Privacy Law Library

Prohibited Uses of Artificial Intelligence in Mental Health Services

VT AI Mental Health Law

Artificial intelligence · Health

Bars companies from offering mental health services to the public, including AI therapy chatbots, unless a licensed or rostered mental health professional provides them or they are part of an approved IRB or privacy board study. Professionals may use HIPAA-compliant AI tools and FDA-authorized digital therapeutics if they review and approve the services.

Where
Vermont
Citation
18 V.S.A. § 7115, added by 2026 Acts and Resolves No. 156 (H.816); see also 3 V.S.A. § 129a and 26 V.S.A. § 1354 as amended
Status
In force
In force since
2026-06-17
Enforced by
Vermont Attorney General (Consumer Protection Act); Office of Professional Regulation and Board of Medical Practice for licensees
People can sue
Yes
Penalties
A violation by a corporation or entity is a Consumer Protection Act violation; the AG has chapter 63 authority (civil penalties up to $10,000 per violation) and private parties have the same rights and remedies as under 9 V.S.A. ch. 63, subch. 1. Prohibited AI use by professionals is unprofessional conduct.
Applies to
  • Corporations and entities that provide, advertise or offer mental health services to the public, including through AI
  • Licensed mental health professionals (through unprofessional conduct rules)

Practices it requires

  • Do not provide, advertise or offer mental health services, including AI-delivered therapeutic communications or decisions, unless a mental health professional provides them or they are part of an approved IRB or privacy board study.18 V.S.A. § 7115(b)
  • Professionals may use only HIPAA-compliant AI tools and must review and approve any mental health services the tools produce.18 V.S.A. § 7115(d)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Included because the library's scope covers AI-related health and disclosure laws; this is mainly a practice-of-care rule rather than a data privacy law.

Research reference, not legal advice.