When AI Therapy Transcripts Get Subpoenaed: Retention Lessons for Behavioral Health Operators

1. The records retention schedule, rewritten for AI artifacts. Treat audio, the AI-generated draft, and the signed clinical note as three separate artifacts with three separate disposition rules. Most programs AHS advises are landing on a model where audio is destroyed within 30 to 90 days post-encounter, the AI draft is destroyed once the clinician finalizes the chart note, and only the signed clinical note persists in the EHR under the state retention clock. Florida programs should map this against Florida Statute 456.057 and, for Medicaid-participating providers, AHCA Rule 59G-1.054.
2. Patient consent and Notice of Privacy Practices. If a clinician is running an AI scribe, the consent form should name the specific tool, describe what is captured (audio, transcript, or both), state the retention period for each artifact, and describe the patient’s right to refuse without affecting care. The updated Part 2 rule requires disclosures to carry the statement “42 CFR part 2 prohibits unauthorized use or disclosure of these records,” and entities that maintain SUD records must have updated Notices of Privacy Practices to address SUD-specific protections, effective February 16, 2026.
3. The legal hold playbook. When the subpoena or preservation letter lands, who at the vendor gets the call within 24 hours? Is that contact named in the BAA? Does the vendor’s contract preserve data past termination if a hold is in place?

AHS’s compliance and IT advisory teams are running exactly this work right now for residential and outpatient programs in Florida, Tennessee, Utah, and Massachusetts. A typical 30-day engagement covers BAA inventory, Part 2 QSOA gap analysis, vendor SOC 2 review, retention schedule rewrite, and consent language revision. If you are coming to NAATP National at Amelia Island May 4-6, 2026, Allison, Leah, Sariah, and the team will be there, and AHS is sponsoring the Women in Leadership Luncheon. Bring your BAA list. AHS will tell you which clauses to renegotiate before the next subpoena lands at someone else’s program and the plaintiffs’ bar generalizes the playbook.

Frequently asked questions

Is a subpoena alone enough to compel production of AI-generated therapy transcripts from a 42 CFR Part 2 program?

No. Under the updated Part 2 rule, which OCR began enforcing on February 16, 2026, a subpoena by itself does not authorize disclosure. The rule restricts the use of Part 2 records and testimony in civil, criminal, administrative, or legislative proceedings against patients without specific consent or a qualifying court order, a standard more stringent than HIPAA. HIPAA allows subpoena-plus-satisfactory-assurances disclosure; Part 2 requires a qualifying court order that must be accompanied by a subpoena or other legal requirement compelling disclosure. If your program is federally assisted and provides SUD diagnosis, treatment, or referral, treat every bare subpoena as insufficient and require the court order before production.

How long should we retain AI scribe audio and transcripts at a Florida behavioral health treatment center?

Florida sets different minimums depending on license type. Under Florida Statute 456.057, physicians must keep records at least 5 years from the last patient contact, and licensed clinical social workers, marriage and family therapists, and mental health counselors must maintain client records for 7 years. Most programs AHS advises destroy raw audio within 30 to 90 days post-encounter, destroy the AI draft once the clinician finalizes the chart note, and let only the signed note persist in the EHR under the state retention clock. Whatever schedule you choose, the vendor’s default must match, not exceed, your policy.

What is the breach notification clock when an AI scribe vendor is breached?

Under 45 CFR § 164.404, a covered entity must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. The 2024 Part 2 Final Rule extended the HIPAA Breach Notification Rule to Part 2-protected records by adopting the definition of “breach” from the HIPAA regulations. Your BAA should require the vendor to report to you fast enough that you can still meet the 60-day federal deadline.

What are the current HIPAA penalty amounts an operator should model when scoping AI scribe vendor risk?

For penalties assessed on or after January 28, 2026, Tier 4 (willful neglect, not corrected) carries a minimum of $73,011 per violation and a maximum of $2,190,294 per violation, with an annual cap of $2,190,294. Tiers 1 through 3 also range up to $73,011 per violation. OCR now enforces both HIPAA and 42 CFR Part 2 under the same civil framework, so a single AI scribe breach involving SUD records can produce parallel exposure under both regimes.