Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The Talkspace Wake-Up Call
The recent reporting on Talkspace transcripts surfacing in custody and civil litigation should land hard on every clinical director running a telehealth program in Florida, New York, or Oregon. The lesson is not that one vendor mishandled records. The lesson is that AI-generated and platform-generated session artifacts are discoverable evidence, and most behavioral health operators have no idea how long their vendors are keeping them, where, or under what legal hold posture.
We are seeing programs deploy AI scribes (Abridge, Eleos, Upheal, Blueprint, and a long tail of smaller tools) into intensive outpatient and Level 2.5 partial hospitalization workflows without revisiting the retention schedule. The transcript is not a clinical note. It is a verbatim record of what the patient said. Plaintiffs’ attorneys understand that distinction. So does the HHS Office for Civil Rights.
Where 42 CFR Part 2 and HIPAA Collide With AI Output
If your program is Part 2-covered (and most SUD programs taking any federal funding are), the AI scribe vendor is handling Part 2 records the moment audio leaves the encounter. The 2024 Part 2 final rule from SAMHSA aligned a lot of the consent and breach mechanics with HIPAA, but it did not soften the re-disclosure prohibitions. A subpoena is not a court order under Part 2. A grand jury subpoena is not a court order under Part 2. Operators get this wrong constantly.
Here is the operational problem. The AI scribe vendor’s standard BAA references HIPAA. It does not reference 42 CFR Part 2. The vendor’s data retention default is often 7 years, sometimes indefinite for "model improvement." Your state may require something different: Florida AHCA wants behavioral health records retained 7 years after last contact, New York OASAS has its own schedule, and California’s DHCS layers another set of requirements on top. If the vendor’s retention does not match yours, you have a problem on both ends. Too short and you violate state licensure. Too long and you have created a discovery target.
Audit log integrity is the other piece nobody is testing. When a subpoena lands, can you prove who accessed the transcript, when, and whether it was altered? If the answer is "the vendor handles that," you do not have an answer.
The Vendor Risk Review Most Programs Skipped
When AHS runs a vendor risk assessment on a behavioral health client deploying AI clinical tools, the failure pattern is consistent. The BAA was signed by an operations lead, not legal. The Qualified Service Organization Agreement (QSOA) required under Part 2 was never executed. The vendor’s SOC 2 Type II report is from 2022 and covers a different product line. There is no documented data flow showing where audio is processed, whether it leaves the United States, or whether a sub-processor (often an LLM API provider) is in scope.
Operators should be asking these questions in writing, today: Does the vendor train models on our session data, even in de-identified form? What is the deletion SLA when a patient revokes consent? Is there a legal hold mechanism that survives our contract termination? Who is the breach notification contact, and what is their clock? HHS expects you to start the 60-day notification window from discovery, not from when the vendor decides to tell you.
Retention, Consent, and the Policy Revisions to Make This Quarter
Three documents need to be on the desk this quarter. First, the records retention schedule, updated to explicitly address AI-generated transcripts, summaries, and the underlying audio. Treat them as separate artifacts with separate disposition rules. Most programs we advise are landing on a model where audio is destroyed within 30 to 90 days post-encounter, the AI-generated draft note is destroyed once the clinician finalizes the chart note, and only the signed clinical note persists in the EHR under the standard retention clock.
Second, patient consent and notice of privacy practices. If you are running an AI scribe your consent form should specifically name the tool, describe what is recorded, state the retention period, and describe the patient’s right to refuse without affecting care. Generic “we may use technology to assist documentation” language will not survive a deposition.
Third, the legal hold playbook. When the subpoena or preservation letter arrives, who at the vendor gets the call within 24 hours? Is that contact in the BAA? If you cannot answer in one sentence, you are not ready.
Where AHS Fits, and a Note on NAATP
AHS’s compliance and IT advisory teams are doing this exact work right now for residential and outpatient programs across Florida, Tennessee, Utah, and Massachusetts. A typical engagement runs a 30-day assessment covering the BAA inventory, Part 2 QSOA gap analysis, vendor SOC 2 review, retention schedule rewrite, and consent language revision.
If you are coming to NAATP National at Amelia Island May 4-6, 2026, Allison, Leah, Sariah and I will be there. AHS is sponsoring the Women in Leadership Luncheon. Find any of us between sessions if you want to walk through your AI tool stack and what a 90-day policy refresh looks like. Bring your BAA list. We will tell you which clauses to renegotiate before the next subpoena arrives at someone else’s program and the plaintiffs’ bar generalizes the playbook.
References
- SAMHSA: 42 CFR Part 2 Confidentiality Regulations and 2024 Final Rule
- HHS Office for Civil Rights: HIPAA Breach Notification Rule
- HHS: Sample Business Associate Agreement Provisions
- Florida Agency for Health Care Administration: Health Facility Regulation
- New York State Office of Addiction Services and Supports: Regulations
- ASAM Criteria, 4th Edition (2023)
- NAATP National Conference, Amelia Island, May 2026