SimplePractice is the most widely used EHR platform among independent behavioral health clinicians in the United States. Last week, it quietly announced a policy change in a support page update that should trouble every therapist, every patient, and everyone who believes the clinical relationship deserves to be protected from commercial interest.
Beginning June 16, 2026, SimplePractice will retain de-identified transcripts from its AI Note Taker tool. New users who enable Note Taker are opted in by default. The company’s defense is familiar: the data is de-identified under HIPAA’s Safe Harbor standard. It is encrypted. It will not be sold. It will be used only to improve their own AI features.
They are, by their own account, technically compliant.
That is precisely the problem.
Here’s why this is so concerning and a threat to all practices.
HIPAA is a floor, not a ceiling
HIPAA was written in 1996. The Safe Harbor de-identification standard — a checklist of 18 data fields to remove — was designed for claims data, lab results, and administrative records. It was not designed for the verbatim transcript of a psychotherapy session.
Think about what a therapy transcript actually contains. Not a diagnosis code. Not a blood pressure reading. The patient’s words. Their account of their marriage, their childhood, their fears, their secrets. Their therapist’s questions. The specific metaphors a patient uses to describe their inner life. The way they talk about the people they love and the people who hurt them.
This content is not a demographic record. It is a narrative. And narratives are uniquely, stubbornly re-identifiable in ways that a 1996 compliance framework cannot anticipate. Stripping names and dates from a richly specific personal account does not make that account anonymous. It makes it nameless. Those are not the same thing.
SimplePractice knows this. They are not naive. They have legal teams and ethics consultants and compliance officers. And they still chose opt-out for new users. That choice reflects a calculation, not an oversight.
The research is unambiguous. Health data consent studies show participation rates above 95% under opt-out defaults versus roughly 19% under opt-in — not because patients’ values differ, but because most people never act against a default. SimplePractice did not choose opt-out despite knowing this. They chose it because of it.
The therapeutic relationship is not a data asset
Psychotherapy notes have their own protected status under HIPAA, separate from the general medical record, for a reason. What happens in the therapy room operates under a different ethical compact. Patients disclose things they have never told another human being, under an explicit promise — enforced by ethics codes, licensure, and law — that it stays in that room.
Using session content to improve AI systems, even a company’s own, even de-identified, violates that compact. It converts what patients said in confidence into a commercial input.
SimplePractice would respond that patients can opt out. What they don’t say is that this requires clinicians to navigate settings at the clinician, client, and session level — a process most will never get to. When a company leads with regulatory compliance rather than clinical ethics, it is telling you what standard it is optimizing for. The alternative is straightforward and how we have built our technology: build AI features where both providers and patients are opted out by default. That is a design choice. It is available to any company willing to make it.
This is not about AI
I want to be precise here, because the argument I am making is sometimes misread as a case against AI in clinical settings. It is not.
AI tools that help clinicians document more efficiently, that reduce the administrative burden that drives burnout, that allow a therapist to be more present in the room — these are genuinely valuable. The technology is not the problem. The problem is the governance model under which it is deployed. Who controls the data. Who benefits from its secondary uses. Whether the patient’s interest is treated as primary, or as a constraint to be managed within the limits of what the law currently requires.
SimplePractice could have built its AI improvement pipeline on opt-in consent. It would have been slower. They chose not to, because they are optimizing for a different outcome than the one their customers believe they are.
This is not a fringe concern — it is the field’s consensus
The concern I am raising is not a minority position. At a recent national conference of the National Association of Social Workers, the CEOs of the American Psychiatric Association, the American Psychological Association, NASW, and NAMI said publicly what I am saying here: that technology companies are moving faster than ethics, policy, and clinical controls; that safeguards need to be built in on the front end; and that the field has a narrow window — perhaps three to five years — to shape how AI develops in behavioral health before industry defines it without us.
Dr. Arthur Evans, CEO of the American Psychological Association, made the re-identification point directly: that even data we believe to be de-identified can be reassembled, and that the greatest risk in this moment is misplaced trust — people believing their information is protected in ways it may not actually be.
The American Counseling Association, representing 60,000 professional counselors, is currently revising its Code of Ethics specifically to address AI and technology — with the updated code expected in fall 2026. SimplePractice made this policy change in the middle of that revision process. The field’s ethics framework is being written in real time, and the companies that serve the field are not waiting for it.
These are not outside critics. They are the people who set the ethical standards for the clinicians SimplePractice serves. SimplePractice’s transcript retention policy is not an isolated incident. It is a data point in a pattern — and the pattern is what we need to address.
What independent practitioners should ask their EHR
If you are a behavioral health clinician, there are four questions your EHR should be able to answer clearly and immediately:
Does any session-derived data leave the clinical record for any purpose other than direct patient care? If so, under what consent model?
If I enable an AI feature today, what am I opted into by default?
If my patient objects to AI processing of their session content, can they opt out completely?
Who owns the company that makes my EHR, and what are their financial incentives with respect to the data I generate?
These are not hostile questions. They are the questions any clinician with a duty of care to their patients should be asking. If your EHR cannot answer them plainly, that is informative.
A different model is possible
I am writing this as the founder of a behavioral health EHR. I have a stake in this conversation that readers should weigh accordingly.
What I can say is this: the choices SimplePractice made were not forced on them by the technology or the market. They were design decisions, made by people with options. A company that generates revenue from successfully adjudicated insurance claims — not from subscription fees, not from data — has a different relationship to session content than one whose product roadmap depends on retained transcripts. Structural alignment between provider success and company success is not an idealistic abstraction. It is an architecture. You can build it, or you can choose not to.
The therapists and patients raising their voices this week understand exactly how technology companies work. That is why they are angry. And they are right to be.
The question is whether enough people in this industry — clinicians, patients, policymakers, and the technologists building these tools — will hold to a higher standard than the one the law currently enforces.
I believe they should. I believe they will.
Samant Virk, MD is a neurologist and the founder and CEO of MediSprout, a behavioral health EHR and practice management platform built for independent practices.