Behavioral health organizations use technology to help with documenting, intake, scheduling, coordinating care, and retrieving information.
However, myriad clinicians and other staff members still spend significant time working across numerous systems and completing administrative tasks. Generative AI may be able to help; however, for behavioral health the issue is not just whether a model will provide an adequate response. It is whether it can improve a real-world process while supporting privacy, safety, and professional responsibility. [3]
This difference matters because behavioral health data is highly personal. Behavioral health data related to substance use disorder (SUD) treatment may also have added federal confidentiality protections based on 42 CFR Part 2. According to the U.S. Department of Health and Human Services, Part 2 governs how and when covered SUD records can be shared and/or accessed. The 2024 Final Rule took effect on April 16, 2024, and set a compliance deadline of February 16, 2026. Organizations should review the current rule and consult with qualified privacy and legal experts when developing AI workflows [1].
Start with the Work, Not the Model
The first step in responsible implementation is deciding where the burden falls. For instance:
- Does a clinician spend a long-time taking notes after each appointment?
- Does cross-referencing across multiple systems to find referral information waste the intake coordinator’s time?
- Is staff time being used excessively to research policies or information for follow-up?
By setting up a workflow, AI teams can determine whether AI is the right tool for the job, what information it needs, and what to do when it returns incorrect or incomplete output.
Not all work will be automated. AI can sort approved information, create administrative text, summarize documents, or identify missing text for staff to review. It will not decide who should be cared for, make clinical assessment decisions, or serve as the final decision in a crisis. The greater the potential consequence of an error, the stronger the safeguards and human oversight should be. [2]
A Practical Lesson from Enterprise AI
I worked on an enterprise AI-based information retrieval project with over 20,000 users and 1.7 million+ queries. The reported results were approximately 95% accurate answers, a 40% increase in adoption, and a 70% decrease in search time. While these numbers are for an enterprise information retrieval project (not specifically for behavioral health deployment), the questions also included behavioral health topics; some of the queries were clinical, like questions on rheumatoid arthritis medications, dosage information, and care. But the product was an enterprise information retrieval tool, finding information from enterprise knowledge sources — not independently determining a patient’s treatment, prescribing medication, or directing care. A suitably qualified professional should review any clinical use of the retrieved information.
The lesson I learned from this project is that while generating a fluent response is an important part of the product, the system must also let users find relevant information in their workflow and evaluate the response before acting on it. In terms of behavioral health, this lesson translates into a practical design principle: allow for review of AI outputs; link AI outputs to authorized sources whenever possible; and clearly show when a human will need to verify the output. [2]
Design Documentation Support Around Clinician Review
AI can help with documentation, which can be a good starting point because it can create a draft based on information collected during the patient visit. But an AI-generated note should not be the clinical note by itself. A safer approach is for AI to generate a draft; the clinician reviews it to ensure it matches what happened during the visit; corrects any errors or omissions; and then approves the final note. Separate clearly what is generated from what is professional judgment.
The same applies to intake and referral coordination. AI can sort, fill in missing administrative information, or flag a message for review. It should not make any consequential clinical decisions of its own or drop a potentially life-saving message into an unsupervised queue. If a system detects language that might imply immediate risk, it should refer to a trained, identifiable escalation pathway and not serve as a clinical risk assessment tool.
Privacy Must Be Designed In
Privacy should never be treated as a final compliance check on an AI product after development. Prior to deploying an AI product, teams should determine what sources of data the system can access, what users will have access to the output of the system, whether information is being sent to a third party, how long inputs and outputs are going to be retained, and how activity is going to be logged. Set up data minimization, role-based access control, encryption, vendor reviews, retention policies, incident response plans, and controls on secondary use before deployment. [2]
When an AI workflow is utilizing records from a covered SUD program or is processing Part 2 records in some manner, there are specific requirements that must be followed based on the record, the entity, and the proposed use or disclosure. An AI vendor or integration does not relieve organizations of these obligations. Organizations should map data flows and permissions with privacy, security, clinical, and legal stakeholders to ensure that consent, notices, contracts, and technical controls follow the applicable requirements [1].
Measure Whether the Workflow Improves
A successful pilot will measure more than just the number of notes or summaries generated by the model. Set a baseline and monitor documentation time; after-hours work; time spent searching; correction rates; missing or incorrect information; escalation performance; staff experience; and patient-facing impacts (where measurable). Also check privacy and security incidents and the frequency of user rejections or overrides of AI outputs.
Teams should establish exactly what the metrics will represent before launch. For instance, define accuracy in relation to the task, the evaluation sample, the scoring criteria, and the person who evaluated the results. Documentation and adoption should be two separate measures. Documentation should be evaluated on how complete, accurate, and clinically appropriate it is. Adoption should evaluate whether the correct users are using the tool regularly at the proper workflow step. Excelling at one does not make up for failing at the other. [2]
Build a Foundation That Can Scale Safely
The same capabilities (e.g., identity management, access control, audit logging, model evaluation, monitoring, and incident response) can be applied to a multitude of AI-based projects in organizations. Reusable infrastructure does not mean you have to give everyone the same access for every project. For instance, a tool for retrieving policies carries different risks than a tool for creating a clinical note, and those differ from a tool that supports crisis escalation.
The goal is not to eliminate individuals from behavioral health workflows; rather, it is to minimize unnecessary administrative burdens on professionals while supporting their ability to provide care with time, context, empathy, and judgment. AI will earn its place in the workflow by proving usefulness, reliability, and strong safeguards — not just because the technology exists.
Conclusion: Automate the Burden, Not the Accountability
Behavioral health organizations can leverage AI to improve access to information, minimize redundant tasks, and provide greater consistency in their administration. To achieve this, organizations will need to take a “workflow first” approach: identify a single issue, limit access to only what is required, ensure that all output is based on authorized data, maintain responsibility for making consequential decisions with qualified professionals, and assess both the positive and negative outcomes.
The bar is simple: increased functionality without losing administrative convenience, documentation quality, patient trust, or accountability for clinical practice. Responsible AI in behavioral health does not hinge on the level of autonomy that a system achieves. Whether it enables professionals to work smarter, while making sure qualified individuals rather than the AI system remain accountable for clinical judgment and care decisions, is what will determine its usefulness.
Sonam Kumari is a healthcare technology and AI product professional with a background in computer science engineering and an MBA from Boston University’s Questrom School of Business. Her experience spans healthcare analytics, data-driven product development, generative AI, operational optimization, and cross-functional technology leadership. For more information, email [email protected] or visit www.linkedin.com/in/sonam-k108.
References
[1] U.S. Department of Health and Human Services. “Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or ‘Part 2’.” Includes the 2024 final rule and compliance date. https://www.hhs.gov/hipaa/part-2/index.html [2] Tabassi, E. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1 [3] Substance Abuse and Mental Health Services Administration. (2022). Addressing Burnout in the Behavioral Health Workforce Through Organizational Strategies: Identifying and Implementing Emerging Strategies to Address Burnout (Publication No. PEP22-06-02-005). U.S. Department of Health and Human Services. https://library.samhsa.gov/sites/default/files/pep22-06-02-005.pdf
