A therapist in private practice can dictate a progress note on a Mac, with free Apple Dictation or a dedicated app, after the session and straight into the practice's record system. No dictation app makes that HIPAA compliant: a compliance decision belongs to your organisation (in a solo practice, you). HIPAA gives psychotherapy notes extra protection, and any vendor that receives client information in a cloud step normally needs a business associate agreement (BAA) first.
This page is general information, not legal or clinical advice.
Publisher note: SuprFlow publishes this guide and is one of the products discussed. Competitor details come from each company's own pages, checked on 1 October 2026. Prices and features change; confirm before you buy.
What does HIPAA treat specially about psychotherapy notes?
The HIPAA Privacy Rule separates two kinds of record a therapist writes.
Psychotherapy notes. 45 CFR 164.501 defines them as notes "recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record."
Everything else in the record. The same definition excludes "medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date." Those items belong to the ordinary clinical record, which is where most progress notes live.
The extra protection is in 45 CFR 164.508(a)(2): "a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes," with narrow exceptions, such as use "by the originator of the psychotherapy notes for treatment."
- Separation is part of the definition. Notes only count as psychotherapy notes if they are kept apart from the rest of the record. The American Psychiatric Association's resource document on the psychotherapy notes provision (approved 2002) describes notes "kept separately from the rest of the record and not disclosed to anyone," and tells psychiatrists to consider "the security of the record, and relevant state law."
- A dictation step can undermine that separation. If a dictation tool keeps a history, or a cloud service receives the text, a copy of your most protected notes sits outside the separate file. Decide which kind of note you are dictating before you speak.
Is a dictation app the same as an AI scribe?
No. They do different jobs.
| Tool | What it does | Main question for the practice |
|---|---|---|
| AI scribe or ambient assistant | Listens to the session itself and drafts a note | Client consent to recording, the vendor's BAA, and where session audio is kept |
| Dictation app | Types what you say, after the session, into the field your cursor is in | Where your dictated audio and text are processed and stored |
| Practice record system | Holds the official record | Access controls, separation of psychotherapy notes, retention |
A general dictation app does not hear the session, does not know what a treatment plan is and does not produce a structured note. You speak the note yourself, so you control what is written and you check every word.
If you are considering any tool that records sessions, the American Psychological Association's Ethics Code, Standard 4.03, says: "Before recording the voices or images of individuals to whom they provide services, psychologists obtain permission from all such persons or their legal representatives." Your own licensing body's code may say more.
Where do the words go when you dictate?
Follow the path of one note:
- Your voice reaches the Mac's microphone. Anyone in the room or next door can hear it too.
- Speech recognition turns audio into text, either on the Mac or on a company's servers. Apple's Dictation guide (macOS 27 edition) says Keyboard settings show whether general text dictation is "processed on your device and not sent to Siri servers."
- Optional AI cleanup may send the text to another service.
- The text lands in whichever app has focus, ideally your record system.
- Copies may remain in the dictation app's history, the clipboard and backups.
Any company that receives client information at step 2 or 3 is a candidate business associate. 45 CFR 160.103 defines one as a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information." The Centers for Medicare & Medicaid Services says the covered entity "must have a written business associate contract or other arrangement with the business associate." CMS also says providers who submit HIPAA transactions, like claims, electronically are covered.
A safe routine for dictating progress notes
- Get the decision first. Write down which tool, settings and kind of note are allowed. Ask any vendor with a cloud step whether it will sign a BAA.
- Never dictate with a client present unless they have agreed. Dictate after the session, door closed.
- Test with a fictional client. Dictate a made-up note, for example: "Client J. Test, session 4. Reports sleep improved. Denies suicidal ideation. Plan: continue weekly CBT." Check the negation, the abbreviation and where the text landed.
- Dictate straight into the note field of your record system. Avoid drafting in email, messaging apps or general notes apps that sync elsewhere.
- Keep identifiers to a minimum while speaking. The record system already knows who the client is.
- Read every line before you sign. Dictation errors are real words in the wrong place. "Denies" heard as "describes" changes a risk statement.
- Clear the extra copies your policy says to remove: dictation history, clipboard history, scratch documents. The APA Ethics Code, Standard 6.02(a), asks psychologists to "maintain confidentiality in creating, storing, accessing, transferring, and disposing of records under their control."
Where does SuprFlow fit, and where does it not?
SuprFlow is a general Mac dictation app, not clinical software. It holds no certification of any kind, has no BAA to offer, has no integration with any electronic health record (EHR) and makes no promise about clinical or medical vocabulary.
What it does: on an Apple Silicon Mac with macOS 14 or later, you hold the Fn key, speak, release, and the text is pasted at your cursor. Speech recognition runs on the Mac with a downloaded model. Default formatting is local cleanup of punctuation, capitalization and numbers. Its optional Cloud API formatting sends the transcript text, not the audio, to the provider you configure; leave it off for client information unless your practice has a BAA with that provider. It keeps a local history of up to 100 recent transcriptions, another copy to manage, and uses the network for licence checks, updates, model downloads and usage telemetry; Where does my dictation go? lists them. It costs $125 once, with no free tier or trial.
If you want an ambient scribe, SuprFlow is the wrong product. If you want a cloud dictation service that offers a BAA, Is Wispr Flow safe? covers what Wispr documents. If Apple Dictation is acceptable and accurate enough, it costs nothing.
Questions people ask
Is SuprFlow HIPAA compliant?
SuprFlow makes no such claim. It has no BAA and no certification. Recognising speech on the Mac reduces what leaves the device, but compliance depends on the whole workflow.
Can I dictate psychotherapy notes into my EHR?
Only if the EHR keeps them separate from the rest of the record, as the definition requires. Ask your EHR vendor how it stores psychotherapy notes, and keep dictation-app copies out of the picture.
Can I record a session and transcribe it later?
Only with the client's permission, and with a tool your practice has approved for session audio. A live dictation app does not transcribe recorded files; see How to transcribe a voice memo on a Mac for that different job.
Is Apple Dictation safe for therapy notes?
Check the processing notice under System Settings → Keyboard → Dictation on the actual Mac, and whether Share Audio Recordings was chosen when Dictation was turned on.
Related guides
- Medical dictation on a Mac and HIPAA
- Is Wispr Flow safe?
- Where does my dictation go?
- Is Mac Dictation private?
- Local vs cloud formatting
- Delete SuprFlow transcription history
Sources
- U.S. Government Publishing Office — 45 CFR 164.501, Definitions (1 October 2024 edition)
- U.S. Government Publishing Office — 45 CFR 164.508, Uses and disclosures for which an authorization is required (1 October 2024 edition)
- U.S. Government Publishing Office — 45 CFR 160.103, Definitions (1 October 2024 edition)
- Centers for Medicare & Medicaid Services — Are You a Covered Entity?
- American Psychiatric Association — Resource Document on Psychotherapy Notes Provision of the HIPAA Privacy Rule
- American Psychological Association — Ethical Principles of Psychologists and Code of Conduct (with 2010 and 2016 amendments)
- Apple — Dictate messages and documents on Mac