Jordan's renewal packet from CPH & Associates arrived with a question that did not exist on last year's form: does the practice use AI documentation tools, and if so, what review and consent controls are in place? It is due Friday, and the honest answer involves twelve clinicians, two supervisors, and a policy that is three weeks old. The question is not a formality. It is the leading edge of how liability for AI-assisted clinical work is being priced, allocated, and litigated, and the practice owner who cannot answer it crisply is also the owner who cannot answer a plaintiff's attorney, a state board investigator, or a court applying vicarious liability doctrine to a supervisee's note. This lesson walks the three scenarios that organize the entire liability landscape, clinician error AI-assisted, clinician error AI-flagged, and AI error clinician missed, and traces each one through the malpractice carrier, the licensing board, and the practice owner's exposure. By the end you will have a Three-Scenario Liability Memo mapped to your carrier's questionnaire: the document that makes Friday's deadline an exercise instead of an emergency.

One Event, Three Investigations

The controlling analogy for this lesson comes from aviation. When a plane goes down, three separate investigations open, and they are asking three different questions. The safety board asks what happened and how the system failed. The regulator asks whether anyone's certificate should be acted against. The insurer asks who pays and whether the policy covers it. The investigations share facts but not purposes, and a pilot who confuses them, who treats the insurer's adjuster like the safety board, or the regulator like a sympathetic colleague, makes every one of them worse. The same triple structure governs a bad outcome in a behavioral health practice that uses AI. The malpractice claim asks whether the clinician breached the standard of care and caused damages: a civil question about money. The board complaint asks whether the license holder violated the practice act: a regulatory question about fitness to practice, where the burden, the procedure, and the stakes are entirely different. And the practice-level question asks whether the owner is vicariously liable for the clinician's conduct and directly liable for the systems the practice did or did not build. One signed note can feed all three, and the documents this chapter has built, the risk register, the incident runbook, the supervision addendum, are the practice's evidence in every one of them.

Hold onto the most important orientation fact in this lesson: AI does not appear as a defendant in any of these proceedings in any useful sense. The clinician signed the note; the signature is a legal attestation, not a formatting step. The vendor's terms of service were engineered by capable lawyers to push clinical responsibility back onto the licensed professional, and the board's jurisdiction runs to license holders, not language models. Whatever the AI did, the questions in all three rooms reduce to what the human did: what the clinician verified, what the supervisor reviewed, what the owner built. That is not a reason for despair. It is the reason the chapter's artifacts work: every one of them is a record of what the humans did.

Scenario One: Clinician Error, AI-Assisted

In the first scenario, the clinician makes a clinical error and AI was somewhere in the workflow. A clinician misjudges a client's risk, the client is harmed, and the chart shows the notes were drafted with an AI scribe. Here is the legal center of gravity: the standard of care is the standard of care, with or without AI. The clinician who would have been negligent dictating into a recorder is equally negligent dictating into a scribe, and using AI does not raise the bar of what is expected, but it does not lower it either. What AI changes is the evidentiary texture. The plaintiff's attorney will mine the AI dimension for aggravating color: did the clinician sign without reading, does the note contain templated language inconsistent with the session, did the practice disclose AI use to the client, was there a BAA. None of those facts is the negligence itself, but each one shapes how a jury hears the story, and "the therapist let a machine write the record and signed it unread" is a story no defense counsel wants to fight.

The carrier's interest in this scenario explains the questionnaire change. CPH & Associates, HPSO, The Trust, and American Professional Agency all revised their 2025-2026 renewal questionnaires to ask directly about AI scribe use, and the reason is underwriting, not curiosity: the carrier is pricing exactly the aggravating-color risk described above. A practice that answers "yes, with a written policy, client consent addenda, BAAs on file, and a verification requirement before signature" presents a different risk than a practice that answers "yes" with nothing behind it, and a materially false answer is its own catastrophe, because misrepresentation on an application is the classic route to a coverage fight at the worst possible moment. Answer the questionnaire the way you would answer a deposition: accurately, completely, and with the documents already in hand. The board's interest in scenario one is narrower but sharper: was the clinical judgment competent, and does the record show the clinician, not the tool, exercised it. A chart where the risk assessment is demonstrably the clinician's own documented determination survives this; a chart where the assessment language reads machine-generated invites the question that ends careers.

Scenario Two: Clinician Error, AI-Flagged

The second scenario is the one nobody anticipated until the tools matured: the clinician errs, and the AI flagged it. The scribe's draft surfaced a client statement about stockpiling medication; the clinician deleted the line as clutter and the note went out without a risk update. Or a documentation tool's review pass flagged that the safety plan was never updated after a reported escalation, and the flag was dismissed. Discovery will find the flag. Drafts, prompts, tool logs, and version histories are increasingly preserved and increasingly discoverable, and a plaintiff's expert will frame the deleted flag as the moment the clinician was warned and chose not to act. This is the scenario that turns an ordinary negligence case into one with a documented warning in it, and it deserves to reshape how clinicians treat AI output they disagree with.

The discipline that survives scenario two is not "defer to the machine," which would violate everything this program teaches. It is "document the disagreement." The clinician remains the only party who makes clinical determinations: AI never scores the CSSRS, never assigns a risk level, never makes the duty-to-protect or mandated-report call, and a flag is not a determination, it is an input. But an input the clinician overrides should be overridden visibly: a sentence in the note or the supervision log recording that the flagged content was evaluated and why the clinical judgment differed. "Client's statement about medication reviewed in session; clinician assessed context as hyperbole consistent with longstanding expressive style; risk assessment completed, no change in level; plan unchanged" is a clinician exercising judgment on the record. Silent deletion is a clinician who will spend a deposition explaining an absence. The supervision parallel is exact: when an associate dismisses an AI flag, the supervisor's review duty from the previous lesson is the mechanism that catches it, and the supervision log is where the override reasoning lives.

In the liability record, the question is never what the AI knew. It is what the clinician did with what the record shows the clinician saw.

Scenario Three: AI Error, Clinician Missed

The third scenario is the inverse and the most common in practice: the AI got it wrong and the clinician failed to catch it. The hallucinated instrument score from the incident-response lesson, the softened risk language, the wrong-client paragraph, signed into the record by a clinician who skimmed. Legally, this scenario collapses into clinician error faster than most clinicians expect, because the signature converts the AI's mistake into the clinician's attestation. The defense theory "the AI inserted it" is an admission, not an excuse: it concedes the clinician signed content they did not verify, which is the breach. Vendors' terms of service reinforce the collapse, disclaiming clinical reliability and designating the professional as the final reviewer, so the contractual paper trail points the same direction as the professional duty. There may be circumstances in which a practice or vendor fight emerges over a tool's defect, but no clinician should plan their defense around winning it; the realistic posture is that the clinician owns whatever the clinician signs.

The protective discipline is the one this program has repeated since its first documentation lesson, now with its full legal weight visible: read every word before signing, because the signature is a legal attestation. The verification pass is not a quality habit; in scenario three it is the entire difference between a near miss and a malpractice exhibit. For the board, scenario three raises the competence question in its modern form: a license holder is expected to use tools competently, and signing unverified machine output is not competent use. For the carrier, scenario three is the precise loss profile the new questionnaire is designed to detect, which is why the questionnaire asks not just whether the practice uses AI but what review controls stand between the draft and the signature. And for the owner, scenario three is where vicarious exposure concentrates, because the question "why did your clinician sign that?" is followed immediately by "what did your practice require before signing?"

The Owner, Vicarious Liability, and the Supervisor's Special Exposure

The practice owner stands behind every scenario through two doors. The first is vicarious liability: the practice answers for the conduct of its clinicians acting within the scope of their work, which means a clinician's scenario-three signature is also the practice's problem, in litigation and in settlement value. The second door is direct liability for the practice's own decisions: negligent failure to have an AI policy, to vet vendors, to obtain BAAs, to train the verification discipline, to run the incident response this chapter built. The plaintiff's theory writes itself against an ungoverned practice: the owner deployed (or tolerated) AI tools across a clinical workforce with no policy, no consent process, and no review requirement, and the harm was foreseeable. The chapter's artifacts are the rebuttal: the risk register shows foresight, the runbook shows response capability, the supervision addendum shows the oversight chain, and together they convert "the owner never looked" into "the owner built a system."

The supervisor's exposure deserves its own sentence because it compounds: a supervisor answers to the board for the supervision itself, and the previous lesson's addendum is the control, but in litigation the supervisor can also appear as the practice's agent whose review duty was the last system control before the harm. The supervisor's logged review cycles are simultaneously board evidence and civil evidence. And the owner should notice the insurance architecture beneath all of this: the clinician's individual policy, the practice's entity coverage, and the supervisor's exposure need to fit together without gaps, which is a renewal-season conversation to have with the carrier on purpose rather than discover during a claim. When the carrier's questionnaire asks about AI, it is also implicitly asking whether the entity, the individuals, and the supervision chain are insured as the same coherent story the practice's documents tell.

The Carriers and the 2025-2026 Questionnaire: Answering as Underwriting, Not Confession

Treat the renewal questionnaire as the carrier teaching you what it fears. The 2025-2026 changes across CPH & Associates, HPSO, The Trust, and American Professional Agency converge on a small set of questions: whether AI tools are used in documentation or other clinical-adjacent work, whether clients are informed and consent is documented, whether business associate agreements are in place, whether a written policy governs use, and whether human review occurs before records are finalized. Read that list again and notice what it is: a compressed audit of this entire program. Every question maps to an artifact a well-governed practice already has, the consent addendum, the BAA file, the AI policy, the verification requirement, the supervision addendum, and the practice that built them answers the questionnaire by attaching what exists.

Three disciplines for the answering itself. First, accuracy over optimism: answer what is true on the date of the application, not what will be true after Friday's policy rollout, because misrepresentation risks the coverage itself, and a denied claim over an inaccurate application is a worse outcome than a higher premium. Second, completeness with documents: where the form allows attachments or explanations, attach the policy and the register summary rather than bare yes/no answers, because underwriters price uncertainty and documents reduce it. Third, continuity: the questionnaire answers, the risk register, the incident runbook, and the supervision addenda must tell one consistent story, because in a claim the carrier's coverage counsel will read all of them together, and inconsistency between what the practice told its insurer and what its documents show is a gift to everyone adverse to you. Renewal season is also the moment to ask the carrier the reciprocal questions: how the policy treats AI-assisted documentation claims, whether any exclusions or endorsements touch AI use, and what the carrier's risk-management resources (the same carriers run risk-management webinars precisely on this) recommend, so the practice's controls and the policy's expectations stay aligned.

The Applied Problem: Write Your Three-Scenario Liability Memo Mapped to the Carrier Questionnaire

Your artifact is the Three-Scenario Liability Memo, two to three pages, addressed from the practice owner (or the solo clinician to herself, which is not a joke; Maria's version of this memo is how a solo practice thinks clearly) to the leadership team, and built in four sections. Section one: the three scenarios, each in one paragraph, stated in the practice's own facts: who the clinicians are, which tools are deployed, what a scenario-one, scenario-two, and scenario-three event would concretely look like here. Section two: the three-investigation map for each scenario, one line each for the carrier question (what the claim looks like and which policy responds), the board question (which license is examined, including the supervisor's), and the owner question (vicarious exposure plus the direct-liability theory a plaintiff would plead). Section three: the control that answers each scenario, named as the existing artifact: the verification-before-signature requirement and consent stack for scenario one, the documented-override discipline and supervision review for scenario two, the read-every-word attestation plus the incident runbook for scenario three.

Section four is the questionnaire map: take your actual carrier's renewal questionnaire, CPH & Associates, HPSO, The Trust, or American Professional Agency, list each AI-related question, and write next to it the document that answers it and where that document lives. If a question has no document, that row is a finding, and it goes to the risk register as a mitigation with an owner and a deadline before the renewal date. You may use AI to format the memo from your notes; the prompt: "Organize the following into a liability memo with four sections: scenarios in practice-specific terms, the carrier/board/owner map per scenario, the named control per scenario, and a questionnaire-to-document table. Do not add legal conclusions, carrier names, or controls I have not provided, and flag any questionnaire row with no answering document." The verification pass: every scenario is written in your facts, not generic ones; the scenario-two section contains the documented-override language; the scenario-three section states that the signature converts AI error into the clinician's attestation; every questionnaire row either names a document or names a deadline. "Done" is the memo reviewed with the leadership team (or, solo, read once aloud, which finds what skimming misses), the questionnaire answered from it with attachments, and the memo filed beside the register, the runbook, and the addenda as the fourth corner of the governance binder this chapter built.

Key Takeaways

• One clinical event opens three investigations asking three different questions: the malpractice claim (standard of care and damages, the carrier's money question), the board complaint (fitness to practice, the license question, on different procedure and stakes), and the practice-level question of the owner's vicarious and direct liability. The chapter's artifacts, register, runbook, supervision addendum, are the practice's evidence in all three rooms.
• AI is never usefully the defendant: vendor terms push clinical responsibility onto the licensed professional, boards regulate license holders, and every question reduces to what the humans did. The clinician signs the note, and the signature is a legal attestation, not a formatting step.
• Scenario one (clinician error, AI-assisted): the standard of care is unchanged by AI, but the AI dimension supplies aggravating color, unread signatures, templated language, missing consent, missing BAAs, that shapes how a jury hears the case and how an underwriter prices it.
• Scenario two (clinician error, AI-flagged): drafts, flags, and tool logs are discoverable, and a silently dismissed flag becomes a documented warning. The discipline is never deference to the machine, it is the documented override: the clinician evaluates the flagged content, makes their own determination (AI never scores risk or makes duty-to-protect and mandated-report calls), and records why their judgment differed.
• Scenario three (AI error, clinician missed) collapses into clinician error because the signature converts the tool's mistake into the clinician's attestation; "the AI inserted it" is an admission of signing unverified content, not a defense. Read every word before signing is the whole distance between a near miss and a malpractice exhibit.
• The owner is exposed through vicarious liability for clinicians' conduct and direct liability for ungoverned systems; the supervisor compounds board accountability for supervision with civil exposure as the last system control. The register, runbook, and addendum convert "the owner never looked" into "the owner built a system."
• CPH & Associates, HPSO, The Trust, and American Professional Agency all added direct AI-use questions to their 2025-2026 renewal questionnaires: answer accurately as of the application date (misrepresentation risks the coverage itself), attach the documents that exist, keep the questionnaire consistent with the register and runbook, and treat any question with no answering document as a register finding with a deadline before renewal.