Private Practice Policy and Procedure Manual: A Therapist's AI Draft

Draft the manual one policy at a time: describe your practice to an AI assistant without any client details, ask it for a one-page policy on each topic, then edit every page against your professional body's code and have a solicitor or insurer review the final version. Add a yearly review date to each page.

The order matters more than the tool. A single prompt that asks for "a full policy manual" returns forty pages of generic text that nobody in your practice will follow. Twelve short prompts, each tied to a real decision you have to make, return something you can defend to a regulator, an insurer or a client who is unhappy. The checking matters as much as the drafting: every number, legal duty and vendor claim in the assistant's text is a guess until you have confirmed it against a source you can name.

Follow me on Instagram@sagnikteaches

What goes in a therapy practice manual, and what stays out

A manual is the written version of decisions you already make every week: what happens when a client cancels late, what you do when someone mentions suicide, who sees the records if you are ill. If a policy does not describe a decision, it is filler. Competitors in this space sell templates that cover everything a large clinic might need. A solo practitioner or a three-room group practice needs less, and needs it written for how they really work.

Connect on LinkedInSagnik Bhattacharya

A workable core list for a small practice looks like this. Each item becomes one page, not a chapter.

Subscribe on YouTube@sagnikteaches

What stays out: clinical technique, anything that reads like marketing, and any text copied from another practice that you have not tested against your own diary. Also leave out client examples. Illustrations in a manual are invented, never drawn from a real case.

The prompt that sets up every section

Before drafting any policy, give the assistant a short practice profile. Reuse it at the top of every prompt so the sections agree with one another. This is the one place where specifics help, and none of them identify a client.

PRACTICE PROFILE (use for every policy I ask for)
- Solo private practice, one therapist, one room plus online sessions
- Adults only, around 14 clients a week, 50-minute sessions
- Paper-free: notes in a practice-management system, email for admin only
- No receptionist; I answer enquiries myself, usually within one working day
- Member of [professional body]; follow its code of ethics where it conflicts with anything you write
- Write for a reader who is a client or a locum covering for me
- British English, plain words, no legal jargon unless you define it
- Do not invent laws, regulator names or deadlines. Where a legal point depends on where I practise, write [CHECK LOCAL LAW] and stop.

The last line does the heaviest work. It stops the assistant from confidently stating a notification deadline or retention period that is wrong for you. Every [CHECK LOCAL LAW] marker is then a to-do for the review stage, which is far better than an invented fact that looks finished.

The cancellations page, from prompt to usable policy

Take the cancellations section for the profile above. The prompt is short.

[paste practice profile]

Write a one-page cancellations and missed-sessions policy.
Include: notice period, fee for late cancellation, what counts as an exception, how I tell clients and when,
what happens after two late cancellations in a row, and a line on how I handle my own cancellations.
Format: short headed sections, numbered steps, a "Responsible: / Reviewed:" footer.
Mark anything that needs my judgement as [DECIDE].

An illustrative first draft comes back with a 24-hour notice period, the full session fee for late cancellation, a "genuine emergency" exception, and a blanket "no-show clients may be discharged". Four things need your edit:

1. The 24 hours. You know your diary. If a slot is hard to refill within a day, 48 hours may be fair; if you have a waiting list, 24 hours may be generous. Pick the number and write it as a number of hours, not "reasonable notice".
2. The full fee. Say 50 per cent, say 100 per cent, but say it. Check it against what your client agreement already says, because the manual cannot quietly contradict the contract.
3. "Genuine emergency". Replace it with the cases you will actually waive: hospital admission, bereavement, a serious accident, a client in crisis. Say who decides (you) and that you decide case by case.
4. "May be discharged". This is a clinical and ethical decision, not an admin rule. Rewrite as: "After two consecutive late cancellations or missed sessions I will contact you to talk about whether the current arrangement is working." That keeps the human conversation in front of the sanction.

After the edit the page is about 280 words, reads as yours, and is consistent with the contract. If you want to go deeper on this one section, the cancellation policy tutorial covers fee wording and reminders.

Prompts for the sections that carry risk

Confidentiality and its limits

Ask for a client-facing version and a practitioner version separately. The client-facing page is two paragraphs of plain words. The practitioner page lists the situations where you would breach confidentiality and who you would tell. The assistant is good at structure here and poor at law, so keep the legal triggers as [CHECK LOCAL LAW] until you or a professional fill them in.

[paste practice profile]

Write two versions of a confidentiality policy.
1) Client-facing: under 200 words, warm and plain, saying what stays private and the usual limits.
2) Practitioner-facing: a table with columns "Situation", "What I do", "Who I tell", "What I record".
Include rows for: risk of serious harm to self, risk to others, risk to a child, court order, supervision,
a client who has died, an insurer or regulator request. Use [CHECK LOCAL LAW] for any legal duty.

Sample output row, illustrative: "Supervision | I discuss anonymised material with my clinical supervisor | Supervisor only; no name or identifying detail | Date and supervisor in my own log". Check the word "anonymised". Your supervision contract may need to say more than that.

Emergencies and risk

Here the assistant must not write clinical protocol. Use it to lay out a one-page flow chart in words, built from your own decisions. List your steps first, then ask it to tidy them.

Here are my steps when a client says in session that they intend to end their life:
1) Stay with them and ask directly about plan, means and timing
2) Agree a safety plan, using the template I use already
3) If risk is high and they will not agree a plan, I contact [emergency contact / emergency services]
4) I record what was said, what I did and why, the same day
5) I tell my supervisor within 24 hours
Turn these into a one-page procedure for a locum who has never met the client. Keep my steps and my order.
Add a "Before you start: what you need in the room" list and a "Phone numbers to keep to hand" table.
Do not add clinical steps I have not listed.

Notice what is happening: you supply the substance, the assistant supplies the layout. The risk section is where an AI draft that invents steps does the most harm, because a locum may follow it under stress.

Complaints

Ask for three stages: informal conversation, written complaint with an acknowledgement time, and a named outside route such as your professional body. Specify your own reply times, for instance acknowledge in 3 working days, reply in full within 20. A complaints policy that lists reply times you cannot meet is worse than none, so set them against a busy fortnight, not a quiet one.

The AI use section: write it before a client asks

Your own manual now needs a policy about AI, which is a small irony and an important page. It does three jobs: it tells clients what you do, it tells any locum or assistant what is forbidden, and it forces you to decide. Keep it concrete.

Write a one-page "Use of AI and technology" policy for the practice profile above.
My actual position:
- I use an AI assistant for policy drafting, admin letters and template wording only, with no client information
- I do not enter client names, session content, notes or identifying details into any AI tool
- I [do / do not] use an AI transcription or note-taking tool in sessions. If I do: [tool name], only with written consent from each client, recordings deleted after [X] days
- Clients are told in my client agreement and on my website
- Any new tool needs a privacy check by me before first use
Structure: Purpose, What I use AI for, What I never put into AI, Client consent, Review of tools, Responsible person.
Do not describe any vendor's privacy features; I will check those myself.

Two points to edit afterwards. First, vendor claims change: a line such as "the tool does not store recordings" must come from the vendor's current documentation, not from the assistant. Second, if you do use an AI note tool, the consent wording must match what the tool actually does with the audio and transcript. The tutorial on safe AI uses for counsellors sets out tasks that never touch client notes, and the note generator tutorial shows a bullet-based workflow if you decide notes are in scope.

Data breach response: the one-page first hour

A breach in a therapy practice is usually small and human: an email to the wrong client, a laptop left on a train, a shared calendar that showed session titles. The policy should assume that and give the person on duty, often you alone, a short list.

1. Contain it: recall the email, change the password, lock or remotely wipe the device.
2. Write down what happened, when you found out, whose data and what kind.
3. Decide whether it is likely to harm the people affected. Record the reasoning.
4. If your data-protection law has a notification duty, find out the deadline now. Where the GDPR applies, Article 33 says the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people's rights and freedoms; a later notification must give reasons for the delay.
5. Tell the affected clients in plain words if the risk is high, and tell your insurer if your policy requires it.
6. Log it, whether or not you report it, and review what to change.

Ask the assistant to produce the page and a one-table breach log: date found, date happened, description, data type, number of people, risk decision, who was told, action taken. Keep the legal bullet marked until you have confirmed it for your jurisdiction.

A mistake worth planning for: the confident wrong number

An illustrative case. A draft records section says "client records must be kept for 7 years after the last session", stated flatly. For adult clients that may match your insurer's guidance. For records relating to children, it will usually be longer, often until the child reaches a certain age plus a number of years. A practitioner who adopts the sentence unchecked has a policy that tells them to destroy a young client's records too early. The fix is procedural: every number in the manual (retention periods, notice periods, deadlines) goes into a short "Figures to verify" list at the end of the review stage, each with the source you checked and the date.

Review by a person: what to send and to whom

When all the pages are edited, there are three kinds of review, and they catch different faults.

You will not always need all four. A one-hour solicitor review of five pages is a modest and bounded request, and the cost depends on the firm, so ask for a quote before you send anything. State plainly in your email that the draft was written with AI assistance and edited by you; most professionals prefer to know where the weak points are likely to sit.

Keeping the manual alive: a review cycle that takes an hour a quarter

A manual that was right in March and wrong by September is a liability. Three triggers keep it current.

• Calendar trigger: each page carries a review date, and you put the next one in your diary at the moment you sign off. Annual for most pages, six-monthly for AI use and data breach, because tools and vendor settings move faster than ethical codes.
• Event trigger: any incident, complaint or near miss starts a ten-minute question: should a policy change? A late-night email to the wrong person is a near miss worth a log line.
• Change trigger: a new tool, a new room, a move to online work, a new professional-body code, or hiring an assistant all reopen the relevant pages.

Use the assistant for the update, too. Paste the current page (policies, not client data) and describe the change: "I now see clients online two days a week; update the online sessions and emergencies pages to cover location checks and a local emergency contact for the client's address". Then compare the old and new text side by side, accept only the lines you meant to change, and add the date.

A quarterly one-hour routine is enough: 15 minutes on the incident log, 15 on tool and settings changes, 30 on the pages whose review date is due. If you want a hand setting up that routine with your own tools, my AI implementation consultation covers it.

Version control that a solo practitioner will actually use

Keep one master document, not ten files. Put a version table on page one: version number, date, what changed, who approved. Save the previous version as a PDF in an archive folder named by date. If a client complaint turns on what your cancellation policy said in March, you can show exactly which version applied. Store the manual somewhere access-controlled with a backup, and share clients only the relevant pages, not the internal procedures such as the breach response.

Two more filled-in examples to copy the pattern from

Practice continuity, written for a practice of one

The problem: if you are suddenly unable to work, clients have no way of knowing. The fix is a named colleague, a sealed or digital instruction and a client-facing line. Illustrative wording the assistant can draft from your facts: "If I am unable to continue seeing you because of illness or other emergency, my practice executor, [name], has authority to contact you using the details in my booking system, tell you I am unavailable, and arrange the safe return or transfer of your records according to your wishes." Edit it with the executor's agreement in writing, and confirm the arrangement with your solicitor, because records and death are legal topics.

Online sessions: a table the locum can use

The assistant can build this table from your answers in seconds. Your job is to make sure every cell describes something you actually do.

The client-facing summary: what to publish and what to keep internal

Clients do not need your breach log or your locum instructions, but they do need a short, readable version of the rules that affect them. Ask the assistant to produce a "How I work" page from the finished manual: one side of A4 covering session length and fees, cancellations, confidentiality and its limits, how to complain, how to reach you between sessions and what to do in a crisis, plus one sentence on how you use technology. Give it your edited policies as the only source and tell it to add nothing new. Then compare the summary line by line with the full pages, because a summary is where a softened or hardened rule quietly slips in.

Send the summary with the client agreement and keep a dated copy of what each client received. A practical test of length: if the page needs a second side, a policy underneath it is probably too complicated and needs trimming. Internal pages, such as the incident log and the continuity instructions, stay in the master document and are shared only with the people who act on them, for example your named practice executor or a covering colleague.

How to tell the manual works

Before you call it finished, run three tests. A stranger test: give the emergencies page to someone outside the profession and ask what they would do first. A contradiction test: search the manual and the client agreement for each number (hours, fees, days) and make sure they match. A drill: once a year, walk through a pretend breach with the log, using only the manual. Where you stumble, the page needs rewriting.

For adjacent work, the psychotherapy enquiry replies and fee policy tutorial turns your fee page into consistent first replies, and the patient data checklist is a useful companion to the confidentiality and records pages. For the wider question of what AI policy wording looks like in other professions, see how to write an AI usage policy.

Questions therapists ask before using AI on a manual

Can I paste real client details into the AI to make the policies fit?

No. A policy manual never needs a client's name, history or session content. Describe your practice in general terms: solo, online and in person, about 15 clients a week, adults only. If a draft needs an example, invent one. That keeps the whole exercise clear of client confidentiality.

Do I have to tell clients that the manual was drafted with AI?

The manual itself is your document, and you are responsible for every word once you adopt it. What clients must be told is how AI touches their care or data, for example if you use a transcription tool. That belongs in your AI use section and your client agreement, not in a note about how the manual was written.

How long should the manual be?

For a solo practice, 10 to 20 pages is typical: one short page per policy, each with a purpose, the rule, the steps, who is responsible and a review date. Longer usually means nobody reads it. Put detail in forms and checklists the manual points to.

Which AI tool should I use for this?

Any current assistant can draft policy text, because you are not giving it client data. Choose one whose privacy settings you understand, switch off training on your chats where the plan offers that, and keep your own practice description, not client material, in the prompt.

Further reads

• AI Acceptable Use Policy for a Small Professional Firm — Another view of how to word an AI use policy.
• How to Keep Customer Data Private When Your Team Uses AI — Practical habits that keep client data out of AI tools.
• How to Roll Out an AI Policy So Staff Actually Follow It — How to get an assistant or locum to follow the rules.
• AI for Psychotherapists: Plan and Fill a New Therapy Group — If you add group work, your manual needs a page for it.
• AI for Mental Health Providers: A Roll-Out Plan for Group Practices — A seven-step roll-out sequence for a group therapy practice, with consent wording, an approved-tool list and a 90-day review.
• Adult Day Care Software for a Small Centre: Billing and AI Notes Checklist — A grouped checklist for a small adult day centre choosing software for attendance, transport, billing and care notes, with AI drafting kept under review.
• AI Marketing for Therapists: What to Say and What to Leave Out — Testimonial and outcome-claim rules as the spine: before-and-after examples for a directory profile, website copy and a newsletter drafted with AI.
• Mental Health Services AI: Intake, Waitlist and Referral Admin Jobs — A checklist of the intake, waitlist and referral admin jobs AI can take on in a mental health service, and the lines it must never cross.
• Can AI Draft Mental Health Treatment Plans? The Review Steps — A clinician review checklist for AI-drafted treatment plans: who owns the goals, what the AI may format, and what to check before sign-off.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: general professional-practice conventions for therapy records, confidentiality and incident handling; GDPR Article 33 on breach notification, read on EUR-Lex in November 2026; vendor privacy settings pages (check yours).