Resources / Regulation Maps / Healthcare & Life Sciences
Regulation MapsHealthcare & Life SciencesBehavioral Health Centers
AI Regulation Map for Behavioral Health Centers
The federal and state rules that govern AI in behavioral health, from HIPAA and 42 CFR Part 2 to state AI therapy laws, and what each one requires.
The short answer
Behavioral health centers using AI face some of the strictest rules in health care. HIPAA governs any AI tool that touches protected health information, 42 CFR Part 2 adds protections for substance use disorder records, and several states now restrict AI in therapy or require disclosures for mental health chatbots. AI can support documentation and administration, but clinical judgment and therapy must stay with licensed professionals.
Rules at a glance
| Rule | What it covers | What it means for AI |
|---|---|---|
| HIPAA Privacy and Security Rules | Protected health information held by covered entities and business associates | AI vendors that handle patient information need a business associate agreement and a place in your security risk analysis. |
| 42 CFR Part 2 | Records of federally assisted substance use disorder programs | AI tools may not use or disclose these records beyond what Part 2 permits, including for training. |
| State AI therapy laws | AI providing therapy or mental health services | Illinois and Nevada restrict AI in therapy and mental health care, and Utah regulates mental health chatbots. |
| FTC Act Section 5 | Unfair or deceptive practices | Claims about what an AI tool can do for patients must be accurate and supported. |
| State automated decision rules | Consequential decisions, which can include health care | Colorado’s and California’s rules taking effect January 1, 2027 may apply to AI that affects access to care. |
Where AI is lowest and highest risk
- Lower risk: scheduling, billing support, and drafting administrative documents without patient information
- Moderate risk: clinical note drafting and summaries, with clinician review and a business associate agreement
- Highest risk: AI that interacts with patients about their mental health, screens for risk, or influences treatment decisions
What to do now
- Inventory every AI tool, including AI features in your electronic health record and practice management systems
- Confirm business associate agreements and Part 2 terms with every AI vendor that touches patient records
- Write an AI use policy that keeps therapy and clinical decisions with licensed professionals
- Check the AI therapy and chatbot rules in each state where you serve patients
Frequently asked questions
Can a behavioral health center use AI to draft clinical notes?
Yes, with safeguards: a business associate agreement with the vendor, patient information handled under HIPAA and Part 2, and clinician review of every note before it enters the record. Some states also require patient notice or consent for AI documentation tools.
Are AI mental health chatbots allowed?
It depends on the state. Several states now restrict AI that provides therapy or require clear disclosures that a patient is talking to AI. Check the rules in every state where your patients are located before launching one.
More Guides for Behavioral Health Centers
Sources
- HIPAA Privacy, Security, and Breach Notification Rules, 45 CFR Parts 160 and 164
- Confidentiality of Substance Use Disorder Patient Records, 42 CFR Part 2
- Federal Trade Commission Act, 15 U.S.C. 45
- Illinois Wellness and Oversight for Psychological Resources Act (2025)
- Nevada AB 406 (2025)
- Colorado SB 26-189 (2026)
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). AI Regulation Map for Behavioral Health Centers. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-regulation-map-behavioral-health
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
HIPAA Security Risk Analysis
The security risk analysis HIPAA requires, covering every system that holds health information, including AI tools.
AI Acceptable Use Policy
A clear, written policy that tells your people which AI tools they can use, for what work, and with what data.
AI Assurance Test
Our most thorough test: an AI system run against 100 or more realistic scenarios, with a signed assurance letter.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.