Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Short Answer for Operators
If your treatment center runs AI scribes or a telehealth platform that captures verbatim session content, that content is discoverable evidence. Your retention schedule, your BAA, and your consent forms need to say so, explicitly, before a subpoena arrives.
The Talkspace matter made this concrete. Proof News reported that former AdventHealth nurse practitioner Jennifer Kamrass had her Talkspace messages with her therapist subpoenaed by her former employer during a pregnancy discrimination case. The therapist, who declined to be named, told the reporter, “When I came to understand how much information they had, I was shocked.” Talkspace CEO Jon Cohen has told investors the company sits on “one of the largest mental health data banks in the world,” containing 140 million message exchanges, and in March 2026 Universal Health Services announced an $835 million acquisition of the platform.
That is not a Talkspace-only problem. Every AI scribe vendor sitting inside an IOP or a Level 2.5 partial hospitalization workflow is building the same kind of archive on your patients, under your license. Clinical directors in Florida, Tennessee, and Massachusetts should be asking three questions this week: how long the vendor keeps the audio and the transcript, whether a court order or a bare subpoena triggers production, and who at the vendor picks up the phone when a preservation letter lands. If the answer to any of those is unclear, the retention schedule is not compliant, whatever the policy binder says.
Where 42 CFR Part 2 and HIPAA Actually Collide With AI Output
Most SUD programs taking federal funding are Part 2 programs. The moment audio leaves the encounter and hits an AI scribe vendor’s servers, that vendor is handling Part 2 records. SAMHSA and HHS published the Part 2 final rule in the Federal Register on February 16, 2024, with an effective date of April 16, 2024. Enforcement of the updated Part 2 rules began February 16, 2026, under OCR’s newly delegated authority. Operators who signed AI scribe BAAs in 2023 or 2024 are now under a stricter enforcement posture than the one they contracted under.
Under the 2024 HHS inflation adjustment, published in the Federal Register on August 8, 2024, the calendar-year cap for HIPAA violations rose to $2,134,831 per identical provision. Tier 4 (willful neglect, uncorrected) carries a per-violation maximum of $2,134,831 as well. HHS published a further inflation adjustment on January 28, 2026, and Part 2 penalties now sit under the same OCR enforcement machinery.
The subpoena distinction is the one operators get wrong most often. Under HIPAA, a covered entity can produce records in response to a subpoena with satisfactory assurances. Part 2 is different. HHS’s own fact sheet notes that Part 2 records “cannot be used in legal proceedings against the patient without specific consent or a court order, which is more stringent than the HIPAA standard.” A grand jury subpoena alone will not do it. A civil litigation subpoena alone will not do it.
The 2024 final rule also brought Part 2 breach mechanics under HIPAA. HHS applied the HIPAA Breach Notification Rule to breaches of Part 2 records. The AI scribe vendor’s breach clock is now your clock. Under 45 CFR § 164.404, the notification must go out without unreasonable delay and no later than 60 calendar days after discovery. Sixty days from discovery, not from when the vendor decides to tell you. The vendor’s standard BAA references HIPAA. It almost never references 42 CFR Part 2. The Qualified Service Organization Agreement that Part 2 requires is often missing entirely.
The Retention Math Nobody Ran
Behavioral health record retention in Florida is not one number. Under Florida Statute 456.057, physicians and health care practitioners must retain records for at least five years from the last patient contact. A licensed clinical social worker, marriage and family therapist, or mental health counselor must maintain client records for seven years. Utah, Tennessee, and Massachusetts each layer their own schedules on top.
Now overlay the vendor. Most AI scribe defaults land somewhere between 7 years and indefinite for model training. If your Florida behavioral health program is set to a 5-year clinical retention and your vendor is holding raw audio for 10 years, you have created a discovery target that outlives your own record. The plaintiffs’ bar knows that. So does OCR, which now enforces Part 2 alongside HIPAA.
Adoption is not slowing down while operators sort this out. The American Medical Association reported that 7,260 Permanente physicians used ambient AI scribes across 2,576,627 patient encounters between October 2023 and December 2024. The Kaiser Permanente Division of Research found the tool saved nearly 16,000 hours of documentation time over that stretch. Behavioral health is on that curve now, not five years from now. AHS is seeing residential and outpatient programs in Florida sign 3-year AI scribe contracts at $150 to $400 per clinician per month without a single BAA line item revised from the vendor’s template.
The Vendor Risk Review Most Programs Skipped
When AHS runs a vendor risk assessment on a behavioral health client deploying AI clinical tools, the failure pattern is consistent. Operations leads signed the BAA, not counsel. Nobody executed the QSOA required under Part 2. The SOC 2 Type II report is two years old and covers a different product line. There is no documented data flow showing where audio is processed, whether it leaves the United States, or whether a sub-processor (usually an LLM API provider) is in scope at all.
Operators should put these questions to their AI scribe vendors in writing this quarter:
- Does the vendor train models on our session data, in identifiable or de-identified form? What is the opt-out mechanism, and is it default-off or default-on?
- What is the deletion SLA when a patient revokes consent, and does it reach audio, transcripts, drafts, and derivatives?
- Is there a legal hold mechanism that survives contract termination?
- Who is the breach notification contact, and how fast do they report to us? The clock is set by federal rule, not by the vendor’s convenience.
- For SUD programs: does the vendor sign a QSOA and accept Part 2 re-disclosure restrictions on top of the HIPAA BAA?
One structural fact operators need to sit with. As compliance analysts noted after the Kamrass matter, “AdventHealth’s lawyers obtained a court order. The platform produced the records. Nothing in that chain was procedurally wrong under HIPAA.” The vendor did not violate a rule. The system worked exactly as designed. That is the point. The record existed to be produced.
Three Policy Documents to Have on the Desk This Quarter
- The records retention schedule, rewritten for AI artifacts. Treat audio, the AI-generated draft, and the signed clinical note as three separate artifacts with three separate disposition rules. Most programs AHS advises are landing on a model where audio is destroyed within 30 to 90 days post-encounter, the AI draft is destroyed once the clinician finalizes the chart note, and only the signed clinical note persists in the EHR under the state retention clock. Florida programs should map this against Florida Statute 456.057 and, for Medicaid-participating providers, AHCA Rule 59G-1.054.
- Patient consent and Notice of Privacy Practices. If a clinician is running an AI scribe, the consent form should name the specific tool, describe what is captured (audio, transcript, or both), state the retention period for each artifact, and describe the patient’s right to refuse without affecting care. Under the 2024 Part 2 rule, HHS aligned the Part 2 Patient Notice requirements with the HIPAA Notice of Privacy Practices, so this is a single-document revision, not two.
- The legal hold playbook. When the subpoena or preservation letter lands, who at the vendor gets the call within 24 hours? Is that contact named in the BAA? Does the vendor’s contract preserve data past termination if a hold is in place?
AHS’s compliance and IT advisory teams are running exactly this work right now for residential and outpatient programs in Florida, Tennessee, Utah, and Massachusetts. A typical 30-day engagement covers BAA inventory, Part 2 QSOA gap analysis, vendor SOC 2 review, retention schedule rewrite, and consent language revision. If you are coming to NAATP National at Amelia Island May 4-6, 2026, Allison, Leah, Sariah, and the team will be there, and AHS is sponsoring the Women in Leadership Luncheon. Bring your BAA list. AHS will tell you which clauses to renegotiate before the next subpoena lands at someone else’s program and the plaintiffs’ bar generalizes the playbook.
Frequently asked questions
Is a subpoena alone enough to compel production of AI-generated therapy transcripts from a 42 CFR Part 2 program?
No. Under the updated Part 2 rule, which became enforceable February 16, 2026, a subpoena by itself does not authorize disclosure. HHS’s own fact sheet states that Part 2 records cannot be used in legal proceedings against the patient without specific consent or a court order, which is more stringent than the HIPAA standard. HIPAA allows subpoena-plus-satisfactory-assurances disclosure. Part 2 requires a qualifying court order. If your program is federally assisted and provides SUD diagnosis, treatment, or referral, treat every bare subpoena as insufficient and require the court order before production.
How long should we retain AI scribe audio and transcripts at a Florida behavioral health treatment center?
Florida sets different minimums depending on the license type. Under Florida Statute 456.057, physicians must keep records at least 5 years from last patient contact, and licensed clinical social workers, marriage and family therapists, and mental health counselors must maintain client records for 7 years. Most programs AHS advises destroy raw audio within 30 to 90 days post-encounter, destroy the AI draft once the clinician finalizes the chart note, and let only the signed note persist in the EHR under the state retention clock. Whatever schedule you choose, the vendor’s default must match, not exceed, your policy.
What is the breach notification clock when an AI scribe vendor is breached?
Under 45 CFR § 164.404, a covered entity must notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. The 2024 Part 2 final rule extended the HIPAA Breach Notification Rule to Part 2-protected records. Your BAA should require the vendor to report to you fast enough that you can still meet the 60-day outer limit, which almost always means a contractual reporting deadline of 10 to 30 days from the vendor’s discovery, not 60. Under the 2024 HHS inflation adjustment published August 8, 2024, Tier 4 willful-neglect penalties reach $2,134,831 per violation and per calendar year, so the reporting clause is not a boilerplate item.
Do we need a QSOA with our AI scribe vendor, or is a HIPAA BAA sufficient?
For a Part 2 program, a HIPAA BAA alone is not sufficient. Part 2 requires a Qualified Service Organization Agreement (QSOA) that binds the vendor to Part 2’s re-disclosure restrictions on top of HIPAA. If your AI scribe vendor will not sign a QSOA, that is a hard stop for SUD programs. AHS routinely finds this document missing from AI scribe vendor packages and rewrites the contract stack accordingly.
References
- Proof News: Woman’s Talkspace Therapy App Sessions Exposed in Court (April 2026)
- HHS Fact Sheet: 42 CFR Part 2 Final Rule
- Federal Register: Confidentiality of Substance Use Disorder (SUD) Patient Records, Final Rule (Feb. 16, 2024)
- HHS Annual Civil Monetary Penalties Inflation Adjustment, 89 Fed. Reg. 64815 (Aug. 8, 2024)
- HHS Annual Civil Monetary Penalties Inflation Adjustment (Jan. 28, 2026)
- American Medical Association: AI Scribes Save 15,000 Hours at Kaiser Permanente
- Kaiser Permanente Division of Research: One-Year Review of Ambient Scribe Technology
- Florida Statute 456.057, Ownership and Control of Patient Records