What should a therapist check before trusting an AI note tool with client data?

Three documents and four questions. Put your client consent form, your vendor's settings page and your business associate agreement side by side. One counsellor who did that found they did not describe the same thing, and found a default they would not have chosen. Then ask the vendor whether it can write a note without keeping a recording, who else processes the data, whether it trains on it, and when it is deleted.

Why read three documents side by side?

Because each was written by a different person for a different reason. The counsellor had a signed agreement and a consent form, and had never compared them with how the tool was actually configured. On comparing them, the consent form described data practices the settings did not match. The counsellor rewrote the form, changed the setting, and reissued it to every active client.

The consent template supplied by the records system also said, underneath, that it was for reference only and that tailoring it to the state's rules was the clinician's job.

What four questions should I ask a vendor?

Can it produce a note without storing a recording? Who are the sub-processors that handle the data on its behalf? Is client data used to train its models, and is opting out the default? Where is the data stored, and what is the deletion process?

A vendor that answers all four in writing, quickly, has been asked before. A vendor that needs a week has not.

What do clinicians find when they look?

An auditor who reviewed one practice found clinicians already using a tool while nobody knew how it was configured, where the audio and transcripts were held, or that calendar syncing could run before a client had consented. A psychiatrist described one product's process in detail: record, transcribe, delete the audio, pass the transcript to the model, delete transcripts after about two weeks. Each product is different. That is why you ask.

Who is responsible if it goes wrong?

You are. Colorado's new law allows AI for administrative support only where the licensed professional keeps responsibility for reviewing what it produces. Your licence, your document, your client.

The short version

Read your consent form, your vendor's settings and your agreement side by side, then ask four questions: can it work without keeping a recording, who else touches the data, does it train on it, and when is it deleted. Solanto is being built for therapy practices so the answer to where does it go can be short: in Private Mode the note never leaves your device.

Solanto has not shipped yet. The price is on the page rather than behind a call, and early access is open: solanto.ai/pricing

Open those three documents tonight. It takes twenty minutes and most clinicians have never done it.