AI Readiness Checklist for Behavioral Health

Answer every line before an AI agent touches your phones, your intake, or your records. A "no" doesn't mean never. It means not yet.

1. The job

We wrote one paragraph describing the job: what the agent does, what information it touches, and when it hands off to a person.
One named person owns the agent, reads its conversations every week, and has the authority to shut it off.
We know what success looks like (for example, after-hours calls answered and called back by 9am) and how we'll measure it.
We have a written plan for turning it off, and staff know how to cover if we do.

2. The data

We listed every type of information the agent will see, store, or send.
We checked whether the job can be done with de-identified or aggregate data instead. (Removing names isn't de-identification. HIPAA's Safe Harbor method lists 18 identifier types.)
The agent gets only the minimum information it needs, not the whole chart.
We know where recordings, transcripts, and logs are stored, for how long, and who can see them.
The vendor told us in writing whether our data is used to train or improve its models.

3. Law and contracts (bring these to counsel)

Counsel has confirmed whether we're a HIPAA covered entity or business associate for this use.
We have a signed Business Associate Agreement for the exact product and plan staff will use.
We have the vendor's list of subcontractors that handle our data (phone, transcription, cloud, AI model provider).
If we're a federally assisted SUD program, counsel reviewed how the tool handles 42 CFR Part 2 consent and redisclosure.
Counsel checked state AI and recording laws for every state we serve (some states restrict AI in therapy).
Any AI-voiced calls or texts have consent language reviewed under the TCPA.
Pages with chat widgets or intake forms have no third-party ad or tracking pixels that could capture what people type.

4. Safety

Our clinical director approved a list of crisis phrases that trigger an immediate handoff to a person.
We tested the crisis route: the agent gives 911 for emergencies and 988 for the Suicide and Crisis Lifeline, and a human gets on the line fast.
There's a fallback when no human answers, and it's been tested at 2am.
The agent refuses clinical questions (diagnosis, level of care, medication) and routes them to a person.
The agent tells people up front that it's automated.
The agent never promises coverage, cost, or outcomes.
We rerun our test conversations after every vendor update and keep the results.

5. Money and referrals

Vendor pricing is flat or usage based (seats, minutes, conversations).
No payment to or from anyone varies with leads, referrals, admissions, or placements. (See 18 U.S.C. § 220, the Eliminating Kickbacks in Recovery Act.)
The agent never routes callers to another organization in exchange for anything of value.

6. People

Staff have a one-page AI policy: what's allowed, what never goes into a tool, and what no tool does.
Everyone who touches the agent or sensitive data is trained, including house managers, peers, front desk, and night staff.
Staff know how to report a mistake the same day without fear of punishment.
We review a sample of real transcripts as a team at least monthly.

7. Launch

We start small (for example, after hours only) with a person reviewing every conversation for the first few weeks.
We wrote at least 30 realistic test conversations, with no real patient details, and the agent passed them.
The agent is in our HIPAA security risk analysis.
We set a date to decide whether to expand, fix, or stop.

Educational information only, not legal, clinical, or compliance advice. Consult your own legal counsel before acting. Have a healthcare attorney review your setup before any patient or resident information goes into a new tool. Read the full disclaimer and terms of use.

The Behavioral Health AI Agent Readiness Checklist

Get new use cases by email