Therapy notes software is where a therapist writes and keeps clinical documentation: intake notes, progress notes, treatment plans and, under US rules, separate psychotherapy notes. Most products bundle scheduling, billing, client communication and telehealth around those notes. Choose by four things: the rules where you practice (HIPAA in the US, the GDPR in the EU, and in Germany a system certified for billing with the statutory health insurance), the note types and templates you need, where the data lives and how you get it out again, and what any built-in AI does with your sessions. An AI employee does not replace this software. It can take over the office work around it, the inbox, expense receipts and the website, but client health information never goes into a cloud service without protection.
This isn't legal advice. The legal points below refer to the US HIPAA rules and to EU and German law as of November 2026; elsewhere, your own rules apply. What follows is based on the legal texts and vendor pages, not on a test of the products.
What therapy notes software has to do
Progress notes and psychotherapy notes are not the same thing
The search results for "therapy notes software" are mostly review sites and vendor blogs comparing products. What they often skip is a distinction that matters for the choice. HIPAA defines psychotherapy notes as notes "recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session" that are "separated from the rest of the individual's medical record". Session start and stop times, treatment frequency, test results and summaries of diagnosis, treatment plan, symptoms and progress are excluded; those belong in the regular record. For any use or disclosure of psychotherapy notes, a covered entity needs the client's authorization, with narrow exceptions such as use by the note's author for treatment.
For the software that means: if you keep psychotherapy notes, check that the product stores them separately from progress notes and controls who can open them.
In Germany, the frame is different. § 630f of the German Civil Code requires the treating professional to keep a treatment record in close connection with the treatment, keep changes recognizable and retain the record for ten years after treatment ends. Therapists billing the statutory health insurance also need the telematics infrastructure; for practices with up to three practitioners, the German National Association of Statutory Health Insurance Physicians (KBV) lists a monthly flat rate of 263.62 euros in 2026 when all required applications are installed. Its installation statistics for psychotherapists (data as of December 31, 2025) put Elefant, psyprax, Epikur, SMARTY and PsychoDat on top.
AI note features: what to ask before you switch them on
Many products now offer AI that drafts notes from a session recording or transcript. SMARTY, for example, says its assistant Nemo creates letters, findings, reports and assessments from conversation transcripts (as of November 2026). Whether you use such a feature is your clinical decision. Before you do, ask three things:
- Who processes the recording, and where? Under HIPAA, a covered entity may let a business associate handle protected health information only with "satisfactory assurance" documented in a written contract. Under the GDPR, the vendor is a processor and needs a data processing agreement, and health data is a special category under Art. 9.
- How do you get consent? Recording a session is a separate step from writing a note. What German law says about recording and transcribing conversations is in Transcribing Calls: What German Law Says.
- What happens to the audio afterwards? Ask how long recordings and transcripts are kept and whether they are used to train models.
Five questions before you sign
- Where do you practice, and how do you bill? Insurance billing narrows the field quickly. Self-pay practices weigh notes, invoicing and privacy more heavily.
- Solo or group? A group practice needs permissions per person. Ask to see who can open which record.
- Where is the data? On your computer, a server you control, the vendor's data center or a cloud. Get the contract and the processing locations in writing.
- How do you get out? Ask for a full export of all records in a readable format before you start. Retention duties keep running after you switch.
- What does it cost in total? Licence, add-ons, support, AI features, hardware. Compare quotes for your practice size, not list prices.
Among US vendors you will meet names such as SimplePractice, which describes its "HIPAA-compliant software", and TherapyNotes, which calls itself a "Behavioral Health EHR/EMR". A vendor's own label is a starting point, not proof: the contract you sign is what counts.
What an AI employee handles around the software
The clinical record stays in the therapy notes software. An AI employee works next to it, on the office work every practice has. The roles below run in my own business and carry over; there is no therapy practice case behind them yet, so the table shows how it would work.
The last column is what matters. A practice email address collects everything: suppliers, licensing bodies, referrals, newsletters and messages from clients. A workable approach is to split it. Client communication runs through the therapy software's portal or another protected channel, and the AI employee gets the general office inbox. For new client inquiries it prepares templates that you send yourself, instead of reading the inquiries. How the pile system works day to day is in Sorting Your Inbox: The Pile System, and scheduling in Scheduling Meetings With AI: What Works Now.
Receipts are simpler. The landlord's or the software vendor's invoice contains no health data; an invoice to a client does, because it shows the treatment. Peter only gets the first kind. What the filing behind that needs is in Digital Receipt Filing That Holds Up.
On websites there is a real case, without names: Ralf built the website of a licensed couples therapist in Germany. There, the health advertising law (HWG) covers claims about treatments. How such a rebuild runs is in Modernizing a Website With AI: How To. What practice marketing may and may not say is in Marketing for Therapists: Rules and Tactics.
What an AI employee does not do in a practice: diagnose, write the content of notes or reports, advise or treat clients, keep records. That stays with you and your software.
If an AI should ever work with text that mentions clients, then only pseudonymized or on your own hardware. What I call the data lock replaces names and other details that point to a person with placeholders before a request goes to Claude, and puts the real names back into the answer. It's ready, it was built for German law firms, and I set it up for each practice individually; it wasn't designed with HIPAA in mind. We'll look together at what your practice needs. No automatic detection finds every detail, so some content shouldn't go to Claude at all. I describe the principle in Claude Code Mods for Tax Firms: Uses, Risks. Pseudonymized data is still personal data, so the GDPR keeps applying. The alternatives are in Local AI and Privacy: Cloud or Server?, and how I decide what an AI may see is in AI and Privacy: What the AI Gets to See. What this can look like with Claude Code in a practice is in Claude Code for Therapists: HIPAA and Privacy.
Frequently asked questions
What is the difference between progress notes and psychotherapy notes?
Under HIPAA, psychotherapy notes document or analyze the content of a counseling session and are kept separate from the rest of the record. Progress notes hold what belongs in the regular record: session times, frequency, test results and summaries of diagnosis, treatment plan, symptoms and progress.
Is AI-generated therapy note software safe to use?
That depends on the contract and the setup, not on the label. As a HIPAA covered entity in the US you need a business associate agreement with the vendor; in the EU a data processing agreement, and health data is a special category under Art. 9 GDPR. Add the client's consent to recording, and clear retention rules for audio and transcripts.
Can I paste client notes into ChatGPT or Claude?
Not unprotected. Without a suitable contract with the provider and a review by your privacy adviser, client health information doesn't belong there. Pseudonymization or your own hardware are options to settle first. What applies to Claude by plan is in Claude Privacy and GDPR: What Applies.
Which therapy software do German psychotherapists use most?
According to the KBV's statistics (data as of December 31, 2025), Elefant and psyprax lead with more than 10,000 installations each, followed by Epikur and SMARTY. The count only covers practices billing the statutory health insurance.
Where to go from here
Take the five questions above into your calls with two or three vendors, and get export, data processing and, if you need it, the business associate agreement in writing. Before any AI service sees data from your practice, work through the AI privacy check: five yes-or-no questions and a 20-point checklist, each with its legal basis. And if you want to know which office work in your practice an AI employee could take over, book a strategy session: in 20 minutes we look at the one workflow that depends on you the most. The overview for practices is in AI Tools for Therapists.
Your first AI employee up and running within an hour
Join the community$5/month founding price, first 50 members
