You know what's always been a priority for therapists? Even if it wasn't necessarily called this?
Data minimization.
Long before AI, therapists have intentionally documented only what was clinically necessary. A 53-minute session becomes a concise progress note.
This is data minimization.
It's also one of the oldest principles in cybersecurity. You should only collect the data you actually need. Because every piece of data you handle or create has to be secured, stored, deleted, etc. And so if a mistake is ever made, and if a data breach ever occurs, you literally can't expose data that never even existed.
That is data minimization.
If a therapy session is never recorded, there is zero risk that the recording could ever be leaked. (There was never a recording!) If a therapy session is never transcribed, there is zero risk that the transcription could ever be leaked. (There was never a transcription!)
Similarly, as therapists have always done, if a sensitive and specific detail is never explicitly written in a progress note, there is zero risk that it will surface in a subpoena or disclosure or breach.
Therapists can sleep easy, knowing that the sensitive specifics stayed in the session, and it's literally impossible for those details to be accessed or heard or read by anyone else.
But if AI and recording does take place in a session?
Well, that risk is no longer zero. There is now this possibility -- now or years in the future -- that something could go wrong, policies could change, etc.
And in that case, data was not minimized.
So regardless of what companies say to convince therapists to introduce AI and recording/transcription into a session ("We're HIPAA compliant!", "We use encryption!", "We de-identify!", etc.), there's only one true guarantee of privacy in a therapy session. And it relies on data minimization.
