38 U.S.C. § 7332 and cloud AI scribes: VA heightened confidentiality for drug abuse, alcoholism, HIV, and sickle cell records — and the vendor archive that falls outside it

What 38 U.S.C. § 7332 protects — and why Congress created it

38 U.S.C. § 7332 is a confidentiality provision unique to the VA system. It protects records pertaining to the identity, diagnosis, prognosis, or treatment of any veteran or other person maintained in connection with the performance of any program or activity under title 38 relating to four specific conditions: drug abuse, alcoholism or alcohol abuse, infection with the HIV virus, and sickle cell anemia. The statute creates a separate, stricter confidentiality framework that sits above HIPAA for these categories of VA records.

The practical differences from HIPAA are substantial. Under HIPAA, a general authorization signed by the patient can cover a broad range of uses and disclosures. Under § 7332, disclosure of covered records requires written consent that identifies the specific person or entity to whom the disclosure is made, the nature of the information to be disclosed, and the purposes for which the information may be used. A blanket HIPAA authorization does not satisfy § 7332's consent requirement for these records. Under HIPAA, there are numerous exceptions that allow disclosure without patient authorization — for treatment, payment, healthcare operations, judicial proceedings with court orders or subpoenas, law enforcement, and public health. Under § 7332, those exceptions are significantly narrower. Disclosure in criminal proceedings is expressly prohibited with only very limited statutory exceptions. Violations of § 7332 carry criminal penalties under § 7332(e) — a criminal enforcement mechanism that HIPAA does not have at the provider level for disclosure violations.

Congress created § 7332 protections because the four covered conditions carry an elevated stigma and legal risk that ordinary HIPAA protections were not designed to address. A veteran seeking treatment for substance use disorder, HIV infection, or sickle cell anemia at a VA facility needs to be able to disclose fully to their treatment team without concern that those disclosures will be used in criminal prosecutions for drug offenses, will be accessible to employers, will affect child custody outcomes, or will be used in benefits proceedings in ways the veteran has not specifically authorized. The statutory framework reflects Congress's judgment that encouraging veterans with these conditions to seek VA care requires a confidentiality guarantee stronger than the civil enforcement model of HIPAA.

§ 7332 applies to records generated at VA facilities and at non-VA facilities providing care under VA authority — including community-care arrangements. The MISSION Act of 2018 significantly expanded VA community-care programs, authorizing the VA to contract with non-VA providers to treat veterans when VA facilities cannot provide timely or accessible care. A community-care therapist treating a veteran under a VA community-care contract or through the Community Care Network is providing care under VA authority. VA guidance indicates that § 7332 requirements apply to records generated in that community-care context for the four covered conditions. This means a community-care therapist treating a veteran for substance use disorder, documenting HIV-related psychological care, or counseling a veteran with sickle cell anemia about its psychological and functional impact is generating records that may carry § 7332 protections — records that belong in the § 7332 framework even though the therapist's office is not a VA building.

Where the cloud AI scribe vendor archive sits in relation to § 7332

When a community-care therapist uses a cloud AI scribe to document sessions with a veteran about substance use disorder, HIV, or sickle cell anemia, the session audio, generated transcript, and AI-drafted note enter the vendor's commercial infrastructure through the standard cloud AI scribe architecture: the audio is transmitted to the vendor's servers, processed through speech-to-text and clinical note generation systems, and retained in the vendor's commercial storage under a business associate agreement with the therapist. For a complete description of this data flow, see our analysis of what cloud AI scribes actually transmit to vendor servers.

The vendor retains these records as independently maintained business records under its HIPAA compliance framework. The vendor is a business associate of the therapist under HIPAA — a business associate agreement governs the relationship, defines the vendor's permitted uses and disclosures, and allocates HIPAA compliance responsibilities. That business associate agreement does not transform the vendor's independently maintained records into VA-system records governed by § 7332. The vendor is a commercial cloud infrastructure company, not a VA facility or VA-contracted treatment provider. The records the vendor holds — the audio, transcript, and AI note — are commercial business records generated in the vendor's own systems, not records "maintained in connection with the performance of any program or activity" under title 38 in the way that § 7332 contemplates.

This is the structural gap. The veteran and therapist are operating in a § 7332 context — VA-authorized community care for a § 7332-sensitive condition. The therapist's formal clinical records, maintained in the therapist's own medical records system, may carry § 7332's protections. But the cloud AI scribe vendor's independently maintained copy of the session content is outside the formal VA records system, held by a commercial entity whose HIPAA obligations govern its disclosures rather than § 7332's stricter framework. For a foundational understanding of what the business associate agreement does and does not prevent in terms of third-party access, see our analysis of what a BAA actually covers.

The gap also exists with respect to 42 CFR Part 2, the federal confidentiality regulation for substance use disorder records at federally assisted programs. Part 2 and § 7332 address overlapping but distinct populations and institutions. We analyzed the Part 2 cloud AI scribe gap in detail in 42 CFR Part 2 and AI scribes for addiction counseling. The § 7332 gap is distinct because it covers VA-context records specifically, extends beyond substance use disorder to include HIV and sickle cell anemia, and carries criminal enforcement mechanisms that Part 2's civil enforcement structure does not.

Five adversarial proceedings that reach the vendor archive

1. VA Benefits Administration disability adjudication

Veterans with service-connected disabilities file claims with the Veterans Benefits Administration for disability compensation. The adjudication process at the VBA requires the veteran's medical records to establish service connection, evaluate severity, and assign disability ratings. When a veteran's claim involves a condition that intersects with drug abuse, alcoholism, HIV, or sickle cell anemia — as a primary condition claimed for service connection, as a secondary condition to a service-connected primary diagnosis, or as a factor affecting the overall disability rating — the VBA adjudicator reviews treatment records for those conditions.

§ 7332-protected records in the VA system are subject to the veteran's consent requirements for disclosure even within VBA adjudication processes — the VA's internal disclosure of § 7332 records from one component to another for benefits adjudication purposes is governed by § 7332's framework, requiring that the disclosure meet one of the statute's authorization mechanisms. But the community-care therapist's cloud AI scribe vendor holds session content from the veteran's sessions — content that may document the same conditions in the same detail as VA-system records — as ordinary business records under HIPAA. The VBA, requesting community-care provider records as part of the claims file, can obtain the vendor's records through HIPAA-compliant authorization mechanisms, without the specific consent targeting that § 7332 requires for VA-system records.

The veteran who believes their substance use disorder treatment records are protected under § 7332 may be correct about their formal VA treatment records and their community-care therapist's formal clinical chart. They may not understand that the cloud AI scribe vendor's independently maintained copy of the same sessions exists outside the § 7332 framework and can be obtained by VBA through standard HIPAA authorization channels. The practical consequence is that session content the veteran disclosed in the expectation of § 7332 protection enters the benefits adjudication record through a pathway that bypasses the statute's safeguards.

VBA adjudications can also work in ways that disadvantage veterans through this gap. A veteran claiming service connection for PTSD related to military service may have also disclosed substance use disorder in community-care sessions — the substance use disorder being a coping mechanism for the PTSD, itself potentially service-connected as a secondary condition. If the VBA obtains the vendor's session audio documenting substance use, the adjudicator may reach conclusions about the veteran's credibility, the chronology of symptom onset, or the primary versus secondary nature of the conditions that § 7332's framework was designed to prevent arising from VA-system records without the veteran's specific, targeted consent.

2. Criminal proceedings

§ 7332(b)(2)(C) is one of the statute's most significant protections: it prohibits the use of § 7332-covered records "to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient" except under very narrow statutory exceptions. A veteran who sought treatment for drug abuse at a VA facility or under a VA community-care arrangement is protected by this provision from having their VA treatment records used against them in a criminal drug prosecution — their treatment-seeking, which Congress wanted to encourage, cannot become the source of criminal liability.

The cloud AI scribe vendor's archive does not carry § 7332(b)(2)(C)'s criminal proceedings bar. A prosecutor investigating a veteran for drug possession, distribution, or related charges can subpoena the community-care therapist's cloud AI scribe vendor under HIPAA's law enforcement exception at 45 CFR § 164.512(f), which permits disclosures for law enforcement purposes in response to legal process or pursuant to lawful authority. The session audio and transcript documenting the veteran's substance use disorder treatment — the substance use disclosures, the descriptions of frequency and quantity, the named substances, the relapse histories — may be responsive to that subpoena. The vendor produces these records under HIPAA's law enforcement exception in circumstances where § 7332 would have barred the same content from use in the criminal proceeding if it were held in VA-system records.

This is the sharpest edge of the § 7332 gap for cloud AI scribe documentation. § 7332's criminal proceedings bar reflects a foundational policy choice: veterans should be able to seek substance use disorder treatment without that treatment being converted into prosecution evidence. When the substance use treatment session content is simultaneously held in VA-system records (§ 7332-protected, criminal proceedings bar applies) and in a cloud AI scribe vendor's independently maintained archive (HIPAA-only, law enforcement exception available), the § 7332 protection depends on the prosecutor's avenue of access. A prosecutor who knows to go to the vendor rather than to the VA system can potentially obtain content that would have been barred under § 7332 from VA-system records.

HIV-related disclosures face a parallel criminal risk. Many states retain criminal statutes related to HIV exposure or transmission. § 7332 protects VA records about HIV treatment from use in criminal proceedings without the statutory exceptions. A cloud AI scribe vendor's archive of community-care sessions about a veteran's HIV diagnosis, treatment, and disclosure history exists outside that criminal proceedings bar. For the broader analysis of how criminal subpoenas interact with AI scribe documentation, see our analysis of whether AI therapy notes can be subpoenaed.

3. VA Board of Veterans' Appeals and federal courts benefits review

When a VA Regional Office denies a veteran's benefits claim and the veteran appeals, the case proceeds to the Board of Veterans' Appeals (BVA) and potentially to the Court of Appeals for Veterans Claims (CAVC) and beyond. Benefits appeals generate an extensive documentary record — the Claims File (C-file) — that includes all treatment records, examination reports, and correspondence related to the claim. Federal courts reviewing BVA decisions look at the administrative record as compiled in the C-file.

A veteran appealing a denial of disability compensation for a condition that intersects with § 7332-sensitive conditions — service-connected PTSD with co-occurring substance use disorder, HIV-related neurological complications, or sickle cell disease with psychological functional impact — may have community-care therapy records that are critical to the appeal. § 7332 governs how those records, if held in VA-system records, are incorporated into the C-file and made available in the appeals process. But the cloud AI scribe vendor's copy of the same sessions may already be in the C-file through HIPAA authorization channels without the targeted consent mechanism § 7332 requires.

In benefits denial appeals where "willful misconduct" is at issue — the VA's affirmative defense that an otherwise service-connected condition was caused by the veteran's own willful misconduct, including drug abuse — the veteran's treatment records for substance use disorder become directly contested. The government, defending a benefits denial on willful misconduct grounds, has an interest in the most complete available record of the veteran's substance use — including the verbatim session content from community-care therapy sessions that the vendor has preserved in its archive. § 7332 structures how VA-system records of that substance use can be used in this context. The vendor's independently maintained records are subject to the ordinary discovery and evidence framework of the administrative appeal, without the § 7332 overlay.

4. Child welfare and family court proceedings

Substance use disorder, HIV status, and sickle cell anemia management are all conditions that can become material in family court proceedings — both in child custody litigation and in child protective services investigations. A parent with a substance use disorder history has that history scrutinized in custody fitness determinations. A parent's HIV status may be raised in custody proceedings, particularly in contentious litigation, as touching on their ability to parent or on household health risks. Sickle cell anemia, as a chronic pain and management condition, can become material in parental capacity assessments.

§ 7332-protected VA records about these conditions are subject to the statute's consent and disclosure requirements even in family court proceedings. Family courts seeking to obtain § 7332-protected records must navigate the statute's framework — they cannot simply issue a court order that overrides § 7332 without meeting its requirements, and § 7332's protections extend to family court contexts. But the cloud AI scribe vendor's archive of community-care therapy sessions about these same conditions is accessible under HIPAA's judicial proceedings exception at 45 CFR § 164.512(e), which authorizes disclosure in response to a court order or subpoena with appropriate assurances in civil proceedings.

A custody attorney seeking records of a veteran parent's substance use disorder treatment may subpoena the community-care therapist's cloud AI scribe vendor and obtain session audio documenting the veteran's disclosures about substance use, relapse, recovery, and the functional impact on their parenting — records that would carry § 7332 protections if they were held in VA-system records. The family court proceedings exception in § 7332's framework requires specific procedures that the HIPAA judicial proceedings exception does not require in the same way. The practical result is that the most complete verbatim record of the veteran's sessions — the vendor's archive — may be more accessible in family court litigation than the veteran's formal VA or community-care clinical records.

CPS investigations involving veterans face a similar dynamic. Health oversight authority at 45 CFR § 164.512(b) permits disclosures to CPS agencies without patient authorization. § 7332 structures the VA's own disclosures to health oversight agencies differently. The vendor's archive is reachable through the health oversight exception without the § 7332 framework applying. For the analysis of how CPS health oversight authority interacts with cloud AI scribe archives in mandatory reporting contexts, see our analysis of mandated reporting and AI scribe documentation.

5. Federal employment and security clearance adjudication

Veterans who seek or hold federal employment, or who apply for or maintain security clearances as federal employees or contractors, are subject to investigative processes that can encompass their medical and mental health history. Under the Adjudicative Guidelines (Security Executive Agent Directive 4) applicable to security clearance determinations, drug involvement, alcohol consumption, and certain medical conditions including HIV-related concerns are listed as potentially disqualifying conditions that investigators evaluate against mitigating factors. Clearance investigators can request relevant medical records as part of the background investigation process, and applicants are required to provide authorizations for the release of medical records.

§ 7332 governs how VA-system records about a veteran's drug abuse treatment, alcoholism treatment, or HIV care can be disclosed in federal employment and clearance investigation contexts. The statute's specific consent framework and its restrictions on disclosure to federal agencies differ from ordinary HIPAA authorization. A veteran who has sought VA treatment for substance use disorder with the understanding that § 7332 provides stronger protections than ordinary HIPAA for those records may disclose more completely to their VA treatment team, and to their community-care therapist, than they would if they understood the records were subject to ordinary HIPAA disclosure.

A security clearance investigation that identifies community-care treatment records — through the standard SF-86 disclosure requirements or through the background investigation process — can reach the cloud AI scribe vendor's archive through HIPAA authorization mechanisms. The veteran's authorization for release of medical records in the clearance process, if it extends to community-care providers, is sufficient to reach the vendor's independently maintained session content. The session audio and transcript in the vendor's archive documenting substance use disclosures, HIV status discussions, and treatment history may be more granular and more verbatim than the formal clinical note — and the vendor's independently maintained records exist as a separately reachable source regardless of what records the therapist formally produces in response to the clearance investigation's records request.

The asymmetry is significant: § 7332's targeted consent mechanism for VA-system records in the clearance context, and the statute's specific framework for how federal agencies obtain VA records, creates protections that do not extend to the cloud AI scribe vendor's independently maintained copy of the same sessions. A veteran who carefully managed their formal VA record disclosures in the clearance context may not have accounted for the commercial vendor's archive of their community-care sessions existing as a separately reachable, independently maintained source of the same session content.

The veteran's expectation and what the vendor archive actually is

A veteran who seeks mental health care from a community-care therapist for conditions related to substance use disorder, HIV, or sickle cell anemia is often doing so in the context of VA-coordinated care or with awareness that their treatment is connected to their VA relationship. Their understanding of confidentiality may be shaped by their experience with the VA system and with § 7332's stricter framework — they may have been told by VA staff that substance use treatment records have stronger protection, that their HIV status has heightened confidentiality, or that these records cannot be used against them in criminal proceedings. That understanding is accurate for records in the VA system and, to the extent community-care provider records carry § 7332 protections, for the therapist's formal clinical records.

The cloud AI scribe vendor's archive is not in that chain. The veteran has no direct relationship with the vendor, received no disclosure from the vendor, signed no consent with the vendor, and has no § 7332 relationship with the vendor. The vendor exists in the care chain as the therapist's business associate — a status that governs the therapist's obligations under HIPAA but does not extend the § 7332 framework to the vendor's independently maintained records. From the veteran's perspective, the cloud AI scribe is the therapist's documentation tool; from the legal framework's perspective, the cloud AI scribe vendor is a commercial entity holding independently maintained business records subject to the HIPAA framework rather than § 7332's stricter confidentiality protections.

The informed consent gap here has specific features. A community-care therapist's Notice of Privacy Practices will reference business associates as a category of entity receiving protected health information, but it will not typically explain that the specific business associate — the cloud AI scribe vendor — holds verbatim session content about the veteran's § 7332-sensitive conditions as independently maintained commercial records, or that those records are accessible through legal processes that § 7332 would bar for the same content if it were in VA-system records. The veteran signs a general HIPAA authorization for the community-care relationship; they do not receive a § 7332-specific disclosure about the cloud AI scribe vendor's role in the care chain and what protections do and do not apply to the vendor's records.

On-device processing and what it eliminates for § 7332-sensitive practice

On-device AI scribe processing eliminates the vendor archive problem across all five adversarial proceedings. When the therapist uses an on-device AI scribe — processing session audio on a local device with no transmission to commercial cloud infrastructure — the vendor archive that VBA adjudicators, criminal prosecutors, benefits appeals panels, family court litigants, and clearance investigators can reach through their respective legal pathways does not exist.

A criminal prosecutor subpoenaing the cloud AI scribe vendor for session content about the veteran's substance use disorder treatment finds no responsive records — the vendor holds no copy of the session because no audio was transmitted to the vendor. The criminal proceedings bar in § 7332(b)(2)(C), which protects VA-system records of drug abuse treatment from use in criminal proceedings, does not need to extend to the vendor archive, because the vendor archive does not exist to be protected. The contemporaneous session record exists in the therapist's own formal clinical documentation, under the § 7332 framework applicable to the community-care context, without an additional commercial archive existing as a separately reachable source.

VBA adjudicators obtaining community-care provider records for a veteran's disability claim access the therapist's formal clinical records — the records the therapist prepared and maintains, subject to the § 7332 disclosure framework applicable to the community-care context. The vendor's independently maintained archive, which would exist outside that framework under HIPAA only, does not exist to be obtained through HIPAA authorization channels. The veterans' session content about § 7332-sensitive conditions resides in one custody location, governed by the strongest applicable confidentiality framework, rather than in two locations with the vendor's copy governed by the weaker HIPAA-only framework.

Family court subpoenas directed at the cloud AI scribe vendor find no responsive archive. The vendor has nothing to produce. Custody litigation reaches the therapist's formal clinical records through the judicial proceedings exception, under the full weight of the § 7332 framework applicable to those records — not the HIPAA-only framework applicable to an independently maintained vendor archive. A veteran parent's substance use disorder, HIV status, and sickle cell treatment records are subject to the most protective framework applicable to those records rather than to a parallel HIPAA-only copy existing outside that framework.

Security clearance investigations that reach community-care provider records find only the therapist's formal clinical documentation. The vendor's independently maintained verbatim record of the veteran's sessions — the most granular, most complete contemporaneous account of the session content — does not exist in the commercial infrastructure of a cloud AI scribe provider accessible through ordinary HIPAA authorization channels. The veteran's targeted consent framework under § 7332 governs what is produced in the clearance investigation, not the broader HIPAA authorization framework applicable to the vendor's business records.

The veteran's expectation of confidentiality is architecturally honored. The session content about substance use disorder, HIV, or sickle cell anemia exists in the custody of the treating clinician, subject to the § 7332 framework applicable to the community-care context, without a separately maintained commercial copy subject to the weaker disclosure framework that HIPAA alone provides for these particularly sensitive conditions.

Practical implications for community-care therapists treating veterans

Know whether your veteran patients are in VA-authorized community care. If a veteran is referred to you through the Community Care Network, the Veterans Choice Program, or another VA-contract arrangement, you may be generating records subject to § 7332's heightened framework for the four covered conditions. Your documentation practices — including your AI scribe vendor relationships — operate in a legal context that differs from standard HIPAA-only practice. The cloud AI scribe vendor you use is not in the § 7332 chain even if you are.

Your HIPAA NPP does not address the § 7332 gap. Standard informed consent and Notice of Privacy Practices language covers business associate relationships in general terms but does not explain to veterans that their substance use disorder, HIV, or sickle cell treatment content is held by the cloud AI scribe vendor under HIPAA only — not under § 7332's stricter framework. Veterans with these conditions who understand that § 7332 applies to their VA-context care should receive specific, comprehensible disclosure about how the cloud AI scribe vendor's independent archive relates to that protective framework.

The criminal proceedings bar in § 7332 does not extend to the vendor archive. For substance use disorder treatment content specifically, the most significant protection § 7332 provides — its near-categorical bar on use of covered records in criminal proceedings — does not reach the cloud AI scribe vendor's independently maintained copy of session audio and transcripts. Community-care therapists treating veterans for substance use disorders should weigh this against their documentation tool choices: a cloud AI scribe vendor's archive of those sessions is accessible through HIPAA's law enforcement and judicial proceedings exceptions in contexts where § 7332 would have barred access to the same content in VA-system records.

Consider on-device processing as the documentation approach that eliminates the vendor archive gap. The structural gap between § 7332-protected VA-system records and a cloud AI scribe vendor's HIPAA-only independently maintained archive is eliminated when session audio is processed entirely on the therapist's local device without transmission to commercial cloud infrastructure. For community-care therapists treating veterans with § 7332-sensitive conditions, on-device processing means the veteran's session content exists in one custody location — the therapist's own records system — governed by the full framework applicable to those records. For the broader context of how HIPAA's architectural design compares to contractual compliance claims for AI scribe tools, see our analysis of what a BAA actually covers, and for the prior veterans-specific analysis of MST and PTSD documentation risks, see our analysis of veterans' mental health records and AI scribe documentation.

Frequently asked questions

What does 38 U.S.C. § 7332 protect?

§ 7332 protects records pertaining to the identity, diagnosis, prognosis, or treatment of veterans at VA facilities or non-VA facilities treating veterans under VA authority, relating specifically to drug abuse, alcoholism or alcohol abuse, infection with the HIV virus, and sickle cell anemia. The protections are stricter than HIPAA: specific, targeted written consent is required for disclosures rather than a general HIPAA authorization; use in criminal proceedings is almost categorically barred; and violations carry criminal penalties. Congress created § 7332 to ensure veterans could seek treatment for these stigmatized and legally sensitive conditions without those records being used against them.

Does § 7332 cover records held by community-care therapists or their cloud AI scribe vendors?

§ 7332 applies to records maintained in connection with VA-authorized programs and activities, which includes community-care arrangements under the MISSION Act. A community-care therapist treating a veteran under a VA contract may generate records subject to § 7332 for the four covered conditions. A cloud AI scribe vendor that receives and processes session audio from that therapist holds its independently maintained business records under its HIPAA framework — not under § 7332. The vendor is not a VA facility or VA-contracted treatment provider, and the business associate relationship with the therapist under HIPAA does not carry § 7332's protections into the vendor's independently maintained records.

Can a cloud AI scribe vendor be subpoenaed for substance use disorder session content despite § 7332?

In most circumstances, yes. § 7332's criminal proceedings bar applies to records "maintained in connection with the performance of any program or activity" under VA authority — a category that encompasses VA-system records and community-care provider formal clinical records in the VA-authorized care context. A cloud AI scribe vendor's independently maintained business records are held outside the VA records system and outside the community-care provider's formal clinical records. Civil subpoenas under FRCP Rule 45 and law enforcement requests under HIPAA § 164.512(f) can reach those vendor records in circumstances where § 7332 would have barred access to the same content in VA-system records.

Does on-device AI scribe processing protect veteran § 7332-sensitive content from the vendor archive problem?

Yes. On-device processing means session audio is transcribed and draft notes are generated entirely on the therapist's local device, with no transmission to a cloud vendor's commercial infrastructure. The independently reachable vendor archive that VBA adjudicators, criminal prosecutors, family court litigants, benefits appeals panels, and clearance investigators can reach through their respective legal processes does not exist. Session content about the veteran's substance use disorder, HIV status, or sickle cell anemia treatment exists in the therapist's own custody under the applicable § 7332 framework — without a parallel HIPAA-only copy in commercial cloud infrastructure existing as a separately reachable independent source.

How does § 7332 differ from 42 CFR Part 2 for VA substance use treatment records?

42 CFR Part 2 protects records at federally assisted substance use disorder treatment programs broadly — many non-VA providers receiving federal SUD treatment funding are Part 2 programs. § 7332 is specific to the VA system and extends beyond substance use disorder to include HIV and sickle cell anemia. A veteran in VA-authorized SUD treatment may have records covered by both frameworks. The cloud AI scribe gap applies differently under each: Part 2's re-disclosure prohibition and its interaction with vendor archives involves different enforcement mechanisms than § 7332's criminal penalty structure. Both share the fundamental structural problem that a cloud AI scribe vendor's independently maintained business records are not the same as the "records" these protective frameworks were designed to restrict. For the Part 2 analysis, see our analysis of 42 CFR Part 2 and AI scribes for addiction counseling.