⚠️ Is your AI scribe training on patient data? (OCR Warning)

Google Core Update targets "AI Fluff" and prioritizes Local Authority

On February 5, 2026, Google rolled out the February 2026 Core Update, which explicitly separates "Search" signals from "Discover" signals for the first time. Early data shows a massive volatility shift: Google is aggressively de-ranking therapy websites relying on thin, AI-generated blog posts that lack "demonstrated local expertise."

This update penalizes "AI Fluff", generic, perfectly written articles that could apply to any therapist in any city. If your website is full of content that looks like it was written by a machine (smooth but vague, with no local flavor), Google now views it as "low value." To rank in 2026, you must establish an irrefutable handshake between Google and AI. This means every piece of AI-assisted content must be anchored by something AI cannot fake: your specific local knowledge and your real-world clinical experience.

👉 Action: Audit your last 5 blog posts immediately. If they were AI-generated, rewrite the introductions to include specific local references (e.g., "Here in [City Name]...") and personal clinical anecdotes. Add an "Author Bio" to every page linking to your Psychology Today or LinkedIn profile.

OCR enforcement targets "Shadow AI" and unvetted scribe tools

On February 10, 2026, legal analysts reviewing the Office of Civil Right's 2026 enforcement priorities identified a major new target: "Shadow AI." This refers to therapists independently using convenient AI tools, like generic note-takers, Otter.ai, or standard ChatGPT, without a signed Business Associate Agreement (BAA).

The shocking detail for practice owners is the "Model Training Risk." Regulators are noting that simply deleting a patient's data after a session is insufficient if that data was used to "train" the AI model in the interim. If you used a non-compliant tool that trains on user data, you may have permanently exposed PHI in a way that cannot be "scrubbed," technically constituting a reportable breach for every single client recorded.

👉 Action: Audit your phone and browser extensions today. If you or your staff use any AI tool for notes that does not have a signed BAA specifically with your practice, stop immediately. Do not just "delete" the account; export your data first, then request a formal "data deletion" from the vendor's legal team to attempt to mitigate the training breach.

FTC issues warning letters to health data brokers (Lead Gen Risk)

On February 9, 2026, the FTC sent warning letters to 13 data brokers regarding the illegal sale of sensitive health and location data to foreign adversaries, citing violations of the Protecting Americans' Data from Foreign Adversaries Act. Violations carry fines up to $53,088 per violation.

Why this shocks therapists: Many practices use third-party "lead generation" services or "marketing lists" that aggregate potential client data. If you are buying leads from a vendor that scrapes data non-compliantly, you could be implicated in a chain of privacy violations. The FTC is signaling a zero-tolerance approach to health data commodification.

👉 Action: Review your marketing contracts if you purchase leads or use "client finder" services. Ask your vendor for a written confirmation of their data sourcing compliance. If you use a "pixel" or tracker on your website for retargeting, ensure it is not sharing data with unvetted third parties.

Medicare Telehealth Flexibilities officially extended to 2027

On February 3, 2026, the Consolidated Appropriations Act of 2026 was signed into law, officially extending key Medicare telehealth flexibilities through December 31, 2027. This includes the waiver of geographic restrictions (clients can be at home) and the allowance of audio-only visits for mental health.

However, the "in-person visit requirement" (seeing a patient in person within 6 months of starting telehealth) remains a complex compliance trigger that will effectively "reset" in 2028. While this is a reprieve, practices must not get complacent; payers are starting to audit "audio-only" claims to ensure they meet the specific clinical necessity criteria (video was not available/patient refused).

👉 Action: Update your billing cheat sheets. Confirm that you are using the correct Place of Service (POS) code (usually 10 for home telehealth) and modifier (93 for audio-only). Document specifically in the client's chart why a video visit was not possible if you conduct an audio-only session, to protect against future audits.

CMS finalizes reimbursement for "Digital Mental Health Treatment" devices

Effective January 1, 2026, but widely rolling out now in February, CMS has finalized payment policies for new HCPCS codes related to Digital Mental Health Treatment (DMHT) devices. This allows therapists to potentially bill for the use of FDA-authorized software and apps used as an adjunct to therapy (e.g., for ADHD or CBT reinforcement).

This is a massive opportunity that many therapists are missing. It shifts AI/Software from a "cost" to a "reimbursable service." However, it only applies to FDA-cleared devices, meaning using a generic "AI Chatbot" or "Wellness App" does not qualify and could lead to billing fraud if coded incorrectly.

👉 Action: Research the new DMHT codes (specifically G-codes for digital therapeutics). Contact your billing provider this week to ask if any of the digital tools you currently recommend (like prescription digital therapeutics) are on the approved list. Do not attempt to bill these codes for standard apps like Calm or Headspace.

Quick wins for the week

• Check your phone for "Shadow AI" apps (like free recorders) and delete them if they lack a BAA.
• Rewrite the intro of your latest blog post to include your city name and a personal "I" statement.
• Verify your "Special Hours" for upcoming Presidents' Day rather than using the "Closed" status button.
• Document "Video Not Available" in the clinical notes for every single audio-only Medicare session you hold this week.
• Ask your marketing agency (if you have one) to confirm in writing that their data sources are FTC compliant.
• Check your website's "About" page to ensure your specific state license numbers are visible.

Final thoughts

This week is a perfect example of the "split reality" therapists face in 2026. On one hand, you have a massive win with the Medicare telehealth extension through 2027, a rare moment of stability. On the other, the hidden risks of "Shadow AI" are becoming clear. The convenience of using a free AI note-taker today could turn into a permanent data breach tomorrow if that tool is training on your confidential sessions.

The FTC's aggressive move against data brokers reinforces that the "wild west" of digital data is over. Using compliant tools isn't just about ethics anymore; it's about survival. The shift toward "Local Authority" in search means your unique voice and community presence are now your best SEO assets, something AI can't fake.

While you're providing therapy, we're monitoring policy changes, protecting your Google presence, and optimizing for AI search. You shouldn't need to become an SEO expert, compliance specialist, and tech strategist on top of being a therapist.