Illinois Passes Extensive Law Regulating AI in Behavioral Health

The statute is the first in the nation to codify a direct restriction on AI therapy, while also placing strict conditions on how licensed professionals may incorporate AI into care delivery. In addition, it expands confidentiality requirements for all therapy providers.

Key Provisions

The Act has several key features, including a broad prohibition on providing therapy services with AI unless by individuals licensed to provide such services, new consent requirements for AI use in certain therapeutic contexts, and additional confidentiality requirements.

1. Who can provide therapy services?

Under the Act, no person or entity, including "internet-based Artificial intelligence," may provide, advertise, or offer therapy or psychotherapy services unless the services are conducted by a licensed professional. The Act defines "therapy or psychotherapy services" as clinical services to diagnose, treat, or improve mental or behavioral health, except for religious counseling and peer support. There is an enumerated list of licensed professionals who may provide such services, including psychologists, licensed clinical social workers, licensed clinical professional counselors, licensed marriage and family therapists, and certain psychiatric nurse practitioners, but note that the definition includes only individuals licensed in Illinois (which may have significant ramifications for telehealth).

The Act does not define the terms "provide, advertise, or offer," which may lead to some ambiguity in deciding whether an entity is providing, advertising, or offering therapy services without a licensed professional. Nonetheless, the Act is clearly intended to prevent the provision of therapy services through AI platforms, and when coupled with the restrictions set forth below, essentially serves as a complete prohibition on AI therapy services.

2. What new restrictions exist on AI usage?

In addition to the broad requirements above, the Act creates restrictions on the use of AI by licensed professionals. First, no licensed professional may use AI to provide "supplementary support" without a clients' informed written consent in therapy or psychotherapy where the clients' session is being recorded or transcribed. That consent needs to clearly describe both the AI itself and that AI's specific purpose. "Supplementary support" means tasks performed to assist a licensed professional in the delivery of therapy or psychotherapy services that do not involve therapeutic communication and that are not "administrative support." Administrative support means tasks performed to assist a licensed professional in the delivery of therapy or psychotherapy services that do not involve communication, including (1) managing appointment scheduling and reminders; (2) processing billing and insurance claims; and (3) drafting general communications related to therapy logistics that do not include therapeutic advice.

In addition, the Act provides that, even when a licensed professional is involved, AI may not:

• Make independent therapeutic decisions
• Engage directly in "therapeutic communication" with clients
• Generate treatment plans or recommendations without licensed professional review and approval
• Detect emotions or mental states

The Act broadly defines "therapeutic communication" to mean "any verbal, non-verbal, or written interaction conducted in a clinical or professional setting that is intended to diagnose, treat, or address an individual's mental, emotional, or behavioral health concerns," and further provides the following non-exhaustive list of prohibited AI uses:

(1) Direct interactions with clients for the purpose of understanding or reflecting their thoughts, emotions, or experiences;

(2) Providing guidance, therapeutic strategies, or interventions designed to achieve mental health outcomes;

(3) Offering emotional support, reassurance, or empathy in response to psychological or emotional distress;

(4) Collaborating with clients to develop or modify therapeutic goals or treatment plans; and

(5) Offering behavioral feedback intended to promote psychological growth or address mental health conditions

3. New Confidentiality requirements

The Act provides that all client records with licensed professionals (not only those related to AI) shall be confidential and shall not be disclosed except as required by the Illinois Mental Health and Developmental Disabilities Confidentiality Act (IMHDDC). Notably, the Act does not define "records," though the term is defined in the IMHDDC. This definitional oversight (or intentional exclusion) expands the confidentiality requirements set forth in the IMHDDC: The IMHDDC contains a narrower definition of the term "record" with numerous exceptions, including a therapist's personal notes maintained outside of the medical record and de-identified information. In contrast, all "records" (however that term may be interpreted) are now required to be kept confidential under this Act.

In addition, many disclosures under IMHDDC are permissive, giving flexibility to providers. However, under the Act, records may only be disclosed "as required" under the IMHDDC, which will limit a provider's ability to make otherwise permissive disclosures under the IMHDDC. All therapy providers, not just those using AI, should review their confidentiality and record retention policies to align with the Act.

Enforcement

The IDFPR has the authority to investigate violations and impose penalties up to $10,000 per violation. Orders are enforceable as court judgments, and penalty amounts will be determined based on the degree of harm and surrounding circumstances.

Implications for Health Care Providers and Digital Health Platforms

The Act's breadth means that its impact extends beyond traditional therapy practices to telehealth companies, hospitals, wellness app developers, and technology vendors supporting mental health services. It will be important to consider all AI usage and classify it as administrative, support, or impermissible. In addition, claims of "therapist-like," "personalized coping advice," or "24/7 emotional support" aimed at Illinois users may be viewed as offering AI therapy.

Recommended Next Steps

1. Conduct a Comprehensive AI Audit: Identify all AI tools and classify their functions as administrative, supplementary, or therapeutic.
    
2. Implement Geofencing and Role-Based Controls: Disable prohibited features for Illinois users or ensure licensed professional oversight.
    
3. Revise Consent Processes: Implement purpose-specific, written, revocable consent procedures for covered AI uses.
    
4. Review Confidentiality policies and procedures: Ensure compliance with the expanded confidentiality requirements of the Act.
    
5. Update Marketing and Communications: Remove or qualify claims suggesting AI-delivered therapy unless compliant.
    
6. Review Vendor Agreements: Require vendors to support compliance with Illinois-specific restrictions and provide audit documentation.
    
7. Establish Governance Protocols: Create cross-functional oversight for AI features involving behavioral health.

Conclusion

Illinois' Act sets a new regulatory standard for AI use in behavioral health services, marking a shift from professional ethics guidance to enforceable statutory rules. Entities delivering or marketing mental health-related services to Illinois residents should act immediately to review AI functionality, marketing practices, and consent processes to ensure compliance and mitigate enforcement risk. Illinois' model is likely to influence other states, so providers with multistate operations should consider adopting Illinois-compliant practices enterprise-wide.

AI regulation continues to develop quickly across sectors. For assistance under this law (or others) contact Alisa L. Chestler, Allison M. Cohen, Alexandra P. Moylan, Dan S. Parks, or any member of Baker Donelson's AI team.