Guide · Healthcare · AI in Behavioral Health

Illinois AI Therapy Law: A Compliance Framework for Behavioral Health Practices

The Wellness and Oversight for Psychological Resources Act permits defined administrative and supplementary AI support while reserving therapeutic communication and professional judgment to licensed professionals.

By Lincoln Square Law · 9-minute read

The Illinois rule is about who delivers therapy, not whether a practice may use software

Illinois enacted the Wellness and Oversight for Psychological Resources Act, 225 ILCS 155, effective August 1, 2025. Its purpose is to protect people seeking therapy or psychotherapy by keeping those services with qualified licensed or certified professionals while regulating the role of artificial intelligence systems. For a behavioral health practice, the correct compliance question is therefore not 'Do we use AI?' It is 'What function is the AI performing, what does it say to the patient, and who remains professionally responsible for the output?' That framing avoids two opposite mistakes. One is to ban every tool with an AI feature even when the Act permits administrative or supplementary support. The other is to treat every AI feature as ordinary software because a clinician is somewhere in the workflow. The statute draws functional lines, and the practice should classify each use against those lines.

Administrative support is the clearest permitted lane

The Act defines administrative support as tasks that assist a licensed professional but do not involve therapeutic communication. The statute gives examples such as appointment scheduling and reminders and processing billing and insurance claims. These are functions a practice can generally automate without turning the software into a therapist, provided other privacy, security, consumer, and professional rules are satisfied.

Inventory the features, not just the products. A platform may use AI in scheduling, generate draft messages, summarize an intake, and offer a patient-facing chatbot. Those are different uses under the Act even though they come from one vendor. The compliance inventory should list each feature, whether it communicates with patients, what data it uses, what output it produces, and whether a licensed professional reviews or relies on it.

Supplementary support requires professional responsibility

The Act also permits a licensed professional to use AI for supplementary support, subject to the statutory conditions.

Supplementary support can assist the professional without replacing professional judgment. The licensed professional remains fully responsible for the use of the AI and for the services delivered. That means a practice should not solve compliance by adding a generic disclaimer that 'AI may be used.' It needs a workflow that assigns review and responsibility to a licensed professional.

For documentation tools, establish when the clinician reviews a transcript or draft note, how corrections are made, and whether the signed record shows the clinician’s approval. For analytical tools, identify exactly what the system does and what decision the clinician makes independently. If a tool produces a suggestion about diagnosis, treatment, risk, or patient state, the practice should examine the prohibition sections before treating the function as supplementary support.

The statute prohibits AI from taking the therapeutic role

The Act bars an AI system from making independent therapeutic decisions, directly interacting with clients in therapeutic communication, generating therapeutic recommendations or treatment plans without review and approval by a licensed professional, and detecting emotions or mental states. These restrictions are operational. A practice cannot rely on a vendor’s marketing category such as 'wellness assistant' if the feature actually responds to a patient’s distress, interprets emotional state, recommends a therapeutic intervention, or adapts treatment without the licensed professional’s review.

Patient-facing generative chat deserves particular scrutiny. A bot that confirms an appointment is administrative. A bot that asks a patient to describe symptoms and then provides coping advice may cross into therapeutic communication. A system that flags a word for a clinician to review is different from one that claims to infer depression, intent, or emotional state. Document the actual prompt, output, routing, and human review rather than relying on a high-level product description.

Recording or transcription triggers a specific notice-and-consent step

When an AI system is used for supplementary support that involves recording or transcribing a therapy or psychotherapy session, the Act requires written notice that AI will be used and notice of the specific purpose, together with the client’s consent. Build that requirement into the workflow before recording begins. A consent buried in a general website privacy policy is a poor operational substitute for the statutory step tied to the session.

Keep the notice with the patient record or another reliable compliance record. It should identify the function in plain terms, such as transcription to create a draft clinical note, rather than describing AI in the abstract. The practice should also have a path for a patient who does not consent: turn the feature off, use another documentation method, and make sure staff know how to do so without interrupting care.

Mental-health confidentiality and HIPAA still govern the data

The WOPR Act does not displace other confidentiality law. It expressly references protection of information under the Illinois Mental Health and Developmental Disabilities Confidentiality Act. Depending on the provider and relationship, HIPAA may also apply. The practice must therefore analyze both what the AI is allowed to do and whether the data can lawfully be disclosed to the vendor or processed in the proposed way.

Vendor review should cover the information sent to the system, business associate status and a BAA when HIPAA requires one, subcontractors, storage location, retention, deletion, security controls, training or secondary use of patient data, incident reporting, and the ability to disable features that the practice has not approved. A contract promise that the vendor is 'HIPAA compliant' does not answer the Illinois professional-practice question, and compliance with WOPR does not answer HIPAA.

Advertising and product configuration should match the licensed service

The Act regulates providing, advertising, or offering therapy or psychotherapy through unqualified providers or systems. Marketing teams therefore belong in the compliance process. A website should not describe an automated tool as a therapist, treatment provider, diagnostic companion, or substitute for professional care if the service is not delivered in the manner the statute permits. Review app-store descriptions, portal labels, onboarding screens, chatbot names, and vendor-supplied copy as well as the practice’s own advertising.

Configuration also matters. Many platforms release new AI functions by default. Contract for notice of material feature changes where possible, limit administrator permissions to enable patient-facing AI, and create a change-review process. An inventory done once in 2025 will not protect a practice if the vendor silently adds sentiment detection or therapeutic response features later.

IDFPR enforcement makes documentation part of the control

The Department of Financial and Professional Regulation may investigate suspected violations and the Act authorizes civil penalties of up to $10,000 for each violation following the statutory process. The practical response is not alarmist language. It is a record showing how the practice classified the tool, what the licensed professional reviewed, what consent was obtained when required, and how prohibited functions were disabled or excluded.

Create a one-page approval record for each AI use. Identify the vendor and feature, permitted category, patient interaction, data involved, reviewer, consent requirement, contract status, security review, and approval date. Attach screenshots or configuration exports for important settings. Re-review on a defined schedule and when the vendor changes functionality. This produces evidence that the practice did more than buy a product and assume the vendor understood Illinois law.

A five-step implementation plan

First, inventory every AI feature in clinical, administrative, billing, marketing, and documentation workflows. Second, classify each feature as administrative support, supplementary support, prohibited therapeutic functionality, or unresolved. Third, disable unresolved or prohibited functions until the practice completes legal and clinical review.

Fourth, for approved uses, document professional responsibility, required notice and consent, privacy and security controls, and vendor terms. Fifth, monitor feature changes and complaints so the classification remains accurate.

The plan should include clinicians, privacy or compliance leadership, IT, and whoever manages vendor contracts. The statute is about professional services, but the facts that determine compliance are distributed across those teams. A clinician may know what the tool does in a session while IT knows whether transcription is retained and contracting knows whether the vendor uses data to train models. The approval record should bring those facts together.

Where practices should draw the line

A useful internal rule is that automation can support the professional, but it should not become the professional. That is not a substitute for the statutory definitions. It is a practical way to spot features that need closer review. If the output is intended to be therapeutic communication, a treatment decision, a treatment recommendation, or an inference about emotion or mental state, stop and test it against 225 ILCS 155 before deployment.

Illinois practices do not need to wait for an enforcement action to make this manageable. Most risk can be reduced by controlling configuration, narrowing data flows, obtaining the required consent, keeping the clinician responsible for review, and ensuring marketing does not promise an automated therapeutic service. The remaining questions are fact specific and should be resolved before the feature is used with patients, not after a complaint.