How CBT Assistant Pro Protects Client Data: The Security Model, Stated Plainly

HIPAA compliance for a therapy documentation platform is not a single checkbox — it is a combination of administrative, physical, and technical safeguards defined in the HIPAA Security Rule. A genuinely compliant case formulation platform must:

• Encrypt all Protected Health Information (PHI) in transit (TLS 1.3) and at rest (AES-256-GCM)
• Sign a Business Associate Agreement (BAA) with every customer who needs one
• Implement role-based access control so only the treating clinician can view their client records
• Maintain audit logs of every access and modification to PHI
• Provide breach notification within 60 days of any confirmed incident
• Ensure that no PHI is ever used to train AI models — a contractual guarantee enforced through enterprise API agreements with model providers

CBT Assistant Pro meets some of these and not others, and the distinction is the point of this guide. Role-based access, audit logging, breach notification and the no-training guarantee are in place. A BAA is not offered today, and encryption at rest covers private notes and credentials but not session notes, transcripts or intake answers. If your compliance position depends on either of those two, it is not met yet.

Different jurisdictions have different health privacy laws, and CBT Assistant Pro is built to satisfy the strictest of them simultaneously:

HIPAA (United States): The Health Insurance Portability and Accountability Act governs PHI handling by covered entities and business associates. CBT Assistant Pro does not currently offer a BAA, which means a US covered entity cannot rely on it for PHI yet, whatever its technical controls.

PHIPA (Ontario, Canada): The Personal Health Information Protection Act regulates custodians of personal health information in Ontario. The platform supports lawful authority requirements, consent management, and the right of access to one's own record.

PIPEDA (Canada federal): The Personal Information Protection and Electronic Documents Act applies to private sector handling of personal information across Canada. CBT Assistant Pro's consent flows, transparency notices, and breach response procedures meet PIPEDA standards.

For most clinicians, this means: if you practice anywhere in the U.S. or Canada, you can use the platform without worrying about jurisdictional gaps.

The General Data Protection Regulation (GDPR) is the world's strictest privacy law. CBT Assistant Pro is GDPR compliant for European Economic Area clinicians and clients:

• Lawful basis for processing: Explicit consent for client records; legitimate interest for therapist accounts; contract necessity for service delivery.
• Right of access: Clients can request a full export of their data at any time.
• Right to erasure (right to be forgotten): Permanent deletion within 30 days of request, with verification logged.
• Data Protection Impact Assessment (DPIA): Available on request for institutional clients.
• Data Processing Agreement (DPA): An outline of what such an agreement would commit us to is published, but no DPA has been executed with any customer yet.
• Sub-processor transparency: Full list of sub-processors (hosting, AI inference, email delivery) published and updated within 30 days of any change.

If you treat any client residing in the EU, EEA, or UK, GDPR applies to you — regardless of where you are physically located. The platform handles this automatically.

Data moving in or out of CBT Assistant Pro is encrypted with TLS. An attacker intercepting your network traffic sees only encrypted bytes — no session notes, no client names, no assessment scores.

At rest the picture is mixed, and it is worth being exact because this is the claim most often rounded up:

• Encrypted with AES-256-GCM: the therapist’s private notes on a client, and stored third-party credentials and tokens.
• Not encrypted: session notes, transcripts, AI summaries, the presenting problem, intake answers and client journal entries. These are stored as readable text in the database.

So a breach of the storage layer would expose clinical text, and a database administrator can read it without going through the application. What protects it is control of the server and the access logging around it, not cryptography. The code to encrypt those columns is written and sits behind a feature flag; turning it on requires a one-off migration of existing rows.

Note what this is not: it is not end-to-end encryption. End-to-end would mean the server cannot read your data, and the server can — it has to, to search your notes and to draft from them.

Nothing stops a clinician entering a pseudonym or a client code rather than a real name in the client record, and for high-sensitivity cases that is worth doing — it is the one de-identification control available to you today that does not depend on us.

Be clear about what the platform does not do, so the decision is yours and not an assumption:

• There is no built-in client-code scheme and no separate encrypted "real identity" field. Whatever you type in the name field is what is stored.
• There is no automatic redaction of names, phone numbers or addresses from AI-generated drafts. Transcription can strip financial and identity numbers, and that is the extent of it.
• Reporting and analytics run over your own records rather than a de-identified copy.

If you choose to use a pseudonym, keep the mapping to the real identity outside the platform.

CBT Assistant Pro offers voice transcription for session notes — a feature that lets clinicians dictate notes rather than type them. The privacy model here is critical:

Audio is transcribed, then permanently deleted. Once the session note text is generated and saved to the client record, the original audio file is securely overwritten and removed from all storage layers — including temporary processing buffers, cache, and any third-party transcription service.

This is fundamentally different from platforms that retain audio for "quality improvement" or "model training." Our contract with transcription providers explicitly prohibits retention beyond the minimum processing window. We do not store, archive, or analyze your clinical audio.

The transcribed text becomes part of the secure client record, encrypted and access-controlled like every other field.

You own your data. CBT Assistant Pro provides:

Full export at any time: Download every client record, formulation, assessment score, and progress note as JSON or PDF. No subscription required to export — even on cancelled accounts.

Granular edit and delete: Modify or permanently delete any individual record. Deletions are real deletions — not soft flags. Once confirmed, the data is gone from production systems within 24 hours and from backups within 30 days.

Account-level erasure: Close your account and request full erasure. Within 30 days, every byte associated with your account is permanently removed.

Audit trail: See every access and modification to your data, including by your own staff if you operate a clinic account.

This is not optional — these are baseline rights guaranteed by HIPAA, PHIPA, GDPR, and the platform Terms of Service. We make them genuinely usable, not buried in legal language.

Many clinicians have experimented with pasting session notes into ChatGPT, Claude, or other consumer AI tools. This is a significant HIPAA risk:

The cost of a HIPAA breach can exceed $50,000 per incident — far more than any subscription. Using a purpose-built compliant platform is not just safer, it is the only defensible choice for licensed clinicians handling PHI.