AI Scribe for Psychiatry: The Privacy Questions First

Before you pick a psychiatry AI scribe, ask one question: what happens to the audio? In behavioral health the recording is more revealing than the note, and a vendor that retains it has created something a court can later reach. The privacy rules that apply are narrower than most vendor pages imply, but the discoverability risk of stored audio is real. A scribe that never keeps the recording sidesteps the worst of it.

That's the thesis. The rest sorts out which rules actually govern your practice, which ones are marketing fog, and a short decision tree you can run any vendor through, including us.

Key takeaways

• 42 CFR Part 2 protects substance use disorder records held by federally-assisted SUD programs. It does not, by itself, cover general psychiatry.
• The scribe's SOAP note is the regular clinical record, not a HIPAA "psychotherapy note." Different rules, lower disclosure bar.
• Retained audio is protected health information and is discoverable in litigation. Audio that's never stored can't be subpoenaed.
• 93% of behavioral health workers reported burnout in a 2023 survey of 750 workers; 62% called it moderate or severe.
• The deciding question isn't a feature. It's the retention policy. Get a one-sentence answer with a timeline.

Which privacy rules actually apply to a psychiatry scribe?

This is where careful clinicians get talked into the wrong fear. Three different regimes get name-dropped on vendor pages, and only some of them apply to you.

HIPAA. This governs your practice's protected health information, including the note the scribe drafts. It's the floor, and the part that almost always applies.

42 CFR Part 2. This is the one most often misstated. Part 2 protects records of substance use disorder treatment created or held by a federally-assisted Part 2 "program," meaning a person or unit that holds itself out as providing SUD diagnosis, treatment, or referral (42 CFR 2.11, 2.12). If a patient's SUD treatment is not provided by such a program, that record is not covered by Part 2. So a general psychiatry or therapy practice that isn't an SUD program is usually governed by HIPAA, not Part 2. If you do run SUD treatment, Part 2 layers on with stricter consent and disclosure rules. The 2024 final rule aligned much of Part 2 consent with HIPAA, letting a single patient consent cover future treatment, payment, and operations uses, while still requiring separate consent for SUD counseling notes.

Psychotherapy notes. A HIPAA category, not a Part 2 one. Psychotherapy notes are the clinician's process notes analyzing a session, kept separate from the rest of the record, and they need a specific authorization to disclose (45 CFR 164.501, 164.508(a)(2)). Here's the part that matters for a scribe: the structured note a scribe produces, the SOAP, the meds, the plan, is the regular clinical record. It is not a psychotherapy note. So it doesn't get the heightened protection, and you shouldn't assume it does.

One honest line before we go further: this is reporting, not legal advice. The interaction of HIPAA, Part 2, and state mental-health law is exactly the kind of thing to confirm with counsel for your specific practice type. If you want the general HIPAA framework, our HIPAA and AI scribes guide covers the BAA and the vendor checklist that apply to every practice.

Why retained audio is the real risk in behavioral health

Strip away the regime alphabet soup and the practical risk is concrete. If a vendor stores the visit audio, that recording is protected health information, and PHI is discoverable in litigation. Under 45 CFR 164.512(e), a covered entity can be compelled to produce PHI in response to a subpoena or court order when the conditions are met. For SUD records under Part 2, the bar is higher, a qualifying court order rather than a plain subpoena, but the point holds: a stored recording is a thing that can be reached.

In behavioral health that's a sharper edge than in most of medicine. The audio captures what the patient said before any of it was filtered into a note: the digressions, the names, the things they immediately walked back. The note you sign is the curated record. The raw recording is everything else. A clinician who would never paste a verbatim transcript into the chart should think hard about a vendor keeping that transcript on a server for weeks.

This is editorial synthesis, not a statute, so we'll mark it as such: the legal mechanism is 164.512(e); the conclusion that "a scribe's stored audio is a discovery target" is our read of how that mechanism meets this technology. We think it's the right read. The cleanest way to test it is to ask the vendor directly: if you keep my patients' audio, and a court asks for it, what happens? A vendor that stores nothing has a one-word answer. If that answer is the one you want, book a demo and put the audio question first, before anyone talks features.

The behavioral-health scribe decision tree

Run any vendor through this, in order. The first question that gets a bad answer ends the evaluation.

Notice what's not on the list: per-specialty "psychiatry templates," accuracy percentages, EHR write-back. Those make good slides and decide nothing about your privacy exposure. The retention answer in step one decides almost everything.

Where we fit, and where we don't

Plainly: AI Scribe by Patient Square is an ambient AI medical scribe that listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft, ready to review and sign about two minutes after the visit. For behavioral health, the part that matters is what we do with the audio. It's processed in memory and discarded the moment the note is drafted. There is no recording to retain, train on, subpoena, or breach. The prescription draft passes a deterministic safety screen, drug-interaction, renal, and pregnancy checks that re-run at sign time and hard-block unsafe combinations unless you override with an attestation, which matters in psychiatry where polypharmacy and interaction risk are routine.

Now the honest part. If you run a federally-assisted SUD program that needs Part 2-specific consent tracking wired into an enterprise EHR, a health-system platform embedded in that EHR will likely fit your compliance workflow better than we will. We don't integrate with EHRs, and we don't manage Part 2 consent flows for you. That's a real gap for a subset of behavioral-health practices, and you should weigh it honestly against the audio-retention advantage. Match the tool to your regulatory footprint.

For everyone else, a solo psychiatrist, a group therapy practice, a behavioral-health clinic that isn't a Part 2 program, the calculus is simpler: the documentation burden is brutal (93% of the workforce reported burnout in 2023), and a scribe that never keeps your audio answers the privacy fear at its root. If that's your practice, book a demo and run the audio policy past your own compliance instincts before you commit.

What to verify before you sign

The work is small and it's worth doing precisely:

1. Settle the audio question first. One sentence, with a deletion timeline. Everything else is secondary.
2. Confirm your regime. Are you a Part 2 program or a HIPAA-only practice? It changes the consent and disclosure rules, and it changes which vendor claims are even relevant to you.
3. Get the BAA before the first real session, and confirm it covers the trial period, since you'll feed it real visits from day one.
4. Pin the training-data policy in writing, separately for audio and note text.
5. Test on your own patients during a trial. A demo with a scripted SUD intake tells you nothing about how the tool handles your actual sessions.

Our security posture, what's encrypted, who can access what, what's audited and what isn't yet, is on our security page, written to be read with this checklist in hand. And the cross-vendor audio question is its own buying decision: see what happens to your visit audio across major scribes before you take anyone's word, ours included.

The right evaluation for a behavioral-health practice is a quiet week of real sessions with the audio policy verified in writing first. Book a short demo and make the audio question the first thing you ask, then run the 7-day trial on your own caseload. In this specialty, the recording is the risk. A tool that keeps none of it is the cleanest answer to the hardest question.