AI Scribe for Behavioral Health: Privacy First

Ask one question before you pick a behavioral-health scribe: what happens to the audio? In therapy the recording holds more than the note ever will, and a vendor that keeps it has made something a court can later reach. A scribe that never stores the recording removes that risk at the root. The compliance rules people worry about, 42 CFR Part 2 and HIPAA's psychotherapy-notes category, are narrower than most vendor pages let on. Stored audio is the part that's actually sharp.

This post is for the talk-therapy side of behavioral health: counselors, LCSWs, group practices, clinics. If you're an MD running medication management, the psychiatry privacy guide covers your case more directly. Here we sort the rules that govern a therapy practice from the ones that don't, and we give you a decision tree to run any vendor through. Us included.

Key takeaways

• 42 CFR Part 2 covers substance use disorder records held by federally-assisted SUD programs. A general therapy or counseling practice that isn't one is governed by HIPAA.
• HIPAA "psychotherapy notes" are your separate session-analysis notes. The progress note a scribe drafts is explicitly the excluded content, not a psychotherapy note.
• Stored audio is protected health information and discoverable in litigation. Audio that's never kept can't be subpoenaed.
• 93% of behavioral health workers reported burnout in a 2023 survey of 750; 68% of those in direct care said paperwork takes time from clients.
• The deciding factor isn't a feature. It's the retention policy. Get a one-sentence answer with a deletion timeline.

Which privacy rules actually govern a therapy practice?

Careful clinicians get talked into the wrong fear here. Vendor pages name-drop three regimes. Only some touch your practice.

HIPAA is the floor. It governs your protected health information, including the progress note the scribe writes, and it almost always applies to a licensed therapy or counseling practice.

42 CFR Part 2 is the one that gets misapplied most. It protects records of substance use disorder treatment held by a federally-assisted Part 2 "program." Under 42 CFR 2.12, that includes treatment programs, hospital units, and "private practitioners who hold themselves out as providing... substance use disorder diagnosis, treatment, or referral for treatment." Read that carefully. If you don't hold yourself out as an SUD program, Part 2 generally doesn't attach to your records, even when a client talks about drinking or drug use in session. So a counseling or LCSW practice that isn't an SUD program is usually a HIPAA practice, not a Part 2 one. Run an addiction program and Part 2 layers on, with stricter consent and disclosure rules. The 2024 Part 2 Final Rule, with a compliance date of February 16, 2026, aligned much of Part 2 consent with HIPAA, so a single client consent can now cover future treatment, payment, and operations uses. It kept the hard protections: SUD records still can't be used to start or back a criminal charge against the patient, and disclosure in a legal proceeding needs patient consent or a court order plus a subpoena, not a plain subpoena alone.

Psychotherapy notes are a HIPAA category, and this is where the scribe question actually turns. HIPAA defines them as "notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session," kept separate from the rest of the record (45 CFR 164.501). Those get heightened protection: you need a specific authorization to disclose them (45 CFR 164.508(a)(2)). But the same definition spells out what is not a psychotherapy note, and the list is long: the medication record, session start and stop times, treatment modalities and frequencies, clinical test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. That list is the progress note. It's the thing a scribe drafts. So the scribe's output is protected by HIPAA, but it is not a psychotherapy note, and it doesn't get the heightened authorization shield. Don't assume it does, and don't let a vendor imply their note carries protection it doesn't.

One honest line before we go on: this is reporting, not legal advice. How HIPAA, Part 2, and your state's mental-health confidentiality law stack for your specific license and practice type is a question for your own counsel. For the framework that applies to every practice, our HIPAA and AI scribes guide walks through the BAA and the vendor checklist.

Why stored audio is the real risk in behavioral health

Strip away the regime alphabet soup and the practical risk gets concrete fast. If a vendor stores the session audio, that recording is protected health information, and PHI is reachable in litigation. Under 45 CFR 164.512(e), a covered entity can be compelled to hand over PHI in response to a subpoena or court order when the conditions are met. For SUD records under Part 2 the bar is higher, a court order with a subpoena rather than a plain subpoena, but the shape holds: a stored recording is a thing someone can come for.

In therapy that edge is sharper than almost anywhere in medicine. The recording captures what the client said before any of it became documentation. The thing they blurted and took back. The name dropped in passing. The detail about a third party who never consented to anything. Your progress note is the curated version, filtered down to what's clinically necessary. The raw audio is not filtered at all. A clinician who would never paste a verbatim transcript into the chart should think just as hard about a vendor keeping that transcript on a server for weeks.

There's a quieter cost too, and it's worth naming. Some clients freeze when they know a recording is running. The chilling effect is real, and in trauma work or early sessions it can change what gets said at all. A scribe that keeps nothing still records during the visit, so this isn't a magic fix. But "the audio is gone the second your note is drafted" is a sentence you can say to a wary client and mean. "We retain it for a while for quality purposes" is not.

So here's our position, stated plainly, and you should pressure-test it. Visit audio is processed in memory and discarded the moment the note is drafted. There is no audio archive, not for us, not for the practice, not for anyone. What survives is the note you reviewed and signed. The conclusion that a vendor's stored audio is a live discovery target is our read of how 164.512(e) meets this technology, and we think it's the right read. Test it on any vendor with one question: if you keep my clients' audio and a court asks for it, what happens? A vendor that stores nothing has a one-word answer.

The behavioral-health scribe decision tree

Run any vendor through this in order. The first question that gets a bad answer ends the evaluation.

Notice what isn't on that list. Per-specialty "therapy templates," accuracy percentages, EHR write-back. They make good slides and decide nothing about your privacy exposure. Step one decides most of it. The cross-vendor version of that question is its own buying decision, and we wrote it up: see what happens to your visit audio across major scribes before you take anyone's word, ours included.

Does the documentation math even work for therapy?

It does, and the burden is well documented. A 2023 National Council for Mental Wellbeing survey, run by Harris Poll across 750 mental health and substance use professionals, found 93% had experienced burnout and 62% rated it moderate or severe, an 8, 9, or 10 on a ten-point scale. Paperwork is named directly: a third of the workforce said they spend most of their time on administrative tasks, 68% of those providing direct care said that admin time takes away from time with clients, and 38% said less paperwork would help them serve clients better.

That's the case for a scribe in one paragraph. A 50-minute hour followed by ten or fifteen minutes of notes, session after session, is how a full caseload turns into evening charting. A tool that drafts the progress note while the session is fresh gives that time back. The honest framing, though: in this specialty you're buying that time back against higher privacy stakes than a primary-care clinic faces. The retention answer is what makes the trade worth it or not.

Where we fit, and where we don't

Here's where we land. AI Scribe by Patient Square is an ambient AI medical scribe that listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft — ready to review and sign about two minutes after the visit. For behavioral health, the part that matters is the audio: processed in memory, discarded the moment the note is drafted. There's no recording to retain, train on, subpoena, or breach. Notes are encrypted in transit (TLS 1.2+) and at rest (AES-256), access is role-scoped and logged, and the notes belong to your practice, which can export or delete any visit at any time and never has its clinical data sold or shared. We map our safeguards to the HIPAA Security Rule and offer a BAA to every customer; our SOC 2 Type II audit is underway. The full posture is on our security page. For practices that prescribe, the Rx draft passes a deterministic safety screen, drug-interaction, renal, and pregnancy checks, that re-runs at sign time and hard-blocks unsafe combinations unless you override with an attestation.

Now the honest part, because fairness is the point of writing this. An ambient scribe is the wrong tool for some of this work, and we'll say so plainly.

If the recording itself would change the room, skip it. Some modalities lean on a client speaking without a device running, and some clinicians write their notes reflectively, as part of how they think through a session, not by editing a transcript a model produced. Neither of those is a documentation problem a scribe solves. It's a different way of working, and it's a legitimate one. If that's you, a scribe is a poor fit no matter whose it is.

And if you run a federally-assisted SUD program that needs Part 2 consent tracking and disclosure logging wired into an enterprise EHR, a platform embedded in that EHR will fit your compliance workflow better than we will. We don't integrate with EHRs. We don't manage Part 2 consent flows for you. That's a real gap for a slice of behavioral-health practices, and you should weigh it against the audio-retention advantage rather than wave it off.

For everyone else, the calculus is simpler. A solo counselor, a group therapy practice, an LCSW clinic that isn't a Part 2 program: the documentation load is heavy, the privacy fear is legitimate, and a scribe that keeps none of your audio answers that fear at its root. If that's your practice, book a demo and put the audio question first, before anyone talks features.

What to verify before you sign

The work is small, and worth doing precisely:

1. Settle the audio question first. One sentence, with a deletion timeline. Everything else is secondary.
2. Confirm your regime. Are you a Part 2 program or a HIPAA-only practice? It changes the consent and disclosure rules, and it changes which vendor claims are even relevant to you.
3. Get the BAA before the first real session, and confirm it covers the trial, since you'll feed it live visits from day one.
4. Pin the training-data policy in writing, separately for audio and note text.
5. Think through consent with your own clients. State recording-consent rules vary, and a wary client is a clinical consideration, not just a legal one. Our consent-by-state guide is the starting point.

We think a transparent retention policy should be the price of entry for any vendor handling therapy audio, and most of the market isn't there yet. Our security posture, what's encrypted, who can access what, what's audited and what isn't yet, is on our security page, written to be read with this checklist in hand.

The right evaluation for a behavioral-health practice is a quiet week of real sessions with the audio policy verified in writing first. Book a short demo, make the audio question the first thing you ask, then run the 7-day trial on your own caseload. In this specialty the recording is the risk. A tool that keeps none of it is the cleanest answer to the hardest question.