The patient has just told you something they've never said out loud before. The note you write afterward isn't just a journal entry – it's part of a therapeutic alliance that takes months to build and minutes to shatter.

Few types of documents are as dependent on context as a psychological journal. A somatic note can stand alone – a blood pressure reading has meaning even to a colleague who has never met the patient. A therapy note is rarely like that. It has meaning because it is part of a relationship that extends over time, and it presumes that the patient feels confident that what was said in the room will be treated with discretion.

As AI-assisted documentation is now making its way into more Norwegian psychology practices, the first question is rarely whether the technology works. It's whether it's compatible with the duty of confidentiality, with the patient's right to control their own information, and with the very foundation of the therapy room: that what is said there should not travel further without the patient's knowledge and consent.

Therapy notes are a separate category of privacy

Health information is already defined as a special category of personal data – which the Norwegian Data Protection Authority refers to as «special categories of personal data (Articles 9 and 10 of the GDPR). This means that they trigger stricter requirements for the basis of processing, security, and documentation than ordinary personal data. Within health data, in turn, few categories are more sensitive to protection than what is said in a therapy session.

The Norwegian Data Protection Authority treats data protection in the healthcare sector as a separate thematic area. – not because the rules are different, but because the consequences of a deviation are greater. A leaked blood test value can be unpleasant. A leaked description of suicidal thoughts, traumatic experiences, or substance abuse issues can change a person's life in a completely different way.

In addition, there is the peculiarity of the alliance. The Norwegian Psychological Association’s Ethical Principles for Nordic Psychologists emphasizes both confidentiality and the patient’s right to self-determination—and that how information is collected and stored is not merely a technical aspect of treatment. It is part of the treatment itself. A patient who is unsure of what is being stored, where it is stored, and who has access to it will not tell you the most important things on their mind.

The four requirements that must be in place before AI enters the therapy room

There are four key requirements that must be met before an AI assistant can be included in the therapy room. None of them are new. What is new is that they must now be evaluated in relation to a tool that listens, transcribes, and organizes what is said.

Legal basis for processing. The Personal Data Act requires an explicit legal basis for processing health information. For record-keeping in the context of therapeutic treatment, the basis is usually the Health Personnel Act and the Patient Records Act, combined with the fact that the processing of sensitive information is necessary for the provision of healthcare pursuant to Article 9(2)(h) of the General Data Protection Regulation. This legal basis applies to the actual record-keeping—but an AI assistant that listens to the conversation must also fall under the same legal basis. If not, separate consent is required. In practice, the patient should always be informed and give consent to AI transcription, regardless of whether one strictly considers that the legal basis is already in place.

Dataflow. Where does the conversation take place? Where is the raw data stored, and where is the processed note stored? And perhaps most importantly—does any of this cross national borders? We have previously written about how Medical records in many cloud services may end up on servers outside the EU without the individual clinician being aware of it. For a psychologist, this is not a minor technical detail—it is at the heart of what the patient has consented to and what the duty of confidentiality actually entails.

Identifiability. Much of the risk associated with AI systems that process health data lies in the fact that the model itself becomes a repository for what it has seen. We have written a wake-up call about this in our post on anonymization and pseudonymization. When it comes to therapy notes, it is particularly important that directly identifiable personal data—full name, social security number, address, employer—be removed from the material that is transcribed and processed further. That is the difference between a valid legal basis for processing and one that is not.

Patient monitoring. The patient must be able to know that AI is being used, be able to opt out without any consequences for the treatment itself, be able to request that recordings or transcripts be deleted, and be able to request access to the data. This is not just a legal matter—it is a clinical one. A therapeutic relationship with an imbalance in control over the information is not an optimal therapeutic relationship.

What patients are actually wondering about

In practice, patients rarely ask the legal questions first. They ask three other questions:

«Is it recording all the time?» The patient wants to know whether it’s recording continuously, or whether the device turns on and off as you decide. The simplest answer is the honest one: it’s on when you’ve told it to be on, and you can ask to turn it off at any time.

«Who else is listening to this besides us?» Patients must be able to trust that no one is listening to the conversation in real time. A professional AI tool relies on automated transcription, where no human operators listen to the audio file. This is a key difference from human-based transcription services, where the patient may indeed have reason to ask who was listening in.

«What happens if I say something I don't want to include? The patient should be able to request that parts of the conversation are not transcribed, or that parts of the note are edited out before it is saved in the medical record. This is not something AI handles alone – it is your clinical and editorial judgment that determines what ends up in the final note.

I our previous post on why documenting conversations is harder than you think We wrote about how much of the therapy note involves assessment and interpretation—not mere reproduction. It is precisely this task of interpretation that cannot and should not be automated away. AI can pick up the words that were spoken; it is still you who knows which ones belong in the notes.

How Medivox Builds Privacy into Its Systems from the Start

Medivox was developed for the Norwegian healthcare sector with privacy as a core principle—not as an add-on feature. For psychologists, this means four specific things:

  • Directly identifiable personal data is removed before the transcription is processed further. It reduces what the Datatilsynet refers to as the risk of re-identification, and it reduces what is technically available to the model that creates the draft.
  • All data processing takes place at Norwegian data centers, within Norwegian and European jurisdiction. This is a professional requirement for the psychologist’s journal, not a selling point.
  • The patient's consent can be documented and amended. It is easy to note that the patient has been informed, and just as easy to note that the patient has expressed reservations or withdrawn consent.
  • You own the journal, and the final wording is up to you. The tool generates a draft based on what was actually said. What stays in the record, which details are included, and what doesn’t belong in the medical record—that’s entirely up to you, just as it should be.

I our post about the psychologist who stopped taking notes in the evening We wrote about what those time savings could mean for the workday. Privacy is the second requirement that must be met before those time savings can even be considered. For psychologists, the order is clear: trust comes first, efficiency second.

When technology enhances, rather than replaces, the therapy room

There is concern in the field that AI tools may alter the dynamics of the therapy room—that patients may become more reserved, or that therapists may listen less attentively when someone else is taking notes. Both are legitimate concerns that should be taken seriously. At the same time, experience from primary care physicians and specialists who have adopted speech-to-text shows that the opposite often happens: when the therapist doesn’t have to write while listening, their listening becomes more focused. This is an effect that should not be underestimated—but nor should it be overhyped. It is still your clinical structuring of the conversation that creates the space in which the patient can speak.

Privacy is not an obstacle to the use of AI in psychological treatment. It is the framework that makes its use justifiable—and it is that framework that must be in place before the tool can even be considered. A therapy note deserves the same consideration regarding where it ends up as it does regarding how it is worded. It is the same respect for the patient that drives both aspects.

Frequently Asked Questions

Do I need the patient's written consent to use AI transcription in a therapy session?
Although the legal basis for record-keeping may lie solely in the Health Personnel Act, it is recommended that the patient be informed and give specific consent to the AI transcription. The consent should be informed, voluntary, documented in the patient record, and retractable without consequences for the treatment itself.

What data is stored after a call, and for how long?
It depends on which tool you are using. For Medivox, the principle is that the audio recording is not stored after the transcription is complete, that the transcribed note is stored in your journal at Norwegian data centers, and that directly identifiable information is removed before processing. Always check the data processing agreement for the tool you are using.

What happens if the patient withdraws their consent in the middle of a course of treatment?
Treatment should be able to continue without AI transcription. Notes from previous conversations will be retained as ordinary medical records with a legal basis in the Health Personnel Act, but new conversations will be documented without transcription support.

Does the therapist listen less when AI is taking notes in the background?
Clinicians' experiences with tools like Medivox often point in the opposite direction: when they no longer have to think about note formulation at the same time as the conversation, their presence becomes clearer. This assumes that they still make their own assessment of the finished note.

Is there a difference in AI transcription for psychologists and for somatic physicians?
The legal framework is the same – but the level of vulnerability in the content is not. Therapy notes often contain information about sexuality, trauma, substance abuse conflicts, and suicidal thoughts. This places higher demands on pseudonymization, data processing agreements, and the patient's actual control over their own data.

Use Medivox for free – Get started completely free

Are you a psychologist evaluating AI-assisted documentation but want to be sure privacy standards are met before taking the leap? Contact us – We will go through the data processing agreement, consent routines, and data flow together with you.

Sources: