HIPAA-Compliant SOAP Notes: Rules, Checklist and AI Tools

What makes a SOAP note HIPAA-compliant?

HIPAA does not prescribe a SOAP format or specific wording. It regulates protected health information (PHI): who may use and disclose it, how it is protected, and what rights clients have over it. It applies to covered entities, including providers who send health information electronically for standard transactions such as insurance claims, and to their business associates. A therapist who is only paid privately may fall outside HIPAA, but state privacy law and your licensing board's ethics code still apply, and many practices follow HIPAA anyway.

For a SOAP note, compliance comes down to two rules.

The Privacy Rule: who can see the note

• Uses and disclosures. HIPAA generally permits covered entities to use and disclose progress notes for treatment, payment and permitted health care operations without a separate HIPAA authorization, subject to the Privacy Rule's conditions. Sharing for another entity's operations has extra limits, and more protective state laws or 42 CFR Part 2 may require consent even when HIPAA permits a disclosure. Other disclosures need a valid authorization or another legal permission.
• Minimum necessary. Generally limit uses, disclosures and requests for PHI to what is reasonably needed for the purpose, such as when sending records to an insurer or billing service, and use role-based policies for internal access. The standard does not apply to disclosures to or requests by a health care provider for treatment, or to giving clients access to their own records, among other exceptions.
• Client right of access. Clients can inspect or get a copy of their designated record set, which normally includes SOAP notes. Covered entities must act on an access request within 30 calendar days. If they cannot, they may take one extension of no more than 30 days, but must give the client a written reason and a completion date within the original 30 days. Follow any shorter state-law deadline. Write every note as if the client may read it.
• Psychotherapy notes are different. HIPAA gives extra protection to psychotherapy notes: your notes analyzing the session conversation, kept separately from the record. A SOAP note in the client record is a progress note, not a psychotherapy note. See progress notes vs psychotherapy notes for the distinction.

The Security Rule: how the note is protected

The Security Rule covers PHI in electronic form, which includes notes in an EHR, a document on your laptop, an email and an AI tool. It requires administrative, physical and technical safeguards, including:

• Access controls. Unique user identification, access limited to authorized users, and emergency access procedures are required. Automatic logoff is addressable: assess and document how you prevent access to unattended sessions, including on shared devices.
• Audit controls. A way to record and review who accessed or changed records.
• Integrity and authentication. Protection against improper changes, and confirmation that a user is who they say they are.
• Encryption. Encryption at rest and in transit is "addressable" under the current Security Rule. Assess whether it is reasonable and appropriate and implement it if so. If not, document why and implement an equivalent alternative where reasonable and appropriate; if neither is used, document how the standard is otherwise met. Encryption is a strong practical default. For the Breach Notification Rule's encryption safe harbor, the data must meet HHS encryption guidance and the decryption key must not have been compromised.
• Risk analysis. A documented assessment of where PHI lives in your practice and what could go wrong, updated when your systems change.

Retention is a separate question. HIPAA requires you to keep required compliance documentation, including policies and BAAs, for at least six years from when it was created or last in effect, whichever is later. HIPAA does not set how long to keep clinical records. That comes from state law, licensing boards and payer contracts: see mental health records retention by state. 42 CFR Part 2 protects records from federally assisted substance use disorder programs, and some obligations follow those records to recipients. Its updated requirements had a compliance date of February 16, 2026. Part 2 allows a single consent for future treatment, payment and health care operations uses and disclosures. Consent is generally required, but Part 2 permits limited disclosures without it, such as to medical personnel in a bona fide medical emergency when prior written consent cannot be obtained, subject to that exception's conditions.

What to keep out of a SOAP note

HIPAA does not tell you what to write, but anything in the note can be read by the client and, within the rules, shared with payers and other providers. Keep the note clinically relevant.

• Personal process notes. Keep private reflections about the session separate if you maintain psychotherapy notes. Include clinically relevant assessment, working diagnoses, risk findings and treatment rationale in the SOAP note, and clearly distinguish a tentative hypothesis from an established finding.
• Unneeded detail about other people. Describe a partner, parent or coworker only as far as it matters clinically. Avoid full names and identifying details of third parties where a role ("client's manager") will do.
• Sensitive detail that serves no clinical purpose. Specifics of sexual history, immigration status or past legal matters only when they bear on assessment, risk or the plan.
• Long verbatim transcripts. Quote the client briefly where their words matter. A full transcript is not a progress note.
• Identifiers you don't need. The record header already identifies the client. Leave Social Security numbers, card details and similar identifiers out of the note body.

HIPAA SOAP note checklist

1. Notes are protected wherever they are kept, including paper files and your own devices, and a Business Associate Agreement (BAA) is in place before any service provider creates, receives, maintains or transmits PHI on your behalf. Each business associate has BAAs with its own PHI-handling subcontractors.
2. Each person has their own login; access matches their role; shared devices lock automatically.
3. As a practical default, electronic records are encrypted at rest and in transit, including on laptops and phones; any exception is assessed and documented under the Security Rule.
4. Your system logs access and you review the logs periodically.
5. You maintain a written risk analysis and policies, update them as needed, and keep required documentation for at least six years from when it was created or last in effect, whichever is later.
6. Each SOAP note contains what is clinically necessary, written so the client could read it.
7. Any psychotherapy notes are kept separate from the client record.
8. Records sent to payers or billing services contain only the minimum necessary.
9. You have a process to answer client access requests on time.
10. Retention and destruction follow your state's rules and any payer contracts.
11. No PHI is pasted into consumer AI chatbots, personal email or note apps without a BAA.

Choosing an AI SOAP note tool

When an AI SOAP note service handles identifiable client audio, transcripts or summaries on behalf of a HIPAA-covered practice, it generally acts as a business associate. Before you enter PHI, check:

• A BAA, signed before any PHI. No BAA, no PHI. Check the BAA covers the plan you are on, not just an enterprise tier.
• No training on your content. The vendor should state that your recordings, transcripts and notes are not used to train or improve AI models, including by the AI providers it uses.
• Data retention and deletion. How long audio, transcripts and drafts are kept, and how you delete them.
• Subprocessors. Which providers transcribe and draft, and on what terms.
• Security basics. Encryption in transit and at rest, access controls and audit logging.
• Consent and review. Get your client's consent before recording and follow your state's recording-consent law. Review every draft against your own recollection before you sign it.

A free tool can still be used in a compliant way if it comes with a BAA. Our guide to free AI scribes with a BAA explains what to look for, and AI therapy notes covers the wider workflow.

Example: a de-identified SOAP note (fictional)

Fictional example written for this page. The client and every detail are invented; there is no real PHI here. It shows a level of detail that supports care and billing without unnecessary personal information.

Notice what is not there: unnecessary identifying details about the family member and the clinician's private reflections. The note includes enough about the conflict to explain its clinical relevance, the risk assessment and the plan. Separately kept psychotherapy notes are optional and do not replace the clinical record. For the format itself, see the SOAP notes guide.

How MentalNote fits

MentalNote drafts SOAP notes from a recorded session (with your client's consent) or, in the Word add-in, from a summary you type. MentalNote is HIPAA-compliant, with a BAA included on every plan, including the free plan; you accept it in the app before your first session.

• MentalNote does not use your recordings, transcripts or notes to train AI models.
• Notes are drafted by OpenAI under zero data retention, and OpenAI does not use MentalNote's API content to train its models.
• Audio is transcribed by AssemblyAI under a BAA. Once your transcript is saved, MentalNote deletes it from AssemblyAI, and AssemblyAI deletes the uploaded audio within its standard 24 to 48 hours.
• Data is encrypted in transit and at rest, and you can request deletion. Details are on the HIPAA, security and privacy pages.

You still review every draft, copy it into your record system and run your own HIPAA program. See how drafting works on the AI SOAP note generator page. The free plan includes 5 web-app scribe sessions a month with no credit card; Premium is $99/month or $990/year (pricing).