13.4 Technology in Practice: Telehealth, E-Supervision, AI, and Social Media

13.4 Technology in Practice: Telehealth, E-Supervision, AI, and Social Media

The 2025 NAADAC/NCC AP Code of Ethics devotes an entire Principle to this territory: Principle VI, Use of E-Therapy, E-Supervision, Artificial Intelligence (AI) and Social Media. That expansion is itself informative — the 2021 Code addressed e-therapy and social media, and the 2025 revision added artificial intelligence as a distinct ethical domain.

The Code defines the terms broadly. E-therapy and e-supervision mean the delivery of services using technology and HIPAA-compliant resources, across platforms including phones, fax, webcams, computers, tablets, external drives, and cloud storage, and across synchronous delivery modes including video therapy, email, texting, chat, and instant messaging. Artificial intelligence is defined as any technology capable of performing complex tasks that historically only a human could do — recording, reasoning, deciding, or problem-solving — including technology that analyzes client data and proposes actions, often to predict an outcome.

---

1. The Technology Informed Consent (VI-3 and VI-4)

A general consent to treatment does not cover electronic service delivery. Standard VI-3 requires a distinct Electronic/Technology Informed Consent explaining purposes, risks, limitations, and costs; reasonable alternatives; the right to refuse service delivery through electronic means; the security measures in place; and the right to withdraw consent at any time. It must be reviewed both verbally and in writing and signed. Where initial consent is taken verbally, the verbal attestation is documented and followed promptly by a written, signed, dated document.

Standard VI-4 then enumerates what the discussion must cover before technology-based services begin. The full list is long and worth reading in the Code itself; the elements most often tested are:

• Contact information for the client, provider, and supervisor;
• A statement that e-therapy is not always an appropriate substitute for face-to-face counseling;
• That all procedures applying to in-person services apply to e-delivery;
• That duty to warn and mandatory reporting apply to e-therapy as they do in person;
• Confidentiality rules and their exceptions, and the risk of hacking or unauthorized viewing;
• Response time for asynchronous communication — how long before you answer a text or email;
• Technology failure and the alternate method of service delivery;
• Emergency protocols, and procedures when the counselor is unavailable;
• Time zone differences; policy on recording by either party; possible denial of insurance benefits; and the social media policy.

[!NOTE] Why the response-time item matters clinically. A client who texts "I'm not doing well" at 11 p.m. and hears nothing until Monday has experienced something that feels like abandonment. Setting the expectation in the consent — and providing a crisis number that is monitored — is what converts an asynchronous channel from a liability into a support.

---

2. Jurisdiction, Emergencies, and Local Resources (VI-2, VI-6, VI-12)

Standard VI-2 (Competency) requires specialized knowledge and current training in the technical, ethical, and legal considerations of technology-based practice, and states that professionals provide e-services only in those states or jurisdictions where they are registered, certified, or licensed.

Standard VI-6 (Licensing Laws) is more specific and is the highest-yield item in this Principle:

• Comply with licensing and credentialing law in the jurisdiction where the provider is physically located when providing care and where the client is located when receiving care.
• Emergency management protocols depend entirely on the location where the client receives services.
• Notify clients during informed consent of the legal rights and limitations governing practice across state lines or international boundaries.
• Advise clients that mandatory reporting and duty-to-warn obligations are governed by the jurisdiction where the client is receiving services — not where the counselor sits.

Standard VI-12 (Develop Local Resources) follows directly: be familiar with in-person mental health resources in the client's geographic location so that a referral is possible when clinical judgment calls for one.

The practical protocol. Before every remote session, confirm the client's physical location and a callback number. It takes ten seconds and it is what allows you to send help to the right address if the session becomes an emergency. Document it.

---

3. Identity, Capability, and Missing Cues (VI-5, VI-14, VI-15)

VI-5 (Verification): take reasonable steps to verify the client's identity before and throughout the relationship, using at least one of picture identification, code words, numbers, graphics, or other nondescript identifiers. Agreed code words also allow a client to signal distress or a lack of privacy without stating it aloud.

VI-14 (Capability): determine whether the client is physically, intellectually, emotionally, linguistically, and functionally capable of using the platform, and whether e-therapy is appropriate for their needs at all. Agree in advance on the platform and on the steps to take if the technology fails, verify the client understands how the application works, and follow up to correct problems.

VI-15 (Missing Cues): acknowledge that non-verbal and verbal cues differ between in-person and electronic communication and discuss with the client how to prevent and address misunderstandings arising from the absence of visual cues and voice inflection. On a phone or text-based contact you are assessing without posture, tremor, pupil size, gait, or smell — all of which carry clinical information in addiction work.

Clients for whom remote delivery may be inappropriate include those in acute withdrawal requiring physical assessment, those in active suicidal crisis without local supports identified, those without a private space (a client whose partner is in the room will not disclose intimate partner violence), and those whose cognitive impairment prevents reliable platform use.

---

4. Records, Transmission, and Cloud Storage (VI-10, VI-16)

VI-16 (Records) requires providers to be aware of the inherent dangers of electronic health records and to inform clients and supervisees of the benefits and risks of using AI to document sessions and of maintaining records in cloud-based file management — including the explicit acknowledgment that nothing electronically saved on a cloud is totally secure and confidential. Cloud-based file management must be encrypted, secured, and HIPAA-compliant, and encryption must be used when transmitting client information.

Layer 42 CFR Part 2 on top: for SUD records the platform and vendor arrangements must satisfy Part 2 as well, which in practice means a Qualified Service Organization Agreement with the vendor (see Section 12.1), not merely a HIPAA business associate agreement.

---

5. Social Media and Digital Boundaries (VI-13, VI-19)

VI-19 (Friends) is unambiguous: addiction professionals do not accept client friend requests on social networking sites or via email, and professionals who maintain both a professional and a personal social media presence create separate professional and personal pages and profiles that clearly distinguish between them.

VI-13 (Boundaries) requires discussing, establishing, and maintaining professional boundaries regarding the appropriate use and limitations of technology within the counseling or supervisory relationship, with explicit awareness of the unique boundary-crossing risks of electronic delivery.

Read alongside Standard I-23, which extends the prohibition on intimate relationships with current and former clients to electronic, virtual, and social-media relationships (see Section 13.1).

Searching for clients online. Looking up a client's social media without a clinical rationale and without the client's knowledge is a boundary crossing that should be discussed in supervision first and documented if done. Where a genuine safety concern justifies it — locating a client who has expressed suicidal intent — document the rationale, what you found, and what you did.

Recovery-community disclosure. Counselors in recovery face a specific version of this problem: a public recovery presence online can collide with a client's anonymity and with the counselor's own boundaries. Decide the policy in supervision before it becomes a crisis.

---

6. Artificial Intelligence (VI-1, VI-16, VI-20)

Standard VI-20 identifies the ethical considerations a professional using or contemplating AI must assess and address:

The working rules that follow. Never enter patient-identifying information into a tool that is not covered by an appropriate agreement and configured for HIPAA and Part 2 compliance. Obtain and document consent before AI-assisted documentation. Verify every AI-generated clinical statement yourself — you sign the note, and you own its content. Treat AI as an aid to your judgment, never a substitute for it. And remember Standard VI-16's requirement to discuss both the benefits and the risks with the client rather than presenting the tool as neutral infrastructure.