Build Your Therapy Practice SOPs With AI—Then Put a Human in Charge

Quick answer: NIST defines generative-AI “confabulation” as confidently presented erroneous or false content (published July 26, 2024; updated April 8, 2026). AI can organize a therapy practice SOP, but a named human should verify every instruction, release the document, and keep it current. Use approved, non-PHI sources, test the procedure, preserve version history, and send legal, clinical, licensing, and contract questions to the appropriate reviewer.

A small practice needs accessible procedures when intake stalls, a records request crosses state lines, or a security incident needs an owner. AI can speed drafting, but people must decide.

Draw the boundary before you draft

An AI tool can turn an approved outline into numbered steps, standardize headings, or identify a missing handoff. It should not decide what is legally required, clinically appropriate, contractually allowed, or correct for a license.

Fluent text can conceal an unsupported answer. The NIST AI Resource Center supports testing, evaluation, verification, and validation instead of treating generated output as authoritative. Use this posture: draft, inspect, test, approve.

HHS says it does not certify people or products under the Privacy Rule. An AI-written policy and vendor label cannot replace the practice’s review.

Give every SOP a control card

Use a control card. This operational design recommendation—not a statutory checklist—answers questions that prose can bury:

1. Owner: Who is responsible for accuracy and maintenance?
2. Approver: Who has authority to release the SOP?
3. Version and effective date: Which instructions apply, and when did they begin?
4. Review date: When will a human reassess the document?
5. Trigger: What event starts the procedure?
6. Numbered procedure: Which role performs each observable step?
7. Exceptions and escalation: When does the ordinary path stop, and who takes over?
8. Evidence retained: What record shows the process occurred?
9. Change log: What changed, when, and who approved it?

“Contact the client” is not a usable step. Name the role, approved channel, documentation action, and escalation path. The owner fills gaps from approved sources and operations.

Keep the drafting workflow free of unapproved PHI

Create a source packet for one procedure: blank forms, approved role names, public guidance, current controlling materials, and a plain workflow description. Remove client-specific details through an approved method before the material reaches the drafting tool.

HHS guidance says Security Rule risk analysis must cover all e-PHI a regulated entity creates, receives, maintains, or transmits. Do not paste charts, messages, claims, payment records, referral letters, or incident narratives into an unapproved tool. A tool that handles e-PHI belongs in the practice’s formal privacy and security process and, when applicable, needs an executed BAA.

Then make the drafting request deliberately boring:

Use only the approved material below. Draft a control card, trigger, numbered steps by role, exceptions, escalation points, evidence retained, and a change log. Mark every missing decision or conflict as REVIEW REQUIRED. Do not decide legal, licensing, payer, or clinical questions.

Review whether the named role can perform each step, information stays within approved people and channels, and administrative instructions avoid clinical judgment. Trace each claimed duty or deadline to its source, then test with a fictional, non-PHI scenario.

Build six connected practice workflows

Design six recurring workflows and their handoffs.

Intake

Define where an inquiry enters, who receives it, what non-clinical information is gathered, how work is assigned, and when the ordinary path stops. End with a named state such as scheduled, referred, declined under the approved process, or awaiting information. Draft from a generic workflow.

Cancellations

Name the trigger, responsible role, sequence, completion record, exceptions, and escalation route. Separate stable office steps from language controlled by agreements, payer terms, or professional review. Link cancellation and billing SOPs to the same handoff and owner.

Billing

Describe responsibilities, queues, and escalation without using client, claim, or payment information. Mark contract-dependent steps for verification. When controlling material changes, revise and approve the affected instruction and record why.

Referrals

Define how a referral is received or initiated, routed, documented, and closed. Keep routine coordination distinct from professional judgment; generated business steps must not become clinical decision rules.

Records

Avoid a single tri-state retention number. Requirements can vary by license, setting, state, record type, payer, and client age. New York requires LMSWs and LCSWs to keep client records for six years or until the client turns 22, whichever is longer. That belongs in the appropriate New York social-work branch, not in a universal NY/NJ/CT rule.

Incident response

Make the stop-and-escalate point unmistakable. Define the trigger, immediate actions, owner, evidence, exceptions, and person authorized to direct the response. AI may format a generic call tree, but it should not receive an identifiable incident narrative through an unapproved tool or make a live decision.

Add state-aware review gates

State-aware drafting attaches current authority to human decisions; it does not rely on model recall.

New York telepractice guidance says technology-mediated practice remains subject to ordinary professional and ethical duties. It calls out confidentiality, time between responses, emergency provisions, documentation, and recordkeeping. Put those subjects into the New York workflow as explicit review gates.

New Jersey’s social-work rules allow asynchronous store-and-forward technology in telehealth and require location and other telehealth information in the client record. A human should verify how the current rule applies to the exact service and record workflow before releasing the New Jersey branch.

The source packet contains no Connecticut-specific rule. Leave Connecticut retention and telehealth fields unresolved until current authority or a qualified reviewer supplies the answer. Seek legal review when a procedure crosses jurisdictions, interprets a licensing or privacy duty, depends on a contract, presents conflicting authority, or could change client rights or professional obligations.

Release the procedure, then maintain it

Use one release loop for every document:

1. Scope the workflow, roles, trigger, users, and boundaries.
2. Sanitize the approved source packet.
3. Draft narrowly and flag missing decisions.
4. Verify every instruction against authority, agreements, and actual operations.
5. Escalate questions that require qualified interpretation.
6. Test with a fictional, non-PHI scenario.
7. Add approval, version, effective date, review date, and change-log entry.
8. Publish where staff can find the current approved copy.
9. Reopen it when a relevant rule, contract, vendor, workflow, or incident changes.

Training should point to the released SOP. Retire old copies through the approved process. Every instruction needs a source, accountable person, release status, and exception path.

FAQ

Can AI write a compliant SOP for my therapy practice?

No AI-generated draft proves that an SOP is compliant. Use AI for bounded drafting, then have a human verify it against current authority, agreements, professional duties, and actual operations. HHS does not certify people or products under the Privacy Rule.

Can I paste client information into an AI tool to improve an SOP?

Do not place PHI in a tool unless the practice has formally approved it through its privacy and security process and, when applicable, executed a BAA. Draft from an approved, sanitized process description.

How often should a therapy practice review its SOPs?

Give every SOP a review date and reopen it when a relevant rule, contract, vendor, workflow, or incident changes. Verify affected steps, obtain qualified review when needed, update the version, and record the change.

Can one records SOP cover New York, New Jersey, and Connecticut?

Not as one universal retention rule. Requirements vary by license, setting, state, record type, payer, and client age. Use jurisdiction- and role-specific review gates, verify current authority, and involve counsel when interpretation or cross-state application is uncertain.

Sources

• NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. Published July 26, 2024; updated April 8, 2026.
• NIST AI Resource Center. Updated 2025.
• HHS OCR, Guidance on Risk Analysis. Reviewed September 26, 2025.
• HHS OCR, HIPAA Guidance Materials. Reviewed April 7, 2026.
• NYSED, Consumer Information for Licensed Clinical Social Workers. Accessed August 6, 2026.
• NYSED, Engaging in Telepractice. Accessed August 6, 2026.
• New Jersey Division of Consumer Affairs, State Board of Social Work Examiners Rules. Revised April 15, 2024.

Disclaimer

This article is for educational and informational purposes only. It does not constitute medical, clinical, legal, or therapeutic advice, and reading it does not create a therapist-client relationship with Matthew Sexton, LCSW or Mental Wealth Solutions, Inc. Although the author is a licensed clinical social worker, the content in this article is not clinical assessment, diagnosis, or treatment.

The operational patterns and AI-assisted drafting concepts described here are general practice-management information. Privacy, security, licensing, telehealth, records, payer, and contract requirements vary by practice and may change after publication. Confirm current requirements with the applicable authorities and agreements, and consult qualified legal, compliance, or other professional advisors about your circumstances.

If you are in immediate emotional crisis, you can reach the 988 Suicide & Crisis Lifeline by calling or texting 988 (US). If you are experiencing domestic violence or are in physical danger, contact the National Domestic Violence Hotline at 1-800-799-7233 or visit thehotline.org. In a life-threatening emergency, call 911.