The Ethics of AI in Mental Health: What Every Practitioner Needs to Know

Why this matters now

For most of the history of psychotherapy, the ethical obligations were clear: protect client confidentiality, obtain informed consent, maintain competence, avoid dual relationships. The introduction of AI into clinical workflows does not erase those obligations, but it creates new ways to violate them, and new questions about where responsibility lies when things go wrong.

Until recently, most of the ethical discussion around AI in mental health was theoretical. That has changed. The Federal Trade Commission has levied an $7.8 million penalty against one of the largest mental health platforms in the country. Federal courts have allowed wrongful death suits against AI companies to proceed on product liability grounds. State legislatures in Utah and Illinois have enacted laws specifically governing AI in mental health contexts. And in June 2025, the American Psychological Association published its first substantive ethical guidance specifically addressing AI in clinical practice.

Practitioners who use any AI tool (for documentation, preparation, scheduling, or anything else connected to their clinical work) now have a professional obligation to understand what they are using and how it functions. This guide is designed to help with that.

The five core ethical obligations

A fifth obligation, equity and the avoidance of algorithmic bias, cuts across all of these. AI systems trained on data that underrepresents certain populations will produce output that reflects those gaps. This has documented implications for diagnostic accuracy, treatment recommendations, and risk assessment, particularly for clients from marginalized communities. Practitioners have an obligation to understand these limitations and not treat AI output as neutral or objective.

Informed consent: what the professional bodies require

Three major professional bodies have now issued guidance specifically addressing AI use in counseling and psychology practice.

The American Psychological Association published its Ethical Guidance for AI in the Professional Practice of Health Service Psychology in June 2025. It affirms that AI should augment, not replace, human clinical judgment, and that psychologists remain responsible for all final decisions. On consent, the guidance is clear: clients must be informed when AI tools are used in ways that affect their care, and they must have the right to decline.

The American Counseling Association and the National Board for Certified Counselors have both released parallel guidance. The NBCC's Ethical Principles for Artificial Intelligence in Counseling (April 2024) instructs counselors to explain to clients "the what, the how, the whens, and the whys" of any AI technology involved in their care, in plain, culturally appropriate language, with opt-out options provided.

The practical line these guidelines draw is this: using AI to help format or organize notes you have already written is a lower-stakes disclosure scenario. Using AI to identify treatment patterns, generate clinical recommendations, or inform diagnoses requires explicit informed consent, held to the same standard as any other significant clinical decision.

The legal landscape: what courts and regulators have decided

The ethical obligations above exist in professional codes. The following cases and regulatory actions show what happens when those obligations are ignored, and how courts are beginning to define legal accountability.

FTC v. BetterHelp (2023)

The BetterHelp case established a clear regulatory principle: mental health platforms are held to the privacy commitments they make to users, and the FTC is willing to act when those commitments are broken. The fact that the data was used for advertising rather than for any overtly harmful purpose did not reduce the severity of the violation; the FTC treated mental health data as a category warranting heightened protection.

The NEDA Tessa chatbot incident (2023)

The Tessa incident illustrates a failure that professionals using third-party AI tools must guard against: the tool in production is not always the tool that was evaluated. AI systems can be updated, retrained, or modified by vendors without explicit notification. Practitioners who use AI tools bear an ongoing obligation to monitor output: not just at adoption, but throughout use.

Garcia v. Character Technologies (2024–2026)

For practitioners, the Garcia ruling is significant because it signals that courts are willing to treat AI tools as products that can be defectively designed, not simply as neutral instruments that transmit information. It also reinforces that the populations most vulnerable to AI harm in mental health contexts (minors, people in crisis, those with severe disorders) will drive the most consequential litigation.

Raine v. OpenAI (filed 2025)

State legislation: Utah and Illinois

States are not waiting for federal law or landmark rulings to act. Utah's HB 452 (2025) mandates that AI-based mental health tools clearly disclose to users that they are interacting with AI, prohibits selling user data, and restricts certain marketing practices. Illinois' Therapy Resources Oversight Act (HB 1806), effective August 1, 2025, goes further: it explicitly protects consumers from unlicensed and unqualified providers (expressly including unregulated AI systems), ensuring that therapy services are delivered by licensed professionals. A 50-state legislative review published in JMIR Mental Health in 2025 documented increasing legislative activity across the country, with mental health as one of the most active domains for AI-specific regulation.

How we think about this at Cultivar

Cultivar is a pre-session briefing tool, not a documentation platform, not a treatment tool, and not a client-facing application. We have made deliberate choices about what the tool does and does not do, and those choices reflect the ethical framework above. We want to be explicit about how we approach this, not because we are above scrutiny, but because practitioners deserve to know exactly what they are using.

We do not store raw session notes. Notes submitted to Cultivar are processed transiently by the AI to extract a briefing card. The raw note is never written to storage. What is saved is only the structured briefing the practitioner has reviewed and approved. This means a breach of our systems would not expose clinical note content.

We require de-identification. Cultivar is not HIPAA compliant and is explicit about this. Users should not enter client names, dates of birth, or other identifying information, and are reminded of this within the tool. Client profiles use opaque identifiers chosen by the practitioner. Before any note is submitted to the AI, Cultivar runs a pattern-matching filter to detect common PHI signals and blocks submission if they are found, warning the practitioner to de-identify before proceeding.

The practitioner approves every briefing. Nothing is saved without the clinician's review. The AI produces a draft; the therapist reads it, edits it if needed, and approves it. This is not a formality; it is the mechanism by which the practitioner remains accountable for what is stored. AI output is a starting point, not a clinical record.

We are a memory aid, not a clinical decision tool. Cultivar surfaces what the therapist already noted: themes, mood, where things were left. The suggested intervention feature (available on the Solo plan) is grounded in the therapist's stated therapeutic orientation and the specific material in their own note. It is an informed prompt to the clinician's own judgment, not an autonomous recommendation from an outside system. The therapist brings the clinical context; the tool helps them hold it.

We do not interact with clients. Every AI input in Cultivar originates from the practitioner. Clients never interact with the system. This is a meaningful distinction from tools that provide AI-mediated client support; the ethical stakes and failure modes are different when the AI is in conversation with someone in distress.

A practical framework for evaluating any AI tool

When considering any AI tool for your practice, the following questions reflect the ethical and legal standards described in this guide.

• Does the tool store raw session content, and if so, where and for how long?
• Is the tool HIPAA compliant? Does it offer a Business Associate Agreement?
• If not HIPAA compliant, what limitations does it impose on what you can enter?
• Do you review and approve AI output before it is saved or acted upon?
• Does the tool interact directly with clients? If so, what safeguards exist for crisis situations?
• Does the vendor use your input data to train its models?
• How is the tool updated? Will you be notified of changes that affect its behavior?
• What happens to your data and your clients' data if you cancel?
• Does the tool's design account for algorithmic bias in its outputs?
• Have you disclosed your use of this tool to clients, and offered them the opportunity to opt out?

Where the field is heading

In October 2025, a coalition from academia, healthcare, and technology announced the formation of an AI in Mental Health Safety & Ethics Council to develop universal standards for AI use in mental health care. Licensing boards in multiple states are developing AI-specific competency requirements. Federal legislation addressing AI in healthcare has been proposed in multiple sessions of Congress, and the trajectory of state-level action suggests more mandates are coming.

The ethical obligations are not new; they are the same obligations practitioners have always carried. What AI changes is the surface area over which those obligations apply, and the speed at which a poorly understood tool can cause harm at scale. The practitioner who understands their tools, discloses their use, and maintains accountability for every decision those tools inform will be on solid ground, professionally and legally, as the field continues to evolve.