A therapy session is, by design, one of the most protected conversations a person can have. When Molly Quinn, 31, sat down for what she expected to be a routine mental health check-in, she did not anticipate that an artificial intelligence platform was quietly transcribing every word she said about her most private struggles - without her informed consent. Her experience, reported by NPR, has since ignited a broader reckoning about what happens when automation enters spaces that depend entirely on human trust.
The Moment the Room Changed
Quinn noticed something was different partway through the session. Her practitioner, who normally took handwritten notes on a clipboard, had instead propped up an iPad nearby. The familiar rhythm of the appointment had shifted in a way Quinn found immediately unsettling. The more she thought about what was happening - where her words were being processed, where the data was being stored, whether it could eventually be fed into a machine-learning model - the worse she felt.
'The more I thought about it, the more I just started getting more and more sick to my stomach,' she told NPR. 'This person who I'm supposed to be able to trust with some very private and very intense emotions had just completely disregarded something I said I was not comfortable with. I felt completely violated.'
Even after her practitioner offered to stop using the tool, Quinn did not stay. She found a new provider. 'The trust was gone,' she said. That line captures the essential problem: in therapy, trust is not an added benefit. It is the entire architecture on which the work is built. Remove it, and nothing else functions.
A Technology Spreading Faster Than the Conversation Around It
Quinn's case is not isolated. Across clinical practice - from primary care to psychiatry - automated transcription and note-taking tools are being adopted at a pace that outstrips both patient awareness and formal ethical guidance. Software companies marketing these products pitch them as a solution to administrative overload, promising to free clinicians from documentation so they can focus fully on the person in front of them. It is a compelling argument, and for many practitioners working under genuine time pressure, an attractive one.
But the pitch elides a fundamental question: do patients consent to having their most sensitive disclosures processed by a third-party platform? In Quinn's case, the answer was clearly no. And even where consent is technically obtained, the manner in which it is sought - buried in onboarding paperwork, mentioned as an afterthought - can undermine the genuine informed consent that medical ethics requires.
Marisa Cohen, a couples and sex therapist based in New York, explained the dynamic to NPR with precision. 'Even the presence of AI changes the therapeutic experience,' she said. 'Clients know or feel like something else is listening to them. That awareness can subtly alter their disclosure.' The observation matters clinically, not just philosophically. If a client edits what they say because they sense a machine is recording them, the therapy itself is compromised - regardless of how secure the platform claims to be.
Public Distrust Is Not Irrational - It Is Informed
The technology sector's standard response to privacy concerns is to cite compliance frameworks and security assurances. Tal Salman, chief executive of Berries, a transcription tool marketed to therapists, told NPR that recordings are deleted immediately after processing and that transcripts are stored on HIPAA-compliant servers in the United States. These are not trivial assurances - HIPAA compliance sets a genuine legal floor for how health data must be handled.
Yet compliance is not the same as safety, and legal minimums are not the same as trust. HIPAA-compliant systems have been breached before. Healthcare remains one of the most targeted sectors for ransomware and data theft precisely because the information it holds is extraordinarily sensitive and, once exposed, cannot be un-exposed. Quinn put it plainly: 'We're going to see breaches. Maybe not tomorrow, maybe not next week. But in a few years? I think we're going to see them. And I don't want my therapy session to be part of that.'
Public sentiment, as measured in a YouGov survey cited by NPR, reflects deep skepticism. Only 11% of respondents said they would be open to using AI in mental health support. Just 8% said they would trust it in that context. Forty percent said they do not trust the technology at all. These numbers do not describe an uninformed public resisting the unfamiliar. They describe a population that has watched years of data scandals - across social media, healthcare, financial services, and government - and drawn rational conclusions.
The Regulatory Gap That Makes This Possible
What Quinn experienced is partly a product of a regulatory environment that has not kept pace with clinical technology adoption. HIPAA governs how protected health information must be handled, but it was written long before AI transcription tools existed in their current form. It does not prescribe specific consent protocols for AI-assisted note-taking, nor does it require practitioners to disclose proactively that a third-party platform will process session content.
Professional licensing boards and mental health associations have issued varying guidance, but nothing uniform or enforceable at a national level currently closes this gap. The result is that individual practitioners make their own calls - and some, whether through enthusiasm for the technology or genuine administrative need, are making them without adequately centering the client's right to know.
The path forward requires more than better software terms of service. It requires a clear standard: explicit, informed, prior consent before any AI tool is introduced into a therapeutic setting - with a genuine, consequence-free option to decline. Cohen's framing of AI as 'essentially a third party' in the room is not rhetorical. It is accurate. And the introduction of any third party into therapy has always required transparency. That principle does not change because the third party is software.
