Upheal, Twofold, HealOS), install the browser extension on each clinician's workstation and the mobile app on their capture device.

Step 6: Deploy and Configure Capture Hardware

Install and configure audio capture hardware for each therapy room and clinician.

• PLAUD NotePin/NotePin S setup: (1) unbox and charge fully, (2) download PLAUD AI app on clinician's phone, (3) pair device via Bluetooth, (4) configure recording settings (sample rate, auto-start, etc.), (5) activate PLAUD AI subscription (Pro $100/yr or Unlimited $240/yr), (6) test recording quality in the actual therapy room.
• Jabra Speak2 setup: (1) connect via USB-C to clinician's workstation or via Bluetooth to their laptop, (2) install Jabra Direct software for firmware updates and settings, (3) set as default audio input in the operating system and in the scribe application, (4) test recording quality from typical patient seating positions.

Jabra Speak2 setup on Windows

# 1. Connect Speak2 via USB-C
# 2. System Preferences → Sound → Input → select 'Jabra Speak2 55/75'
# 3. In Chrome: Settings → Privacy and Security → Site Settings → Microphone → select Jabra

PLAUD NotePin setup

Step 7: Conduct Room Acoustic Assessment and Optimization

Audio quality test procedure (manual)

Step 8: Configure EHR Integration Workflow

Set up the specific workflow for getting AI-generated notes into the practice's EHR. This varies by platform combination: (A) EHR-Native (TherapyFuel/Note Taker): Notes appear directly in the EHR note editor — configure default note templates and verify field mapping. (B) Browser Extension (Upheal): Install the Chrome extension, authenticate with the EHR, and test that the extension can identify and populate note fields. (C) Copy-Paste Standalone (Twofold, HealOS, Freed, Mentalyc): Create a standardized workflow document showing clinicians exactly how to copy from the scribe app and paste into their EHR note template. Configure the EHR note template to match the scribe's output sections (e.g., DAP sections in both systems).

• macOS: Install Paste (from Mac App Store) or use built-in clipboard history — Enable: System Settings → Keyboard → Clipboard History (macOS Sequoia+)
• Windows: Enable clipboard history — Settings → System → Clipboard → toggle 'Clipboard history' ON — Access with Win+V to see clipboard history
• For text expansion / quick-paste (optional efficiency boost) — macOS: Install TextExpander or use built-in Text Replacements — Windows: Install Beeftext (free, open-source) from https://beeftext.org

Step 9: Implement Consent Collection Workflow in Practice Operations

Deploy the AI consent form into the practice's intake workflow so that every client is properly informed and consented before any ambient capture occurs.

JotForm HIPAA consent form deployment

Step 10: Pilot Deployment with Champion Clinicians

Deploy the complete solution to 1–2 volunteer 'champion' clinicians for a 2-week pilot period. These should be clinicians who are enthusiastic about the technology and comfortable providing feedback.

Pilot tracking spreadsheet column definitions

Step 11: Full Practice Rollout

After successful pilot validation, deploy to all remaining clinicians.

Step 12: Establish Quality Assurance and Compliance Monitoring

Set up ongoing quality assurance processes:

QA review template for clinical director

# Monthly: Review vendor security bulletins and status pages
# Quarterly: Verify BAA currency, check for vendor policy changes
# Annually: Full HIPAA risk assessment update including AI systems
# As-needed: Review new state AI legislation affecting therapy practices

Custom AI Components

Consent Status Verification Workflow

Type: workflow

An automated workflow that checks whether a client has signed the AI documentation consent form before allowing ambient capture to begin. Integrates with the EHR consent tracking field and the AI scribe application. Prevents accidental recording of non-consenting clients — a critical compliance safeguard given the Sharp HealthCare litigation precedent.

Implementation:

Consent Verification Workflow

Overview

This workflow runs at session start-time and prevents ambient AI capture for clients who have not consented.

Implementation Option A: Manual Checklist (Low-Tech)

Implementation Option B: Automated Check (For Practices with Zapier/Make)

Use a Zapier automation connecting the EHR and a notification system:

# Zapier Zap Configuration
trigger:
  app: Google Calendar  # or EHR calendar
  event: Event Start (15 minutes before)
  filter: Event type = 'Therapy Session'

action_1:
  app: Google Sheets  # Consent tracking spreadsheet
  event: Lookup Row
  lookup_column: Client Name
  lookup_value: "{{trigger.event.attendee_name}}"

action_2:
  app: Slack  # or Email or SMS
  event: Send Direct Message
  condition: "{{action_1.consent_status}} != 'Consented'"
  message: |
    ⚠️ CONSENT ALERT: {{trigger.event.attendee_name}}
    AI consent status: {{action_1.consent_status}}
    DO NOT activate ambient scribe for this session.
    Consent form link: {{consent_form_url}}

Implementation Option C: EHR Custom Alert (TherapyNotes/SimplePractice)

For EHRs supporting custom alerts or flags:

Audit Trail

Maintain a log (spreadsheet or form) documenting:

• Client ID
• Consent form signed date
• Consent form version
• Who collected consent
• If declined: date declined, reason (if given)
• Annual re-consent date (if practice policy requires annual renewal)

DAP/SOAP Note Quality Validator Prompt

System Prompt (for use with GPT-4, Claude, or similar LLM)

You are a clinical documentation quality reviewer for a mental health therapy practice. You are reviewing an AI-generated progress note that was drafted from ambient session audio capture. Your role is to identify potential quality and compliance issues — NOT to evaluate clinical decisions.

Review the following note and evaluate each criterion. For each criterion, rate as PASS, FLAG, or FAIL and provide a brief explanation.

Criteria:

1. Section Completeness

• Are all required sections present and populated?
• Is any section suspiciously short or generic?

2. Clinical Terminology Accuracy

• Are clinical terms used correctly (e.g., 'affect' not 'effect', 'ideation' not 'idiation')?
• Are any medication names potentially misspelled or confused with similar-sounding drugs?

3. Hallucination Risk Indicators

• Does the note contain overly specific details that seem templated rather than session-specific?
• Are there statements that contradict each other within the note?
• Are there clinical observations that would be unusual for the stated session type?

4. Psychotherapy Notes Boundary

• Does the note contain the therapist's personal impressions, countertransference reactions, or private analysis that should be classified as psychotherapy notes (HIPAA-protected) rather than treatment records?
• Flag any content that appears to cross this boundary.

5. PHI Minimization

• Does the note contain unnecessary PHI (e.g., full SSN, detailed family member names not relevant to treatment)?

6. Plan Specificity

• Is the treatment plan specific and actionable (e.g., 'Continue weekly CBT sessions focusing on cognitive restructuring for catastrophic thinking') vs. vague (e.g., 'Continue treatment')?

7. Insurance/Audit Readiness

• Does the note support medical necessity for the billed CPT code?
• Would this note withstand an insurance audit or peer review?

Output Format:

For each criterion, provide:

• Rating: PASS | FLAG | FAIL
• Details: Brief explanation
• Recommendation: Specific edit suggestion if FLAG or FAIL

Then provide an overall quality score (1-10) and summary recommendation.

Usage Instructions:

Frequency:

• Week 1-4 post-deployment: Review 20% of all AI-generated notes
• Month 2-3: Review 10% of all AI-generated notes
• Month 4+: Review 5% of all AI-generated notes (random sample)
• Always review 100% of notes for any clinician who reports accuracy concerns

Multi-State Consent Law Compliance Checker

Decision Logic for Telehealth Practices

# Reference tool for determining consent requirements by state. Last
# updated: 2025-07 — MSP should verify current law before relying on this.

# consent_compliance_checker.py
# Reference tool for determining consent requirements by state
# Last updated: 2025-07 — MSP should verify current law before relying on this

STATE_CONSENT_REQUIREMENTS = {
    # Two-party (all-party) consent states
    'CA': {
        'consent_type': 'two-party',
        'recording_consent': 'All parties must consent to recording',
        'ai_specific_law': 'AB 3030 (eff. Jan 1, 2025): Must notify patients when GenAI generates clinical communications. Exemption if clinician reviews and approves.',
        'form_language': 'California law requires all parties consent to audio recording. Additionally, per California AB 3030, we disclose that AI technology is used to assist in generating clinical documentation from session audio. Your therapist reviews and approves all AI-generated notes before they become part of your clinical record.',
        'timing': 'Before session; written consent recommended',
        'special_notes': 'AB 3030 exemption applies when clinician reviews notes — but recording consent still required separately'
    },
    'FL': {
        'consent_type': 'two-party',
        'recording_consent': 'All parties must consent to recording',
        'ai_specific_law': 'Pre-filed bill (2026 session): Would require written informed consent 24 hours before AI recording/transcription of therapy',
        'form_language': 'Florida law requires all parties consent to audio recording of conversations. [If 2026 bill passes: Written consent must be obtained at least 24 hours before the session in which AI recording occurs.]',
        'timing': 'Before session; if 2026 bill passes, 24 hours in advance',
        'special_notes': 'Monitor 2026 legislative session for passage of pre-filed bill'
    },
    'IL': {
        'consent_type': 'two-party',
        'recording_consent': 'All parties must consent to recording',
        'ai_specific_law': 'Public Act 104-0054: Written disclosure of AI use and specific purpose required; written consent required; AI may not independently make therapeutic decisions or interact directly with clients',
        'form_language': 'Illinois law (Public Act 104-0054) requires that you be informed in writing that AI technology will be used during your therapy sessions. Purpose: AI is used solely to generate draft clinical progress notes from session audio. Your therapist reviews, edits, and approves all notes. AI does not make therapeutic decisions, interact with you directly, or generate therapeutic recommendations without your therapist\'s oversight.',
        'timing': 'Written consent required before first AI-assisted session',
        'special_notes': 'Most prescriptive state law — ensure exact compliance with written disclosure and consent requirements'
    },
    'WA': {
        'consent_type': 'two-party',
        'recording_consent': 'All parties must consent to recording',
        'ai_specific_law': 'None specific to AI in therapy as of 2025',
        'form_language': 'Washington state law requires all parties consent to audio recording of private conversations.',
        'timing': 'Before session',
        'special_notes': 'Standard two-party consent'
    },
    'PA': {
        'consent_type': 'two-party',
        'recording_consent': 'All parties must consent to recording',
        'ai_specific_law': 'None specific to AI in therapy as of 2025',
        'form_language': 'Pennsylvania law requires all parties consent to the interception or recording of oral communications.',
        'timing': 'Before session',
        'special_notes': 'Standard two-party consent — Pennsylvania Wiretapping and Electronic Surveillance Control Act'
    },
    'MD': {
        'consent_type': 'two-party',
        'recording_consent': 'All parties must consent to recording',
        'ai_specific_law': 'None specific to AI in therapy as of 2025',
        'form_language': 'Maryland law requires all parties consent to recording of oral communications.',
        'timing': 'Before session',
        'special_notes': 'Standard two-party consent'
    },
    # One-party consent states (representative sample — most US states)
    'NY': {
        'consent_type': 'one-party',
        'recording_consent': 'One party (the therapist) may consent to recording',
        'ai_specific_law': 'None specific to AI in therapy as of 2025',
        'form_language': 'We use AI technology to assist in generating clinical documentation from session audio. Your therapist reviews and approves all AI-generated notes.',
        'timing': 'Best practice: inform client before first AI session even if not legally required',
        'special_notes': 'Even in one-party states, best practice and ethical guidelines recommend informing the client'
    },
    'TX': {
        'consent_type': 'one-party',
        'recording_consent': 'One party may consent',
        'ai_specific_law': 'None specific as of 2025',
        'form_language': 'We use AI technology to assist in generating clinical documentation from session audio. Your therapist reviews and approves all AI-generated notes.',
        'timing': 'Best practice: inform before first AI session',
        'special_notes': 'One-party consent state but client disclosure strongly recommended'
    },
    # Add additional states as needed
}

def get_consent_requirements(client_state: str, therapist_state: str) -> dict:
    """
    Returns the most restrictive consent requirements based on
    both client and therapist locations.
    For telehealth, apply the MORE restrictive state's requirements.
    """
    client_req = STATE_CONSENT_REQUIREMENTS.get(client_state, {'consent_type': 'one-party'})
    therapist_req = STATE_CONSENT_REQUIREMENTS.get(therapist_state, {'consent_type': 'one-party'})
    
    # Use the more restrictive requirement
    if client_req['consent_type'] == 'two-party' or therapist_req['consent_type'] == 'two-party':
        primary_state = client_state if client_req['consent_type'] == 'two-party' else therapist_state
        return {
            'applies': primary_state,
            'requirements': STATE_CONSENT_REQUIREMENTS[primary_state],
            'recommendation': f'Apply {primary_state} two-party consent requirements (more restrictive)'
        }
    else:
        return {
            'applies': therapist_state,
            'requirements': STATE_CONSENT_REQUIREMENTS.get(therapist_state, client_req),
            'recommendation': 'One-party consent applies but best practice is to obtain written client consent regardless'
        }

# Example usage:
if __name__ == '__main__':
    # Therapist in New York, client in California (telehealth)
    result = get_consent_requirements('CA', 'NY')
    print(f"Consent standard: {result['requirements']['consent_type']}")
    print(f"Applies from: {result['applies']}")
    print(f"AI-specific law: {result['requirements'].get('ai_specific_law', 'None')}")
    print(f"Required form language: {result['requirements']['form_language']}")
    print(f"Recommendation: {result['recommendation']}")

MSP Action Items:

Session Audio Quality Monitor

Type: integration

A lightweight monitoring integration that tracks audio capture quality metrics over time across all therapy rooms and clinicians. Helps the MSP proactively identify degrading audio quality (e.g., failing microphone, new HVAC noise, repositioned furniture) before it impacts note accuracy. Uses data from the AI scribe platform and clinician feedback.

Implementation:

# Session Audio Quality Monitoring Dashboard

Implementation using Google Sheets + Google Forms + Apps Script

Step 1: Create the Quality Tracking Form (Google Forms)

Create a Google Form with these fields:

• Clinician Name (dropdown)
• Date (date picker)
• Therapy Room (dropdown: Room A, Room B, etc.)
• Capture Device Used (dropdown: PLAUD NotePin, Jabra Speak2 55, Jabra Speak2 75, Laptop Mic, Phone Mic)
• Session Type (dropdown: In-Person, Telehealth - Video, Telehealth - Phone)
• AI Note Accuracy Rating (1-5 scale: 1=Unusable, 2=Major edits needed, 3=Moderate edits, 4=Minor edits, 5=Minimal/no edits)
• Audio Issues Observed (checkboxes: None, Background noise, Echo, Low volume, Dropped words, White noise interference, One speaker unclear)
• Comments (free text)

Step 2: Link to Google Sheet

Form responses auto-populate a Google Sheet. Add these calculated columns:

# Column J: Rolling 7-day average accuracy per room
=AVERAGEIFS(F:F, C:C, C2, B:B, ">="&(TODAY()-7))

# Column K: Alert flag (if average drops below 3.5)
=IF(J2<3.5, "⚠️ QUALITY ALERT", "✅ OK")

# Column L: Trend (comparing this week to last week)
=J2 - AVERAGEIFS(F:F, C:C, C2, B:B, ">="&(TODAY()-14), B:B, "<"&(TODAY()-7))

Step 3: Automated Alert (Google Apps Script)

function checkAudioQuality() {
  const sheet = SpreadsheetApp.getActiveSpreadsheet().getSheetByName('Form Responses 1');
  const data = sheet.getDataRange().getValues();
  const headers = data[0];
  const rows = data.slice(1);
  
  // Get last 7 days of data
  const sevenDaysAgo = new Date();
  sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
  
  const recentRows = rows.filter(row => new Date(row[1]) >= sevenDaysAgo);
  
  // Calculate average by room
  const roomAverages = {};
  recentRows.forEach(row => {
    const room = row[2]; // Room column
    const rating = row[5]; // Accuracy rating column
    if (!roomAverages[room]) roomAverages[room] = { total: 0, count: 0 };
    roomAverages[room].total += rating;
    roomAverages[room].count += 1;
  });
  
  // Check for alerts
  const alerts = [];
  Object.keys(roomAverages).forEach(room => {
    const avg = roomAverages[room].total / roomAverages[room].count;
    if (avg < 3.5) {
      alerts.push(`${room}: Average quality ${avg.toFixed(1)}/5.0 (${roomAverages[room].count} sessions)`);
    }
  });
  
  // Send alert email if issues found
  if (alerts.length > 0) {
    const mspEmail = 'msp-support@yourmsp.com'; // CHANGE THIS
    const practiceEmail = 'admin@therapypractice.com'; // CHANGE THIS
    
    const subject = '⚠️ Audio Quality Alert - AI Scribe System';
    const body = `The following therapy rooms have audio quality ratings below threshold (3.5/5.0) over the past 7 days:\n\n${alerts.join('\n')}\n\nRecommended actions:\n1. Check microphone positioning and connections\n2. Test for new ambient noise sources\n3. Verify capture device firmware is up to date\n4. Schedule a room acoustic re-assessment if issues persist\n\nThis is an automated alert from the AI Documentation Quality Monitor.`;
    
    MailApp.sendEmail(mspEmail, subject, body);
    MailApp.sendEmail(practiceEmail, subject, body);
  }
}

Step 4: Clinician Workflow

• After each session, clinician takes 10 seconds to rate note accuracy (can be simplified to thumbs up/down)
• Form is bookmarked on clinician's browser or added as a home screen shortcut
• Alternatively, integrate with the scribe platform's own feedback mechanism if available

Step 5: MSP Review Cadence

• Weekly: Glance at dashboard for alerts
• Monthly: Review trends, identify rooms or devices with declining quality
• Quarterly: Present quality report to practice leadership

Automated HIPAA Audit Trail Logger

Type: workflow

A workflow that maintains a comprehensive audit trail of all AI documentation system activities for HIPAA compliance. Tracks consent collection, BAA status, vendor policy changes, clinician access, and note generation events. Essential for demonstrating compliance during audits or breach investigations.

Implementation:

# HIPAA Audit Trail for AI Documentation System

Implementation using Google Sheets as Audit Log

Audit Log Structure

Create a Google Sheet with the following tabs:

Tab 1: Consent Audit Log

• A — Date
• B — Client ID (coded, not name in this log)
• C — Consent Action (Obtained / Declined / Revoked / Renewed)
• D — Consent Form Version
• E — Collected By (staff name)
• F — Storage Location (EHR record #, JotForm submission #)
• G — State-Specific Requirements Applied
• H — Notes

Tab 2: BAA Tracking

• A — Vendor Name
• B — BAA Execution Date
• C — BAA Expiration/Review Date
• D — BAA Document Location (link to file)
• E — Last Verified Date
• F — Verified By
• G — Vendor SOC 2 Report Date
• H — Vendor Data Retention Policy Summary
• I — Next Review Date
• J — Status (Active / Expired / Under Review)

Tab 3: System Access Log

• A — Date
• B — User
• C — Action (Account Created / Deactivated / Password Reset / Permission Changed)
• D — System (Upheal / TherapyNotes / Network / etc.)
• E — Performed By
• F — Reason

Tab 4: Incident Log

• A — Date Discovered
• B — Incident Type (Unauthorized Recording / Data Exposure / Vendor Breach / Consent Gap)
• C — Description
• D — Affected Clients (count)
• E — Immediate Action Taken
• F — Root Cause
• G — Corrective Action
• H — Reported To (HHS if >500 affected, state AG, etc.)
• I — Resolved Date
• J — Follow-up Verification Date

Tab 5: Vendor Policy Change Tracker

• A — Date Identified
• B — Vendor
• C — Change Description
• D — Impact Assessment
• E — Action Required
• F — Action Taken Date
• G — Reviewed By

Automated Reminders (Google Apps Script)

function sendComplianceReminders() {
  const sheet = SpreadsheetApp.getActiveSpreadsheet().getSheetByName('BAA Tracking');
  const data = sheet.getDataRange().getValues();
  const today = new Date();
  const thirtyDaysFromNow = new Date();
  thirtyDaysFromNow.setDate(today.getDate() + 30);
  
  data.slice(1).forEach((row, index) => {
    const reviewDate = new Date(row[8]); // Next Review Date column
    const vendor = row[0];
    const status = row[9];
    
    if (status === 'Active' && reviewDate <= thirtyDaysFromNow) {
      MailApp.sendEmail(
        'msp-compliance@yourmsp.com',
        `⏰ BAA Review Due: ${vendor}`,
        `The BAA with ${vendor} is due for review by ${reviewDate.toLocaleDateString()}.\n\nActions needed:\n1. Verify BAA is still current and signed\n2. Check for any vendor policy changes\n3. Review vendor's latest SOC 2 report\n4. Update the audit log after review`
      );
    }
  });
}

Access Control

• Google Sheet shared only with MSP compliance team and practice HIPAA Privacy Officer
• Enable Google Workspace audit logging for the spreadsheet itself
• Do NOT include actual PHI in this audit log — use coded client IDs only

Testing & Validation

• AUDIO CAPTURE TEST: In each therapy room, record a 3-minute scripted conversation using the deployed capture device. Verify the AI scribe transcription achieves ≥95% word accuracy (WER <5%). Test from the furthest typical client seating position with HVAC running and door closed.
• NOTE FORMAT TEST: Generate AI notes in each configured format (DAP, SOAP, BIRP) and verify all required sections are present, properly labeled, and populated with relevant content from the test conversation.
• EHR INTEGRATION TEST: Complete the full workflow from ambient capture through note appearing in the EHR: (A) For EHR-native solutions, verify the note populates directly in the correct EHR note template. (B) For browser extension solutions, verify one-click push populates the correct fields. (C) For copy-paste workflows, verify formatting is preserved when pasting into the EHR.
• CONSENT WORKFLOW TEST: Walk through the complete client intake process: (1) New client receives AI consent form during intake, (2) Form is signed and stored, (3) EHR consent tracking field is updated, (4) Clinician can verify consent status before starting ambient capture. Test both the 'consented' and 'declined' paths.
• DECLINED CONSENT FALLBACK TEST: Simulate a session with a client who has declined AI consent. Verify the clinician can conduct the session and write a manual note without any AI capture activating. Verify no audio is inadvertently recorded.
• TELEHEALTH SESSION TEST: Conduct a test telehealth session using the practice's telehealth platform (e.g., SimplePractice Telehealth, Doxy.me) with the AI scribe active. Verify the scribe can capture audio from both parties through the telehealth platform's audio stream.
• NETWORK RESILIENCE TEST: During an active test recording, temporarily degrade the Wi-Fi connection (e.g., move to edge of coverage). Verify the AI scribe handles the interruption gracefully — either buffering locally and syncing later, or alerting the clinician to the connection issue.
• MULTI-ROOM SIMULTANEOUS TEST: If the practice has multiple clinicians, run concurrent ambient capture sessions in adjacent rooms. Verify there is no audio bleed-through or cross-contamination between sessions, and that the network handles the concurrent upload bandwidth.
• PHI HANDLING VERIFICATION: After a test note is generated, verify with the AI vendor's dashboard/settings that audio has been deleted per the vendor's stated policy (e.g., auto-delete after processing). Check that no audio files persist on the capture device after sync.
• HIPAA AUDIT TRAIL TEST: Verify the audit log correctly captures: (1) consent form collection event, (2) AI scribe session initiation, (3) note generation and clinician review. Pull a sample audit trail and confirm it would satisfy an HHS auditor's inquiry.
• CLINICIAN EXPERIENCE TEST: Have each pilot clinician complete 3 real sessions (with consented clients) and rate the experience on: time saved vs. manual documentation, note accuracy requiring editing, workflow disruption during session, and overall satisfaction. Target: ≥4.0/5.0 average satisfaction.
• BROWSER EXTENSION COMPATIBILITY TEST: If using Upheal or similar browser extension, test on the clinician's actual browser with their actual EHR login. Verify the extension correctly identifies note entry fields and does not conflict with other browser extensions (password managers, ad blockers, etc.).
• EMERGENCY STOP TEST: Verify that the clinician can immediately stop ambient capture mid-session if the client requests it. Test the 'stop recording' function on the capture device, mobile app, and web interface. Confirm no audio from after the stop command is captured or transmitted.

Client Handoff

Client Handoff Checklist

Training Sessions to Deliver:

Documentation to Leave Behind:

• Clinician Quick Reference Card (laminated, 1 page): Step-by-step workflow from session start to signed note
• Consent Form Templates: Finalized, attorney-reviewed consent forms for all applicable states
• State Consent Law Reference Matrix: Printout of the multi-state compliance checker output for the practice's client base
• Troubleshooting Guide (2 pages): Common issues and fixes — audio quality, connectivity, app errors, EHR integration problems
• Vendor Contact Sheet: Support contact information for the AI scribe vendor, EHR vendor, and MSP help desk
• HIPAA Documentation Binder Update: Updated risk assessment including AI documentation system, BAA copies, data flow diagrams showing how PHI moves through the ambient capture system
• Audio Quality Monitoring Dashboard Access: Shared Google Sheet with instructions for the quality tracking form
• Audit Trail Spreadsheet Access: Shared with HIPAA Privacy Officer and practice administrator

Success Criteria to Review Together:

Maintenance

Ongoing MSP Maintenance Responsibilities

Weekly Tasks:

• Review audio quality monitoring dashboard for alerts (rooms dropping below 3.5/5.0 threshold)
• Check AI scribe vendor status page for outages or degraded performance
• Respond to any clinician support tickets within 4-hour SLA during business hours

Monthly Tasks:

• Review adoption metrics: percentage of clinicians actively using the system, notes generated per clinician
• Pull and review QA audit results from clinical director
• Check for AI scribe vendor app updates (mobile and browser extension) and coordinate update rollout
• Review network health metrics (bandwidth utilization, Wi-Fi signal strength in therapy rooms)
• Update capture device firmware if available (PLAUD app, Jabra Direct)
• Brief practice administrator on any emerging state AI legislation

Quarterly Tasks:

• Verify BAA currency and vendor compliance status for all AI vendors
• Review and update the multi-state consent law compliance matrix
• Conduct a brief check-in with the clinical director on note quality trends
• Review vendor data retention and processing policies for any changes
• Test the incident response procedure with a tabletop exercise (annually, but prep quarterly)
• Assess whether the current AI scribe vendor is still the best fit (new competitors, pricing changes, feature updates)
• Generate a quarterly report for practice leadership: adoption rates, time savings, quality scores, compliance status

Annual Tasks:

• Conduct a full HIPAA risk assessment update that includes the AI documentation system
• Review and renew all BAAs
• Evaluate whether the practice should switch AI scribe vendors (market changes rapidly)
• Review client consent forms and update language for any new state laws
• Recertify audio quality in all therapy rooms (furniture moves, new noise sources)
• Review practice malpractice insurance coverage confirmation for AI-assisted documentation
• Present annual AI documentation ROI analysis to practice leadership

Trigger-Based Maintenance:

• Vendor breach notification: Immediately activate incident response; notify practice HIPAA officer; assess scope; document in audit trail; determine HHS reporting obligations
• New state AI legislation: Review within 30 days of passage; update consent forms and compliance matrix; notify practice and clinicians of any workflow changes
• Clinician turnover: Deactivate departing clinician's AI scribe account immediately; onboard new clinician with full training within first week
• Client complaint about AI documentation: Investigate within 24 hours; review the specific note and consent documentation; escalate to practice clinical director if clinical content concern
• Significant drop in note accuracy: Investigate root cause (audio hardware degradation, vendor model update, room acoustic change); resolve within 1 week

SLA Considerations for MSP Contract:

• Response time: 4 hours (business hours) / next business day (after hours) for standard issues
• Critical issue response: 1 hour for compliance-related issues (unauthorized recording, potential breach)
• Uptime: AI scribe availability is dependent on vendor SLA (typically 99.5-99.9%); MSP responsible for network/infrastructure uptime at 99.9%
• Escalation path: Clinician → Practice Admin → MSP Help Desk → MSP Senior Engineer → Vendor Support

Model/Platform Retraining Triggers:

• Most SaaS AI scribe vendors handle model updates automatically; MSP should monitor vendor release notes
• For platforms with learning features (Twofold's writing style learning): New clinicians need 5-10 sessions for the AI to calibrate; inform clinicians that accuracy improves over the first 2 weeks
• If the vendor changes their underlying LLM (e.g., GPT-4 to GPT-5), conduct a brief note quality validation to ensure output quality has not regressed

Alternatives

EHR-Native AI Scribe (TherapyFuel / SimplePractice Note Taker)

Instead of deploying a standalone third-party AI scribe, use the ambient AI feature built directly into the practice's existing EHR platform. TherapyFuel is native to TherapyNotes ($40/clinician/month add-on) and SimplePractice Note Taker is native to SimplePractice ($35/clinician/month add-on). Notes generate directly inside the EHR with zero copy-paste required.

• PROS: Lowest workflow friction (single login, no copy-paste), single BAA covers both EHR and AI, clinicians already familiar with the interface, lower total cost if already on these EHRs.
• CONS: Locked into one EHR vendor, may have fewer note format options than standalone tools, AI capabilities may lag behind specialized vendors like Upheal or Freed, cannot use if on a different EHR (Jane, Valant, TheraNest).
• RECOMMEND WHEN: The practice already uses TherapyNotes or SimplePractice and values simplicity over best-in-class AI accuracy.

PIMSY EHR with PAISLY AI (42 CFR Part 2 Compliant)

For practices that treat substance use disorders (SUD), deploy PIMSY EHR with its native PAISLY AI assistant. PIMSY is purpose-built for behavioral health with native 42 CFR Part 2 compliance including data segmentation, consent tracking, and audit trails for SUD records. PAISLY AI generates notes directly within PIMSY's template structure and handles group documentation with individual notes per participant.

• PROS: Only option specifically designed for 42 CFR Part 2 compliance from the ground up, handles SUD record segmentation natively, EHR-native AI eliminates integration complexity, group therapy documentation support.
• CONS: Requires practice to switch to PIMSY EHR if not already using it (major migration project), pricing by quote only (less transparent), smaller vendor than SimplePractice/TherapyNotes.
• RECOMMEND WHEN: The practice has significant SUD treatment caseload and needs bulletproof 42 CFR Part 2 compliance, or is already on PIMSY.

Self-Hosted Open-Source Pipeline (Maximum PHI Control)

Deploy a fully self-hosted transcription and note generation pipeline using open-source components: OpenAI Whisper Large v3 or Google MedASR for speech-to-text, running on a local GPU server, with a locally-hosted LLM (e.g., Llama 3 or Mistral) for SOAP/DAP note structuring. All PHI remains on-premises or in the practice's own cloud tenancy — no third-party vendor processes audio or transcripts.

• PROS: Maximum PHI control (no data leaves the practice's infrastructure), no per-clinician SaaS fees after initial setup, no vendor BAA dependency, full customization of note templates and AI behavior.
• CONS: Extremely high implementation complexity (requires ML engineering expertise), significant upfront hardware cost ($5,000–$15,000 for GPU server), ongoing maintenance burden (model updates, infrastructure management), lower transcription accuracy than commercial solutions tuned for therapy (Whisper WER is ~5-8% general vs. <2% for tuned commercial solutions), no vendor support — MSP owns all troubleshooting.
• RECOMMEND WHEN: Only for practices with extreme data sovereignty requirements (e.g., government-affiliated, military/VA adjacent) or MSPs with dedicated ML engineering staff. Not recommended for typical SMB therapy practices.

Freed AI (General-Purpose Ambient Scribe)

Deploy Freed AI as the ambient scribe at $90–$99/clinician/month. Freed is a popular general-purpose medical ambient scribe with SOC 2 Type II certification, HIPAA compliance, and strong adoption in small/medium practices. It generates SOAP notes, patient instructions, and ICD-10 coding suggestions. Integration is via copy-paste (no native EHR write-back for therapy EHRs).

Tradeoffs

• PROS: Mature platform with large user base (47% from 2-10 clinician practices)
• PROS: SOC 2 Type II certified
• PROS: Strong general medical vocabulary
• PROS: 7-day free trial
• PROS: ICD-10 coding assistance
• CONS: Higher price than therapy-specific alternatives ($99/mo vs. $49/mo for HealOS/Twofold)
• CONS: Not purpose-built for mental health (may lack therapy-specific note formats like DAP/BIRP)
• CONS: No native EHR integration with therapy platforms
• CONS: Copy-paste only workflow
• RECOMMEND WHEN: The practice includes prescribers or medical providers alongside therapists (mixed practice), values enterprise-grade security certifications, or clinicians have prior positive experience with Freed from other settings.

DeepCura Full-Stack Clinical AI Platform

Deploy DeepCura at $129/clinician/month as an all-in-one clinical AI platform that includes ambient scribe, AI receptionist, billing assistance, and fax management. Supports 50+ specialties and allows the practice to choose their preferred AI engine (GPT-5.2, Claude Opus, or Gemini).

• PROS: Comprehensive platform beyond just scribing (receptionist, billing, fax), choose-your-own-AI-engine flexibility, supports 50+ specialties, single vendor for multiple AI capabilities.
• CONS: Higher cost ($129/mo vs. $49/mo for basic scribes), newer platform with less therapy-specific track record, may include capabilities the practice doesn't need (paying for bundled features), vendor stability risk as a newer entrant.
• RECOMMEND WHEN: The practice wants to consolidate multiple AI tools into one platform, has billing and front-desk automation needs beyond just note-taking, or wants the flexibility to switch underlying AI models.