Cody Saunders, LMSW · Responsible AI for Behavioral Health
Use this checklist with sellers and your team. Record each answer, proof, who checks it, and the next step.
Choose one clear task, such as drafting care notes. Measure the time it takes now. Set a goal before you buy.
Ask for: A task, a starting measure, and a goal.
Test the tool in your care setting. Include the languages and people you serve. A sales demo alone does not show a good fit.
Ask for: Tests and examples that match your work.
List allowed tasks and uses to avoid. Staff should know when to use AI and when to use their usual process.
Ask for: A list of uses, limits, and tasks to avoid.
Ask how the tool was tested and who took part. Read results from outside groups when you can. Keep test results separate from sales claims.
Ask for: Test methods, results, and who was tested.
Track time saved, fixes, care quality, staff views, and costs. Set goals for a small trial before buying.
Ask for: A trial plan with clear goals.
Put data rights in the contract. Include data you enter, results, notes, and new data made from them. State how you can view and take out your records.
Ask for: Written terms for each type of data.
List the data types, where they are stored, and who uses them. Include other firms the seller hires. Give the map to your privacy and security teams.
Ask for: A data map and a list of firms involved.
Set how long recordings, requests, results, logs, and backups stay. Confirm how they will be deleted, even after you stop using the tool.
Ask for: A written schedule and deletion terms.
Ask if the seller reuses data, results, or logs to improve AI. Decide what you allow. Put clear limits in the contract.
Ask for: Written data-use rules and settings.
Ask your privacy and legal teams which rules apply. Some uses need a business associate agreement, called a BAA. Get it in place before use if required. A BAA alone does not complete the review.
Ask for: Required contracts and your team’s review.
Check who can sign in and see data. Review encryption, which protects data by coding it. Check security tests and support access. Name the tasks your own team must do.
Ask for: Security reports, access rules, and each team’s duties.
Test examples from real types of work. Make sure staff can spot and fix mistakes. Set how staff report them and how the seller will help.
Ask for: Sample results and a clear process for fixes.
Ask for tests by language and group. Check ease of use for people with disabilities. One overall score may hide differences.
Ask for: Group and language tests, access tests, and known limits.
Name who checks and signs off before results go into care or records. Give staff time to review. Teach each person their role.
Ask for: A review process with named roles.
Staff need ways to edit, reject, or stop results. Keep another way to do the task. Test that process for outages or pauses.
Ask for: A demo of controls and a backup process.
Explain why you use AI, what data it uses, and what choices clients have. Ask the right reviewers which notice and consent rules apply.
Ask for: Approved client information and consent steps.
Test links to your electronic health record, called an EHR. Check what data goes in and out. Name who sets up and maintains the link.
Ask for: A full test of the links and clear setup duties.
Measure the full task, including setup, fixes, and repeat typing. Ask staff what helps and what adds work.
Ask for: Task times before and after use, plus staff views.
Plan lessons, examples, refreshers, and help channels. Give staff time to learn. Make sure leads know how to support them.
Ask for: A training plan and named support contacts.
Count fees, use limits, setup, links to other tools, training, review time, upgrades, and exit costs. Compare that total with the results you measure.
Ask for: All prices, cost assumptions, and contract terms.
Name a lead. Include care, IT, privacy, security, buying, and compliance staff as needed. Record approval and allowed uses.
Ask for: A lead, review notes, and use limits.
Check if you can track access, results, edits, and key actions. Keep logs safe. Set how long they stay.
Ask for: A demo of logs and rules for access and storage.
Require notice of key changes to AI models, features, other firms, and data use. Set when your team must review the change.
Ask for: Written notice terms and review triggers.
Use your team’s usual reporting process. Name seller contacts, response times, and who can pause use. Plan how to check and fix the issue.
Ask for: A response plan and written seller duties.
Set dates to review results. Plan how to take out records, delete data, end the contract, and switch to another process.
Ask for: Review dates and an exit plan.
This checklist is for learning and planning. It does not prove that a tool meets standards. Your care, legal, privacy, and security teams must still review it.
Prepared October 2, 2026 · Cody Saunders, LMSW