AI notes for therapists: keeping session audio on your own Mac

AI notes for therapists sound like an obvious win. Progress notes are the part of the job nobody trained you to love, and the pile grows with every session. An AI scribe promises to hand you a draft note minutes after the client leaves. The catch is buried in the architecture: most of these tools work by uploading the most sensitive audio that exists — a therapy session — to someone else’s servers.

This guide takes the privacy question first, then gets practical: what a SOAP note is, and a workflow where the recording, transcript, and draft note never leave your own computer. Full disclosure: we build Eidetic, the on-device tool described below. One naming note up front — this article is about AI-generated session notes, not to be confused with TherapyNotes, the EHR product.

This article is general information, not legal advice. HIPAA compliance is a property of your practice — its policies, safeguards, and agreements — not a badge a product can carry. There is no such thing as “HIPAA-certified” software. Talk to your compliance advisor before changing how you handle session data.

Why therapists hesitate on AI scribes

A session recording is not like a sales call recording. It can contain diagnoses, trauma history, substance use, relationships, names of third parties — everything a client trusts you to protect. Three concerns come up again and again:

• A vendor processes PHI. When a cloud scribe transcribes your session, the vendor receives protected health information on your behalf. Under HIPAA that makes them a business associate, which means a signed business associate agreement (BAA) before any audio flows.
• Breach exposure. Every server that holds session audio or transcripts is a server that can be breached, subpoenaed, or misconfigured. If your vendor has an incident, the notification problem lands on your practice.
• Client trust.“I record our sessions and software on my computer helps me write notes” is a very different disclosure from “your session is uploaded to a company’s cloud.” Some clients will decline the second and accept the first.

The architecture question: cloud scribe vs on-device

Searches for HIPAA-compliant transcription software usually assume the cloud model is the only one. It isn’t. There are two fundamentally different architectures, and they change which questions you even have to ask:

• Cloud AI scribe. Audio is uploaded, transcribed, and summarised on the vendor’s servers. The vendor touches PHI, so you need a BAA, and you pay a subscription for as long as you practice.
• On-device AI. The audio is captured and transcribed on your own computer. There is no transcription vendor receiving PHI, which removes that BAA relationship entirely — though your own obligations (device encryption, access controls, consent) remain. Talk to your compliance advisor about your specific setup.

The mechanics of local capture are the same ones we described for regular meetings in how to get AI notes without a bot joining your call: the Mac records your microphone and system audio directly, so both telehealth and in-room sessions are covered without anything joining a call.

What a SOAP note looks like

SOAP is the most common progress-note structure in behavioral health: four short sections that move from what the client said to what you plan to do. A minimal example:

• S — Subjective. Client reported increased anxiety around work deadlines; described sleep as “four or five broken hours.”
• O — Objective. Client appeared alert but fatigued; speech rapid when discussing workload; affect congruent with content.
• A — Assessment. Presentation consistent with treatment goals around generalized anxiety; coping strategies from prior sessions applied partially.
• P — Plan. Continue weekly sessions; practice sleep-hygiene protocol; revisit workload boundaries next session.

The structure is exactly why AI SOAP notes for therapists work well as drafts. The Subjective and Objective sections are largely a faithful restructuring of what was said and observed — which a transcript supports directly. Assessment and Plan are clinical judgment, and those sections should always be yours after review.

A private workflow with Eidetic, step by step

Eidetic is a menu-bar app for Apple-silicon Macs that records, transcribes, and summarises entirely on-device. Nothing is uploaded — it works offline after the initial model download. Here is how a session-notes workflow looks:

• 1. Get explicit written consent first. Every client, every recording. Recording-consent laws vary by state and country — some require all parties to agree — and consent to therapy is never consent to recording. Document it.
• 2. Record the session. For telehealth, Eidetic captures your microphone and the Mac’s system audio, so both sides of a Zoom, Meet, or any other call are recorded without a bot joining. For in-room sessions, the microphone picks up the conversation.
• 3. Transcription runs on your Mac. The transcript appears live beside any notes you type during the session, and the audio never touches a server.
• 4. Ask the built-in chat for a SOAP draft. The local chat can draft a SOAP note from the session transcript — prompt it with your preferred structure. The model runs on your machine, so the transcript stays there too.
• 5. Review and edit. Correct the Subjective section, and write the Assessment and Plan with your own judgment. The AI produces a first draft, not a clinical record.
• 6. Store, export, delete. The finished note lives in Eidetic’s local library, or you can export to Obsidian if that is where your notes live. Once the note is finalised, deleting the audio recording is good data minimization.

Pricing is deliberately simple: the first 6 sessions are free to try, then it’s a €49 one-time purchase for 3 Macs. Unlike every cloud meeting service, there is no subscription attached to your documentation workflow.

The honest limits: Eidetic is macOS-only and needs Apple silicon (M1 or newer). It is a recorder and notes tool, not an EHR — there is no scheduling, billing, or claims. It is single-user, with no shared team library. And the local transcription struggles with sentences that mix two languages, which matters if your sessions code-switch mid-sentence. The same on-device approach also works for research and intake interviews — see how to transcribe interviews.

Consent, ethics, and data minimization

A private architecture does not replace an ethical process. A few practices worth adopting regardless of which tool you choose:

• Consent every time, in writing. Not a blanket line in the intake packet. Clients should know what is recorded, where it is processed, and how long it is kept — and laws on recording consent vary by jurisdiction, so confirm what applies to you.
• The right to decline. A client who says no to recording should get the same care with manual notes, and should know that declining costs them nothing.
• Delete audio after the note is written. The recording is a means to a note, not an archive. Keeping the minimum data for the minimum time shrinks what any breach — even of your own laptop — could expose.
• Protect the device itself. On-device processing moves the responsibility to your Mac: full-disk encryption, a strong password, and a locked screen are the baseline.

FAQ

How do I write therapy notes faster?

Three habits compound: use one consistent structure (SOAP or DAP) so you never face a blank page, write within 24 hours while the session is fresh, and edit a draft instead of composing from scratch. An AI draft generated from the session transcript turns note writing into note reviewing — typically a few minutes instead of fifteen or twenty.

Is there a HIPAA-compliant AI transcription?

Honestly reframed: no software is HIPAA-compliant on its own. Compliance describes your practice — its safeguards, policies, and agreements. A cloud transcription service can support compliance if it signs a BAA and you use it correctly. An on-device tool changes the question: when session audio and transcripts never reach a vendor, there is no transcription vendor handling PHI in the first place. Either way, the determination belongs to your compliance advisor, not a marketing page.

Do I need a BAA for an on-device note tool?

BAAs exist for vendors that create, receive, maintain, or transmit PHI on your behalf. With on-device processing the software vendor never receives session audio or transcripts, so per HHS guidance the BAA question changes — as of mid-2026, the obligation follows PHI access, not software installation. That said, your device security and consent obligations remain fully yours, and this is exactly the kind of question to confirm with counsel.

Can AI write SOAP notes?

It can draft them well, especially the Subjective and Objective sections, which restate what was said and observed. It cannot make clinical judgments: the Assessment and Plan need your review and your edits before anything enters the record. Treat every AI note as a first draft that you sign off on — the clinical responsibility never transfers to the software.