Maine P.L. 2026, c. 687 (L.D. 2082, AI in mental health services)

Binding law — in force

Maine licensees using AI in therapy must comply with privacy law and ensure the AI technology complies too (Maine LD 2082)

32 M.R.S. § 2113(6) (and the same text in the six other sections) · official text · In force: applies since 29 Jul 2026 · Maine (US-ME)

32 M.R.S. § 2113(6) and the six identical sections require a licensee using AI under the section to comply with all state and federal confidentiality and privacy laws and to ensure that any AI technology complies with them. Detect session notes, transcripts or other client records sent to a model API with no business-associate, HIPAA-eligible endpoint or de-identification safeguard.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Maine licensees under the seven Title 32 chapters that P.L. 2026, c. 687 amends (32 M.R.S. §§ 2113, 2600-G, 3300-J, 3820-A, 6207-D, 7009 and 13870; in §§ 2600-G, 3300-J, 3820-A and 13870 also persons privileged to practice under them) who use AI in delivering therapy or psychotherapy services. Vendors of practice software are reached through what the licensee may allow the AI to do. Which confidentiality and privacy laws govern a given AI vendor is a legal question. In force since 2026-07-29.
• Not covered:
  • AI-based interventions used solely within a research project approved by an institutional review board (as defined in 22 M.R.S. § 1711-C(6)(G)) and conducted under applicable federal human-subjects protections (32 M.R.S. § 2113(9) and the same subsection of the six other sections)
• Whether it applies depends on facts outside the code; a person has to decide.

client = OpenAI()
resp = client.chat.completions.create(model='gpt-4o', messages=[
    {'role': 'user', 'content': f'Summarize: {patient.clinical_note}'}])

VENDORS = load_yaml('vendors/ai_vendors.yaml')   # baa_signed, zero_data_retention per endpoint

def phi_client(name: str) -> tuple[AzureOpenAI, str]:
    v = VENDORS[name]
    if not (v['baa_signed'] and v['zero_data_retention']):
        raise PermissionError(f'{name} is not cleared for PHI')
    client = AzureOpenAI(azure_endpoint=v['endpoint'], api_key=os.environ['AZURE_OPENAI_KEY'],
                         api_version=v['api_version'])
    return client, v['deployment']

client, deployment = phi_client('azure-openai-hipaa')
resp = client.chat.completions.create(model=deployment, messages=[
    {'role': 'user', 'content': f'Summarize: {patient.clinical_note}'}])

Rule id me-ld2082.ai-privacy-compliance · review status: primary source derived

Binding law — in force

Maine licensees need written notice and consent before AI supports a recorded session, and may not deny care for refusing (Maine LD 2082)

32 M.R.S. § 2113(3) (and the same text in the six other sections) · official text · In force: applies since 29 Jul 2026 · Maine (US-ME)

Under 32 M.R.S. § 2113(3) and the six identical sections enacted by P.L. 2026, c. 687, a licensee may use AI for supplementary support (records and therapy notes, progress analysis, resource referrals) only when the session is recorded or transcribed and only after the client or legal representative is told in writing that AI will be used, its specific purpose, and how session data collected by AI will be stored, retained, used for training and deleted when therapy ends, and gives consent. Consent is an explicit, affirmative, revocable written act (electronic or initials on a specific section of the general consent to treatment); accepting broad terms of use, hovering or closing content, and deception do not count. A licensee may not deny or refuse therapy solely because the client declines AI, and a client's waiver is void. Detect session recordings or transcripts reaching AI with no consent check, consent bundled into terms, and copy that makes AI consent a condition of care.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Maine licensees under the seven Title 32 chapters that P.L. 2026, c. 687 amends (32 M.R.S. §§ 2113, 2600-G, 3300-J, 3820-A, 6207-D, 7009 and 13870; in §§ 2600-G, 3300-J, 3820-A and 13870 also persons privileged to practice under them) who use AI in delivering therapy or psychotherapy services. Vendors of practice software are reached through what the licensee may allow the AI to do. In force since 2026-07-29.
• Not covered:
  • AI-based interventions used solely within a research project approved by an institutional review board (as defined in 22 M.R.S. § 1711-C(6)(G)) and conducted under applicable federal human-subjects protections (32 M.R.S. § 2113(9) and the same subsection of the six other sections)
• Whether it applies depends on facts outside the code; a person has to decide.

def draft_note(session):
    with open(session.audio_path, 'rb') as f:
        transcript = client.audio.transcriptions.create(model='whisper-1', file=f).text
    resp = client.chat.completions.create(model=MODEL, messages=[
        {'role': 'system', 'content': NOTE_PROMPT}, {'role': 'user', 'content': transcript}])
    return resp.choices[0].message.content

def draft_note(session):
    consent = db.consents.get(client_id=session.client_id, purpose='ai_scribe')
    if consent is None or consent.signed_at is None or consent.revoked_at:
        raise ConsentRequired('written AI-use consent for note drafting is missing or revoked')
    with open(session.audio_path, 'rb') as f:
        transcript = client.audio.transcriptions.create(model='whisper-1', file=f).text
    resp = client.chat.completions.create(model=MODEL, messages=[
        {'role': 'system', 'content': NOTE_PROMPT}, {'role': 'user', 'content': transcript}])
    return resp.choices[0].message.content

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Tell people when they are interacting with AI — everywhere, not only where required

Rule id me-ld2082.ai-supplementary-support-notice-consent · review status: primary source derived

Binding law — in force

Maine licensees must not let AI make therapeutic decisions, interact therapeutically with clients, or set unapproved treatment plans (Maine LD 2082)

32 M.R.S. § 2113(4) (and the same text in the six other sections) · official text · In force: applies since 29 Jul 2026 · Maine (US-ME)

32 M.R.S. § 2113(2) and (4), with the six identical sections enacted by P.L. 2026, c. 687, let a licensee use AI only for administrative support (scheduling, billing and claims, logistics messages without therapeutic content) or supplementary support, with full responsibility for all AI interactions, outputs and data use, and bar letting AI make independent therapeutic decisions, directly interact with clients in any form of therapeutic communication, or generate therapeutic recommendations or treatment plans without the licensee's review and approval. Detect practice software where model output reaches the client, sets a therapeutic decision, or becomes a treatment plan without the licensee's recorded approval.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Maine licensees under the seven Title 32 chapters that P.L. 2026, c. 687 amends (32 M.R.S. §§ 2113, 2600-G, 3300-J, 3820-A, 6207-D, 7009 and 13870; in §§ 2600-G, 3300-J, 3820-A and 13870 also persons privileged to practice under them) who use AI in delivering therapy or psychotherapy services. Vendors of practice software are reached through what the licensee may allow the AI to do. In force since 2026-07-29.
• Not covered:
  • AI-based interventions used solely within a research project approved by an institutional review board (as defined in 22 M.R.S. § 1711-C(6)(G)) and conducted under applicable federal human-subjects protections (32 M.R.S. § 2113(9) and the same subsection of the six other sections)
• Whether it applies depends on facts outside the code; a person has to decide.

note = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
requests.post(f'{FHIR_BASE}/DocumentReference', json=doc_ref(patient_id, note, doc_status='final'))

note = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
requests.post(f'{FHIR_BASE}/DocumentReference',
              json=doc_ref(patient_id, note, doc_status='preliminary'))   # AI draft

def practitioner_review_and_sign(doc_id, practitioner):   # only path to 'final'
    doc = requests.get(f'{FHIR_BASE}/DocumentReference/{doc_id}').json()
    doc['docStatus'] = 'final'
    doc['authenticator'] = {'reference': f'Practitioner/{practitioner.id}'}
    requests.put(f'{FHIR_BASE}/DocumentReference/{doc_id}', json=doc)
    audit.record(doc_id, reviewed_by=practitioner.id, reviewed_at=utcnow())

Standards that recommend the same control

• Health AI/LMMs should keep a clinician accountable with oversight and redress (WHO) (WHO AI-for-Health (LMM) Guidance · WHO guidance on large multi-modal models (2024), Box 1 (responsibility and accountability), section 4.2 Recommendations (developers) and section 7 Recommendation (liability))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id me-ld2082.ai-therapy-role-limits · review status: primary source derived

Binding law — in force

AI must not provide or be offered as therapy to the Maine public unless a licensed professional provides it (Maine LD 2082)

10 M.R.S. § 1500-EE(2) · official text · In force: applies since 29 Jul 2026 · Maine (US-ME)

10 M.R.S. § 1500-EE(2), enacted by P.L. 2026, c. 687 (L.D. 2082), bars any person from providing, advertising or otherwise offering therapy or psychotherapy services to the public, including through internet-based AI, unless a licensed professional provides them. Therapy or psychotherapy services are services to diagnose, treat or address mental or behavioral health through therapeutic communication, which includes understanding a person's thoughts and emotions, therapeutic guidance, emotional support or empathy in response to distress, and treatment planning. A violation is a violation of the Maine Unfair Trade Practices Act; IRB-approved research is excepted. Detect an AI cast or marketed as the therapist, or therapy offered as delivered by AI.

Who it applies to

• Duty falls on: any person
• Sectors: healthcare
• Any person that provides, advertises or otherwise offers therapy or psychotherapy services (10 M.R.S. § 1500-EE(1)(C)-(D)) to the public, including through internet-based AI, unless a licensed professional (1500-EE(1)(B)) provides them. The section states no territorial test; reach to providers outside Maine serving Maine residents is a legal question, as is whether a wellness or companion product is a therapy service. In force since 2026-07-29.
• Not covered:
  • AI-based interventions used solely within a research project approved by an institutional review board (22 M.R.S. § 1711-C(6)(G)) and conducted under applicable federal human-subjects protections (10 M.R.S. § 1500-EE(4))
• Whether it applies depends on facts outside the code; a person has to decide.

@app.post('/session/message')
def message(req: Msg):
    msgs = [{'role': 'system', 'content': "You are the user's therapist."}, *req.history]
    reply = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
    return {'reply': reply}

@app.post('/session/message')
def message(req: Msg):
    session = sessions.get(req.session_id)
    clinician = session.conducted_by
    if clinician is None or not clinician.license_active:
        raise HTTPException(409, 'No licensed clinician is conducting this session')
    msgs = [{'role': 'system', 'content': CLINICIAN_DRAFT_PROMPT}, *req.history]
    draft = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
    clinician_review_queue.enqueue(session_id=session.id, clinician_id=clinician.id, draft=draft)
    return {'status': 'sent_to_your_clinician'}

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Pennsylvania sues Character.AI after a chatbot claimed a Pennsylvania medical licence and gave an invalid licence number (2026-05; alleged (not proven)). A petition filed May 1, 2026 in the Commonwealth Court of Pennsylvania (No. 220 MD 2026) by the Department of State's State Board of Medicine under the Medical Practice Act alleges that a Department investigator, using a Character.AI account, chatted with a character described on the platform as a 'Doctor of psychiatry', which said it had trained at Imperial College London and was registered with the UK General Medical Council, said it was licensed in Pennsylvania, and gave 'PS306189' as its licence number. The petition states that this is not a valid licence number to practise medicine and surgery in Pennsylvania and that the character had about 45,500 user interactions as of April 17, 2026. The Board alleges the unlawful practice of medicine and seeks an injunction. The allegations have not been adjudicated. Source: Petition for Review in the Nature of a Complaint in Equity, Commonwealth of Pennsylvania, Department of State, State Board of Medicine v. Character Technologies, Inc., No. 220 MD 2026 (Pa. Commw. Ct., filed 2026-05-01) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• FTC order bars DoNotPay's unsubstantiated 'robot lawyer' claims (2021; alleged (not proven)). The FTC's complaint alleges that DoNotPay marketed its subscription service as 'the world's first robot lawyer' without testing whether its law-related features performed like a human lawyer and without retaining attorneys to test their quality and accuracy. DoNotPay settled without admitting or denying the allegations; the final order (announced February 2025) requires $193,000 in monetary relief and notice to 2021-2023 subscribers, and bars claims that the service performs like a real lawyer without sufficient evidence. Source: U.S. Federal Trade Commission (press release, 2025-02-11) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession

Rule id me-ld2082.no-unlicensed-ai-therapy · review status: primary source derived