By Cody Saunders, LMSW · Educational edition · October 12, 2026
AI in behavioral health raises connected questions about people, information, and responsibility. This framework brings those questions together in five domains, or areas: Clinical Appropriateness, Privacy & Security, Reliability & Safety, Human Oversight, and Governance & Accountability.
These domains organize learning and discussion. They are not a validated assessment, approval process, clinical guideline, or implementation procedure. The framework does not certify a tool or determine compliance. Decisions in a real setting belong to qualified professionals and the responsible organization.
Why the task matters
A public staff agenda, a visit transcript, and a treatment suggestion are different uses. They can have different effects on privacy and care. Even an office task can involve confidential health information. The label “AI” says little about those differences.
A product may offer several features with different data paths. A writing feature and an audio recorder can share a name without sharing the same purpose or permissions. This is why educational discussions focus on the specific use rather than a brand alone.
Clinical Appropriateness
This domain concerns the relationship between a tool's purpose, evidence, and the people affected. Help with organizing words differs from making a clinical judgment. A fluent draft does not establish a diagnosis or an appropriate treatment choice.
Evidence also has a scope. Research on physician notes in one setting cannot establish better psychotherapy outcomes elsewhere. A vendor demonstration is different from independent research. Language access, disability, culture, and the care relationship may affect whether a use fits a particular setting.
These are questions of fit, not a clinical assessment supplied by this framework. Professional competence and applicable standards remain separate responsibilities. The NASW Code of Ethics discusses competence in technology use for social workers. It is a professional standard, not a universal AI law.
Privacy & Security
Privacy concerns how information is collected, used, stored, and shared. Security concerns protections against inappropriate access or loss. Audio, transcripts, draft notes, logs, and connected services can each add to the data path.
A setting that turns off model training does not by itself establish that data is never stored or accessed. A client's permission and a vendor agreement answer different questions. HHS explains that covered cloud arrangements involve business associate agreements and other HIPAA duties. Those duties depend on the entity, information, and arrangement. HHS cloud guidance
Some records have additional protections, including covered substance use disorder records under Part 2. State law, professional duties, and contracts can also matter. This framework cannot determine which rules apply to a particular disclosure. The data-handling worksheet is a general educational aid for understanding data paths, not a legal review.
Reliability & Safety
An AI answer can be wrong while sounding confident. NIST calls this false generated content confabulation, often called a hallucination. An output may also omit context, misidentify a speaker, or repeat unfair patterns. NIST Generative AI Profile
Accuracy depends on the tool, task, information, and way performance is measured. An overall score may hide differences across languages or groups. A small test may miss rare errors. A generated explanation is not a reliable record of how the model reached its answer.
Reliability questions include how errors become visible and what happens when a system changes or is unavailable. This framework does not supply a passing score, safety threshold, test protocol, or permission for live use.
Human Oversight
Oversight means more than a person clicking “approve.” It depends on access to relevant facts, appropriate skill, enough time, and the ability to question an output. A reviewer can also place too much trust in polished software output, a concern called automation bias.
Care judgments and office tasks may call for different expertise. Responsibility for a final record or decision does not move to a chatbot because it produced the words. Review effort is also part of the workload and cost of a tool.
The human-in-the-loop article explains this distinction. It offers educational discussion rather than a clinical review procedure.
Governance & Accountability
Governance describes the roles and rules used to make decisions. Accountability concerns who answers for them. These ideas apply to visible tools and AI features inside familiar software.
Questions include who knows about a use, whose views are represented, how changes are noticed, and where responsibility lies when a result is wrong. A generated explanation is not the same thing as an organizational record. Local policies are different from laws and professional standards.
NIST's AI Risk Management Framework provides voluntary guidance. Its named functions are govern, map, measure, and manage. Cody's five domains are an educational organizing approach, not NIST's functions or an endorsed standard.
An illustration, not a protocol
Imagine a proposed note tool. Its purpose raises Clinical Appropriateness questions. Its recording and logs raise Privacy & Security questions. Missing or invented facts raise Reliability & Safety questions. The clinician's ability to judge a draft raises Human Oversight questions. Who owns decisions and notices changes raises Governance & Accountability questions.
The same proposal touches all five areas. No single good feature resolves every concern. This made-up illustration does not show that the tool is suitable, safe, or permitted. It does not set an approval sequence.
Possible value and evidence limits
Less paperwork, manageable workloads, and more room for human connection are worthwhile goals. Drafting speed alone does not establish those gains. Total effort can include review, corrections, setup, and support. Time saved is different from cash saved, and either is different from a measured care outcome.
The purchasing questions offer more educational context. The companion governance article uses these same five domains, without a separate assessment or implementation framework.
Sources and scope
This evolving guide is general educational information only. It does not provide clinical, legal, security, compliance, or implementation advice. Source scope reviewed October 12, 2026. Specific requirements and decisions need qualified review in the relevant setting.
- NIST AI Risk Management Framework: voluntary risk guidance.
- NIST Generative AI Profile, July 2024: generated-content risks and limits.
- HHS cloud computing guidance: HIPAA duties within its scope.
- HHS Part 2 guidance: protections for covered substance use disorder records.
- NASW responsibilities to clients: social work professional standards.