A year of this newsletter, and Headway's paused contract

Headway paused its new therapist contract. Read it before you sign

On October 14, 2026, Headway posted a new provider contract asking therapists to sign by November 17. Section II.E gave Headway a perpetual, worldwide, royalty free right to use a provider's name, likeness, voice and image in any media, with no extra pay and no approval rights. A non-solicitation clause barred providers from seeing Headway sourced clients for 12 months after leaving. CEO Andrew Adams paused the rollout on October 16, saying it was read in ways Headway never intended. As of November 4, the original version is still posted with no revision.

Separately, a Headway help article updated November 2 confirms the US$9.99 per session fee applies to clients sent through health plans or AI tools like ChatGPT, for as long as you see them. Clients who find you directly through your own link or a search engine carry no fee.

Do this now:

Do not sign the October 14 contract until a revised version is posted.
Check Headway's legal center weekly for updates before the November 17 deadline.
Strengthen your own website and Google presence so direct bookings reduce your exposure to per session fees.

People can now pull their health records into Claude

On November 2, 2026, athenahealth launched athenaPatient MCP, a connector that lets US Claude Pro and Max subscribers link their athenahealth records to Anthropic's Claude. Once connected, Claude can read lab results, vitals, medications, conditions, immunizations, visit history, diagnostic reports, allergies, procedures and care plans. Users sign in with their athenahealth credentials, choose what to share, and can revoke access anytime. The announcement says nothing about HIPAA compliance, data retention or whether shared records train Anthropic's models.

Most therapy practices do not use athenahealth, but this signals a broader shift: clients are increasingly bringing their own health data into AI tools before, during and after treatment. Expect more clients to ask AI chatbots questions about their care, including questions about you.

Do this now:

Ask new clients if they have used AI tools to research symptoms or treatment options.
Review what information about your practice is publicly visible, since AI tools often pull from public listings.
Watch for similar record-sharing features from other EHR vendors your referral sources may use.

AI tools run several searches before they recommend you

Google's Search Central documentation confirms that AI Overviews and AI Mode use a technique called query fan-out: the system runs multiple related searches across subtopics to build a single answer. Google repeated this at a Search Central Live event in October 2026, adding that these fan-out queries never appear in Search Console, so you cannot see them directly. An industry guide published November 1, 2026 recommends answering likely follow-up questions directly on your site, with a clear answer in the first sentence under each heading.

For therapy practices, the predictable follow-ups are fees, insurance, superbills, waitlist status, telehealth availability and who you work with. Pages that answer these clearly are more likely to surface across the full fan-out, not just the main query.

Do this now:

Add a clear first sentence answer under headings for fees, insurance and waitlist status.
Create or update a page addressing telehealth availability and who you specialize in treating.
Test your own practice name in Perplexity or ChatGPT to see what comes back.

The HIPAA Security Rule update is now expected in 2027

The HIPAA Journal's State of HIPAA 2027 report, published October 13, 2026, says the Security Rule final rule now has a revised OMB target of July 2027, after the May 2026 target was missed. The rule is expected to be based on the December 2024 proposal, which drew more than 4,700 public comments and included mandatory multi-factor authentication, encryption, network segmentation, penetration testing, annual internal audits and vulnerability scans every six months.

Separately, a proposed rule expected by November 2026 would shorten the right of access response time from 30 days to 15. The report also notes OCR is actively penalizing late breach notifications. Small practices are expected to find the compliance burden heavy once the rule finalizes.

Do this now:

Start documenting your current security practices now, including MFA and encryption status.
Check your breach notification process to ensure it meets current timelines, not just the proposed 15 day one.
Budget for a security risk assessment before mid-2027 when the rule is expected to finalize.

New AI-powered EHRs are pitching therapists to leave TherapyNotes

An October 13, 2026 roundup lists five behavioral health EHR platforms marketing AI documentation features as alternatives to TherapyNotes, whose Solo plan is listed at US$69 per month. The alternatives include TheraNest's AI Session Assistant at US$35 per clinician monthly, plus Alehra, EHR Your Way, MDHub and Upheal, which charges US$1 per session capped at US$69 per provider monthly. The article is tagged sponsored, and it states plainly there is no evidence of an industry-wide migration away from TherapyNotes.

Time savings and user counts in the piece are vendor claims, not independent data. If you are considering a switch, treat this as a starting point for research, not a signal that you are falling behind.

Do this now:

Request a data export sample from any new EHR before signing a contract.
Ask each vendor directly how AI generated notes are stored and whether they train models on your data.
Compare total monthly cost at your actual session volume, not just the advertised starting price.

Quick wins for the week

Check Headway's legal center before November 17 to confirm whether the contract has been revised.
Add a direct answer to your most common client question, like fees or insurance, right under its heading on your website.
Search your own practice name in an AI chatbot to see what information currently surfaces.
Confirm your current breach notification process meets timelines before the proposed rule shortens them.

Final thoughts

This week's stories share a common thread: control over your information is shifting away from you, whether it's a marketplace asking for rights to your likeness, a client's health records flowing into a chatbot, or an AI tool deciding how to answer questions about your practice without showing you the query. None of this is hypothetical. The dates are specific, the deadlines are real, and the fine print matters more than ever.

Staying current on contract clauses, search algorithm changes, HIPAA timelines and EHR vendor claims is a full time job on its own, on top of running a practice and seeing clients. While you're providing therapy, we're monitoring policy changes, protecting your Google presence, and optimizing for AI search. You shouldn't need to become an SEO expert, compliance specialist, and tech strategist on top of being a therapist.

One more thing: this newsletter is now a year old. Since last September we've tried to tell you what changed in Google and AI search, and what to do about it, in a few minutes of reading. Thank you for opening it, replying to it and forwarding it to colleagues. If it's been useful, the best birthday present is sending it to one therapist who'd want it.