Twelve of Jordan's twenty-five clinicians are already using a free AI scribe. There is no BAA, no consent addendum, no policy, and the malpractice carrier's renewal questionnaire, due Friday, now asks directly about AI use. Jordan did not choose this vendor; the clinicians did, one free trial at a time, and now the practice's risk profile is being written by whoever has the best onboarding email sequence. This is how most practices meet the AI scribe landscape: not through procurement but through a quiet accumulation of undocumented individual decisions. By the end of this lesson you will be able to name the major behavioral health scribes (Mentalyc, Eleos Health, Upheal, Twofold, Heidi, and the EHR-native options), explain the four axes that actually separate them (BAA, zero data retention, 42 CFR Part 2 handling, EHR integration), and produce a one-page personal scoring matrix so the next vendor decision in your practice is yours, made on paper, before the trial starts.

Why You Need a Map Before You Need a Tool

Here is the controlling analogy for this lesson: choosing an AI scribe is like credentialing a new associate. You would never let a stranger sit in on your sessions because they offered to work for free. You would check their qualifications, ask who supervises them, find out where their notes go at night, and put the arrangement in writing before they ever heard a client's name. An AI scribe is, functionally, a stranger sitting in on your sessions. It hears the suicidal ideation disclosure at minute 46. It hears the custody dispute, the affair, the relapse. The only questions that matter are the credentialing questions: who is this vendor, what do they sign, what do they keep, and what happens to the transcript of the worst hour of your client's year.

The behavioral health scribe market in 2026 is loud, well-funded, and growing fast. Mentalyc has crossed 30,000 clinicians. Eleos Health's CalMHSA and Streamline enterprise deployment is live across the California public-sector behavioral health workforce, roughly 27,000 clinicians at full saturation. Upheal has become the default for high-volume telehealth caseloads. Heidi moved aggressively into behavioral health from primary care. Twofold is the quiet favorite of psychiatrists who want short, dense notes. TherapyNotes ships its own AI inside the EHR, SimplePractice embeds Blueprint Health for measurement-based care, and Therapy Brands has rolled native AI into the Medicaid-heavy clinic layer. Every one of these vendors publishes blog posts, webinars, and CE modules, and every one of those exists to sell that vendor's product. None runs a vendor-neutral certification. That is the gap this lesson fills.

One framing matters before any product name: the APA Practitioner Pulse Survey (2026 wave) reports that nearly one in three psychologists now use AI at least monthly, while the APA Code of Ethics revision committee has not yet shipped binding AI guidance, only a position paper and aspirational language. The adoption curve is ahead of the guidance curve, which makes the credentialing posture, skeptical, documented, written down before the trial, your professional obligation.

Why a Primary-Care Scribe Is the Wrong Resident for This Rotation

Before comparing behavioral health scribes to each other, understand why this category exists at all. A primary-care AI scribe is trained on a twelve-minute medication visit: chief complaint, history of present illness, exam, plan. A psychotherapy session is a 53-minute conversation that may surface a custody dispute, an abuse disclosure, or active suicidal ideation in the last seven minutes. The clinical structure differs (SOAP, DAP, BIRP, GIRP rather than an E/M template), the billing logic differs (90834 versus 90837 turns on documented time-in-session), and the legal exposure differs (the HIPAA psychotherapy notes carve-out, 42 CFR Part 2 for SUD records, state recording-consent law, mandated reporting).

This is why Heidi's move from primary care into behavioral health is worth watching with both interest and caution. A crossover vendor brings scale and polish but must prove it understands the therapy-specific failure modes: a note that flattens a trauma disclosure into "patient reports stress," a transcript that captures a third party's name in a couples session, a summary that confidently states a risk level the clinician never assigned. Evaluating any scribe means evaluating whether the product was built around the 53-minute hour or merely stretched to fit it.

And keep the regulatory bright line in view from lesson one of this chapter: under the Illinois WOPR Act (2025) and Nevada AB 406 (2025), AI cannot provide therapy or AI-delivered behavioral healthcare. Every product in this lesson lives on the documentation and administration side of that line. A scribe drafts the note after the session; it does not treat, assess, or decide. Any vendor whose marketing blurs that line has told you something important about how carefully they read the law that governs your license.

The Six Names You Will Hear at Consultation Group

Mentalyc is the volume leader among solo and small-group practices, past 30,000 clinicians per its 2026 product blog. Its pitch is therapy-native note generation across SOAP, DAP, BIRP, and GIRP from recordings, dictation, or typed shorthand. When colleagues search "best ai scribe for therapists," Mentalyc is usually the first result and often the first trial. That popularity is a data point about marketing reach, not a compliance finding; the questions you ask Mentalyc are the same four you ask everyone else.

Eleos Health is the enterprise and public-sector player. Its Polaris model and its CalMHSA / Streamline deployment across California county behavioral health, approaching 27,000 clinicians at full saturation, make it the largest single behavioral health AI deployment in the country. Eleos has expanded its agent suite across the care journey. If you work in a CMHC, CCBHC, or county system, the Eleos decision may already have been made above your head; your job is understanding the deployment, not choosing it. Upheal is the default for high-volume telehealth caseloads, and it is what Carmen, the AMFT in Fresno, pays for personally at $59 a month because her agency rate is $32 an hour and she cannot afford to donate two unpaid hours a night. Twofold is the psychiatrist's pick for short, dense medication-management notes. Heidi is the cross-over from primary care. And TherapyNotes AI represents the EHR-native category, AI that lives inside the system of record rather than bolting on beside it, a category the next lesson covers in depth alongside SimplePractice and Therapy Brands.

Notice what this paragraph did not do: it did not tell you which one is best. "Mentalyc vs Upheal" is one of the most-searched comparisons in this market, and the real answer is that the ranking depends on your practice's answers to four questions no marketing page leads with. Those four questions are the rest of this lesson.

Axis One: The BAA, the Document That Decides Whether You Are Compliant or Exposed

A Business Associate Agreement is the HIPAA contract that makes it legal for a vendor to touch protected health information on your behalf. No BAA, no PHI, full stop. The free tier of a general-purpose chatbot does not come with a BAA, which is why Maria, the solo LCSW in Oakland, closed the ChatGPT tab at 9:54 PM instead of pasting her C-PTSD client's session into it, and why Jordan's twelve clinicians on a free scribe are not running a productivity experiment; they are running an uninsured breach risk across three counties.

The credentialing questions on this axis are specific. Does the vendor sign a BAA at your tier, not just at the enterprise tier? Jordan's other discovery cuts here: the EHR vendor's subprocessor list included a model provider that does not sign a BAA at the tier Jordan was paying for. A BAA between you and the scribe means little if the scribe pipes your transcripts to an upstream model under terms that do not extend HIPAA's protections. So ask for the BAA before the trial, ask for the subprocessor list, and ask whether every subprocessor that touches PHI is itself under a BAA or equivalent contractual control. A vendor that hesitates on these questions has answered them.

One more distinction belongs on this axis: the HIPAA psychotherapy notes carve-out. Under 45 CFR 164.501, psychotherapy notes are the clinician's private process notes kept separate from the medical record, and under 45 CFR 164.508(a)(2) they get heightened authorization protection. Most scribes generate progress notes, the medical-record kind, not psychotherapy notes in the narrow legal sense. But if you dictate process reflections, countertransference observations, hypotheses you would never put in the chart, into a scribe, you have just routed your most protected category of writing through a vendor. Know which kind of note the tool is producing, and keep true psychotherapy notes out of any system you have not specifically vetted for them.

An AI scribe is a stranger you are inviting to sit in on every session. Credential it the way you would credential a new associate: qualifications checked, agreement signed, and you find out where the notes go at night before it ever hears a client's name.

Axis Two: Zero Data Retention, or Where the Transcript Sleeps

Zero data retention (ZDR) means the vendor processes your audio or text and then deletes it, retaining nothing that could leak, be subpoenaed, or be used to train a model. This is the axis vendors are vaguest about, so learn to read past the brochure. "We take privacy seriously" is not a retention policy. The questions that produce real answers: How long is session audio retained after the note is generated? How long is the transcript retained? Can I configure deletion, and is deletion actual deletion or a soft flag? Is my clients' data used to train or improve models, and is that opt-in, opt-out, or non-negotiable? What is retained if I cancel my subscription?

Why this matters clinically and not just technically: a retained transcript is a discoverable record. If a client's records are subpoenaed in a custody case, a retained verbatim transcript of fifty sessions is a very different exposure than a signed progress note. If the vendor is breached, retained audio of therapy sessions is among the most damaging PHI categories imaginable, and the HIPAA Breach Notification Rule's 60-day clock starts running toward your clients' mailboxes. Retention turns a documentation convenience into a standing archive of the most sensitive conversations your clients have ever had. The shorter the retention, the smaller the blast radius.

Retention also interacts with your record-keeping duties. Your board requires you to retain clinical records; the signed note in your EHR satisfies that. The vendor's transcript is not your record of care, and you do not want a parallel shadow record accumulating outside your control. The clean architecture: scribe processes, clinician verifies and signs in the EHR, scribe deletes. Score every vendor on how close their contractual behavior comes to that pattern, not on how reassuring their FAQ sounds.

Axis Three: 42 CFR Part 2, the Question That Sorts the Serious Vendors From the Rest

If your practice or program holds itself out as providing substance use disorder treatment, your SUD records fall under 42 CFR Part 2, a federal confidentiality regime stricter than HIPAA. The 2024 final rule aligned Part 2 more closely with HIPAA, including a single-consent option and revised redisclosure rules, but it did not make Part 2 disappear, and it did not make every HIPAA-compliant vendor automatically Part 2-appropriate. A vendor that signs a BAA has cleared the HIPAA bar; whether its consent flows, its redisclosure handling, and its data segmentation can support a Part 2 program is a separate, harder question.

Here is how to use this axis even if you never treat SUD: ask the question anyway, because the answer is a diagnostic for vendor seriousness. A vendor whose sales engineer can explain how their product handles Part 2 records under the 2024 final rule, how redisclosure prohibitions are honored, how a Part 2 client's transcript is segmented from non-Part 2 data, has done its behavioral health homework. A vendor whose answer is a blank pause or "we're fully HIPAA compliant" has just told you its compliance team thinks behavioral health is primary care with sadder clients. In Jordan's practice, two counties' contracts include SUD-adjacent services; the free scribe the twelve clinicians adopted has never published a word about Part 2. That alone should have ended the trial.

The practical scoring question: "Describe how your product supports a program subject to 42 CFR Part 2 under the 2024 final rule, including consent and redisclosure." Score the specificity of the answer, not the confidence of the delivery.

Axis Four: EHR Integration, or How Many Times the Note Gets Touched

The fourth axis is workflow: how does the draft note get from the scribe into your system of record? The spectrum runs from manual copy-paste (the scribe lives in a browser tab; you paste into SimplePractice or TherapyNotes by hand) through structured paste-back (the scribe formats output to match your EHR's note template) to native integration (the draft appears inside the EHR's note screen, as with TherapyNotes AI or SimplePractice's embedded tooling). Each step up removes a copy-paste, and every copy-paste removed is one less chance to paste Client A's note into Client B's chart at 10:40 PM, a transposition error that is mundane, common, and reportable.

But integration is not free. The more deeply a scribe integrates, the more your tool choice is coupled to your EHR choice, and the more important the EHR vendor's own subprocessor and retention story becomes; you inherit the compliance posture of everything in the chain. Integration also intersects with note version history, which becomes critical in a board audit: who drafted which sentence, when was it edited, when was it signed. The next lesson takes that question up in full. For now, score integration against your actual stack: a beautifully integrated scribe for an EHR you do not use scores zero.

And on every axis, the cardinal rule does not move: the clinician signs the note, and the signature is a legal attestation, not a formatting step. No integration depth, no vendor accuracy claim changes the requirement that you read every word of the AI-drafted note before you sign it. And no scribe on any axis scores the CSSRS, assigns a risk level, makes the Tarasoff duty-to-protect determination, or makes a mandated-report call; AI structures and transcribes after the clinician's determination. A vendor demo that implies otherwise is a vendor demo to walk out of.

Reading a Vendor Page Like an Auditor Reads a Note

Vendor marketing in this category follows a pattern, and once you see it you cannot unsee it. The demo client is always an "anxiety client" who never mentions suicidal ideation, abuse, custody, or substance use. The testimonial counts adopters, not audits survived. The compliance page says "HIPAA compliant" in a badge, a phrase with no certifying body behind it. The accuracy claim is a percentage with no denominator. Your default posture is the skepticism of someone whose license is the collateral: trust nothing that has not survived a board complaint or a payer audit, and convert every claim into a question the vendor must answer in writing.

Here is the translation table to carry into every demo. "HIPAA compliant" becomes: send me the BAA and subprocessor list. "Your data is secure" becomes: state your retention periods for audio, transcript, and notes, in days. "Built for therapists" becomes: show me how the product handles a session where SI emerges at minute 46, and show me that the draft note does not assign a risk level. "Seamless EHR integration" becomes: demonstrate paste-back into my EHR, and explain what your integration does to note version history. "Trusted by 30,000 clinicians" becomes: adoption is not adjudication; how many OCR inquiries, breach notifications, or board complaints has your product been part of? You will not always get answers. The refusals are data too, and they go in the matrix.

The Applied Problem: Your One-Page Personal Vendor Scoring Matrix

Your artifact from this lesson is the Personal Vendor Scoring Matrix, a one-page table you build before any trial and keep with your practice's compliance documents. Open a blank document. Across the top, six columns: Mentalyc, Eleos Health, Upheal, Twofold, Heidi, and your EHR's native AI (TherapyNotes AI, SimplePractice's tooling, or Therapy Brands' native layer, whichever applies to you). Down the side, the four axes as rows: BAA (signed at my tier? subprocessors covered?), Zero Data Retention (audio, transcript, and note retention in days; training opt-out?), 42 CFR Part 2 (specific 2024-final-rule answer, even if I do not treat SUD, as a seriousness test), and EHR Integration (manual paste, structured paste-back, or native, scored against my actual EHR). Add a fifth row for Practice Fit: caseload, modality, and price against your real hourly economics, the way Carmen weighed $59 a month against $32 an hour and two unpaid hours a night.

Score each cell 0 to 3. A 3 means the vendor answered in writing with specifics (a signed BAA at your tier, retention stated in days, a substantive Part 2 answer). A 2 means a credible verbal answer awaiting paper. A 1 means marketing language only. A 0 means refusal, silence, or "we're fully HIPAA compliant" as the complete answer. Use this exact request text with each vendor: "Before I begin a trial, please send: (1) your BAA as offered at the [tier name] tier, (2) your current subprocessor list and whether each subprocessor handling PHI is under a BAA, (3) your retention periods in days for session audio, transcripts, and generated notes, including whether client data is used for model training and how I opt out, and (4) a written description of how your product supports programs subject to 42 CFR Part 2 under the 2024 final rule."

The verification pass: for each cell scored 3, you must possess the document, not the memory of a sales call. File the BAA, the subprocessor list, and the retention statement alongside the matrix. Then write one sentence at the bottom of the page: your minimum acceptable score per axis (for most practices: no trial begins for any vendor scoring 0 or 1 on BAA or retention, regardless of how it scores elsewhere). Done looks like this: one page, six vendors, five rows, every number traceable to a document in your file, and a floor rule in writing. When a colleague at consultation group asks "which scribe should I get," you hand them a blank copy of the matrix instead of a brand name. That is what vendor-neutral competence looks like.

Key Takeaways

• The 2026 scribe landscape has six names you will keep hearing: Mentalyc (30,000+ clinicians, the solo-practice volume leader), Eleos Health (Polaris model, the CalMHSA public-sector deployment at roughly 27,000 clinicians), Upheal (telehealth default), Twofold (psychiatrists' pick for dense notes), Heidi (primary-care crossover), and EHR-native AI from TherapyNotes, SimplePractice, and Therapy Brands. Adoption numbers measure marketing reach, not compliance.
• Treat scribe selection like credentialing a new associate: the tool hears the suicidal ideation at minute 46, so the written agreement comes before it ever hears a client's name. A free tool with no BAA, like the one Jordan's twelve clinicians adopted, is an uninsured breach risk, not a productivity win.
• Four axes separate vendors: BAA (signed at your tier, subprocessors covered), zero data retention (stated in days for audio, transcript, and notes, with a training opt-out), 42 CFR Part 2 handling under the 2024 final rule (a seriousness test even for non-SUD practices), and EHR integration depth (which also shapes note version history in a board audit).
• A primary-care scribe trained on twelve-minute med visits is the wrong tool for a 53-minute psychotherapy session where abuse, custody, or active SI can surface in the last seven minutes; crossover vendors must prove they understand therapy-specific failure modes.
• The HIPAA psychotherapy notes carve-out (45 CFR 164.501 definition, 45 CFR 164.508(a)(2) protections) makes your private process notes your most protected writing; keep them out of any scribe you have not specifically vetted for them.
• The hard lines never move: under the Illinois WOPR Act and Nevada AB 406, AI does not provide therapy; AI never scores the CSSRS, never assigns a risk level, never makes the Tarasoff or mandated-report determination; and the clinician's signature is a legal attestation, which means reading every word before signing.
• Your artifact is the one-page Personal Vendor Scoring Matrix: six vendors, four compliance axes plus practice fit, scored 0-3 where a 3 requires a document in your file, with a written floor rule that no trial begins for any vendor scoring 0 or 1 on BAA or retention.