ADHD and autism evaluation records: what AI scribes capture in psychological assessment practice

A 50-minute weekly therapy session and a psychological evaluation for ADHD or autism are both clinical encounters. Both may be recorded and processed by an AI scribe. But the records they produce are not the same kind of document — and the privacy consequences of cloud processing are not the same.

A therapy progress note documents a point in time: what the client brought to the session, what interventions were used, how the client responded, and what the plan is for next session. It is an episodic record. A psychological evaluation report documents something more stable: a person's cognitive profile — working memory capacity, processing speed, executive function architecture, verbal reasoning ability, adaptive behavior in real-world settings — alongside a diagnostic conclusion that will follow the client through every subsequent clinical and insurance encounter. For many clients with ADHD or autism diagnoses, the evaluation report is the foundational document from which all future treatment authorizations, school accommodations, workplace disability requests, and clinical referrals flow. The sensitivity of that document is categorically different from a session progress note, and the custody question — who holds it and in what legal framework — deserves specific attention.

What a psychological evaluation actually documents

A comprehensive evaluation for ADHD or autism spectrum disorder typically includes several distinct data streams that end up in the evaluation report. Cognitive testing produces specific numerical scores: a Full Scale IQ from the WISC-V or WAIS-IV, index scores for verbal comprehension, visual-spatial reasoning, fluid reasoning, working memory, and processing speed, each with a percentile and confidence interval. For ADHD evaluations, performance validity tests confirm effort, and continuous performance tests (Conners CPT, QbTest) produce attention and impulse control metrics. For autism evaluations, the ADOS-2 produces calibrated severity scores across social affect and restricted/repetitive behavior domains.

Behavioral rating scales add another data stream: parent-report and teacher-report forms (BASC-3, Conners, Vineland-3 for adaptive behavior) generate T-scores and clinical elevations across dozens of subscales — anxiety, depression, attention, hyperactivity, conduct, withdrawal, social skills, activities of daily living, functional communication. A comprehensive report may include rating scale data from multiple informants across multiple settings.

The clinical interview adds a third layer: developmental history (pregnancy and birth, early developmental milestones, language acquisition, sensory sensitivities, early social patterns), educational history (grade retention, special services, teacher feedback across years), medical history (neurological events, medication history, sleep patterns, dietary restrictions), family mental health history (first-degree relatives with ADHD, autism, learning disabilities, psychiatric diagnoses), and the current presenting problem in the words of the client and family.

The resulting report synthesizes all of this into a diagnostic conclusion and a recommendations section covering treatment referrals, school accommodations (IEP eligibility, 504 plan accommodations), medication consultation, and further evaluation if indicated. This is not an episodic snapshot. It is a comprehensive profile of how a person's brain processes information — a document whose accuracy and sensitivity make it one of the most significant clinical records a person may have.

The FERPA/HIPAA boundary in evaluation practice

The legal framework governing who can access an evaluation report depends partly on who conducted the evaluation and what records system it entered. When a school district's psychologist or a contracted evaluator conducts a psychoeducational evaluation to determine eligibility for special education services under IDEA, that evaluation becomes an education record under the Family Educational Rights and Privacy Act (FERPA). The school's records management obligations — who can access the record, how long it is retained, how parents can inspect and contest it — are governed by FERPA, not HIPAA. HIPAA contains a carve-out for records covered by FERPA, so the two frameworks generally do not overlap on the same copy of the same record.

The more common scenario for a private-practice clinician is different: a family pays out-of-pocket or through insurance for a private psychological evaluation, often because the school district declined to evaluate or because the family wants an independent assessment to support an IEP challenge or accommodation request. In that case, the clinician is a HIPAA-covered entity (or a business associate of one), and the evaluation records in the clinician's possession are HIPAA-covered health records. HIPAA's full compliance framework applies — including the requirement for business associate agreements with any vendor who touches the PHI.

The same child may end up with evaluation records under both frameworks: the private clinician's report is a HIPAA record; the copy the school receives and files in the student's special education records is a FERPA record. The clinician's BAA obligation runs to any vendor — including an AI scribe — who processes the evaluation data as part of the clinical workflow. The school's copy is outside the clinician's HIPAA obligations once it is transmitted, but the clinician's own records — including any intermediate processing by a cloud AI scribe — remain HIPAA-covered throughout.

Insurance pre-authorization and the evaluation data submission chain

For clinicians billing insurance for psychological or neuropsychological testing, the pre-authorization process creates a data submission chain that runs parallel to the clinical record. Insurers typically require a clinical rationale submission before approving testing: the presenting diagnosis or diagnostic question, the functional impairment the testing is designed to address, and the planned test battery with CPT codes. This submission may include behavioral rating scale results already collected, a description of prior interventions and their outcomes, and a narrative explaining why formal cognitive testing adds clinical value beyond clinical interview.

After testing is complete, some insurers require the evaluation report itself — or a clinical summary — as a condition of reimbursement, submitted to the utilization review department for retrospective review. The insurer's records of these submissions are covered by the insurer's own internal retention policies and legal obligations, not the clinician's HIPAA framework. Once the evaluation report enters the insurer's records management system, it is subject to the insurer's response obligations in legal proceedings — a different set of legal counsel, a different institutional interest, a different disclosure calculus — that the clinician does not control.

This data flow exists regardless of what documentation tool the clinician uses. Cloud AI scribes add another node to the network: the vendor's independently held copies of the clinical interview and the feedback session, on vendor infrastructure, subject to the vendor's own legal counsel's advice in any proceeding that reaches the vendor. A business associate agreement governs the vendor's HIPAA obligations; it does not govern how the vendor responds to a subpoena, a regulatory inquiry, or a litigation hold directed at the vendor as a separate legal entity. What a BAA does not cover includes the vendor's independent response to legal process that bypasses the therapist's records management decisions.

How AI scribes are used in assessment practice and what they capture

AI scribes in psychological assessment practice appear at two points in the evaluation workflow. The first is the clinical interview — a one- to two-hour structured conversation gathering the full history that informs the evaluation. During the clinical interview, the client or family discloses everything: the developmental timeline, early speech and motor patterns, sensory sensitivities, first signs of social difficulty, educational struggles by grade, medical events, family psychiatric history, prior diagnoses, prior treatments, current medications, and the presenting problem in granular detail. For autism evaluations, this is often the longest and most sensitive part of the process — parents describing their child's earliest social patterns, communication development, play behavior, and the family's experience navigating previous assessment attempts.

A cloud AI scribe processing this session holds verbatim audio and transcript of all of it. The developmental history is there. The family mental health disclosures are there. The names of prior clinicians, prior schools, prior evaluators are there. For a minor client, the parents' disclosures about their own psychiatric histories — often volunteered because genetic factors are clinically relevant for ADHD and autism — are there.

The second point is the feedback session: the appointment where the clinician explains the test results and diagnostic conclusion to the client and family. The clinician reads aloud the key findings — the Full Scale IQ, the index score profile, the behavioral rating scale results, the ADOS calibrated severity score if autism was assessed — and explains what the diagnosis means clinically, what accommodations and interventions are recommended, and what the family should do next. A cloud AI scribe processing the feedback session holds audio of the moment the diagnosis was disclosed, the specific scores the clinician cited, and the family's immediate response to the news. This is among the most emotionally sensitive clinical content a practitioner generates — and it is more complete in the vendor's verbatim audio than in any clinical note the clinician writes afterward.

The profiling dimension: evaluation data as a permanent cognitive record

Therapy progress notes are episodic records — each one describes a session at a point in time, and a new note next week may reflect a different clinical picture. A psychological evaluation report is different in kind. The cognitive profile it contains — IQ scores, index profiles, processing speed percentiles, working memory capacity — reflects how a person's brain functions, and that profile is relatively stable over years. An ADHD diagnosis at age ten shapes educational placement decisions, medication history, accommodation eligibility, and clinical referrals through adolescence and into adulthood. An autism diagnosis in adulthood shapes workplace accommodation requests, disability applications, and clinical treatment decisions that may persist for decades.

The permanence of evaluation data means that the custody question is not just about who holds the record now. Subpoenas can reach cloud vendor records years after the evaluation was conducted — in custody proceedings, disability hearings, employment disputes, or criminal cases where cognitive capacity or diagnosis is at issue. A vendor's retention schedule may keep session audio for months or years after the clinical relationship ends. The evaluation data that a cloud scribe captured during the clinical interview or feedback session may be on vendor infrastructure long after the clinician has closed the file.

On-device processing and the assessment context

For clinicians who conduct psychological evaluations — and for therapists providing follow-up therapy for clients after an ADHD or autism diagnosis — the custody structure for session audio matters differently than it does for routine therapy progress notes. The clinical interview contains a person's complete developmental and family psychiatric history. The feedback session contains the diagnostic conclusion and score-level detail. Both are among the most sensitive clinical exchanges a practitioner generates.

When session audio is processed on the therapist's own hardware rather than transmitted to cloud infrastructure, the vendor node disappears from the custody chain. The clinical interview audio stays on the therapist's device. The feedback session audio stays on the therapist's device. The clinician's designated record set — the evaluation report, the clinical notes, the rating scale data — is the complete record of the evaluation, in one location, under one legal framework. When legal process arrives in the form of a custody subpoena, a disability hearing, an insurance dispute, or an employment accommodation proceeding, the therapist's attorney works with one set of records. There is no vendor holding an independently subpoenable copy of the developmental history intake, the cognitive score explanation, or the moment the diagnosis was disclosed.

TherapyDraft processes session audio entirely on the therapist's Mac — Whisper.cpp for transcription, an on-device language model for note drafting on Apple Silicon, no data transmitted to cloud infrastructure for audio, transcript, or note text. For clinicians conducting ADHD and autism evaluations and for therapists providing ongoing care to clients with neurodevelopmental diagnoses, the absence of a cloud vendor in the session processing chain means that the comprehensive developmental histories, cognitive profiles, and diagnostic disclosures that assessment practice generates stay under one custodian. Solo plan starts at $49/month with a 10-session free trial and no card required.

Further reading

• The 7 things Mentalyc, Upheal, and Blueprint actually send to their servers — what intermediate records cloud scribes retain beyond the final note, including the verbatim-vs.-summarized distinction
• Can an AI therapy note be subpoenaed? A 2026 legal-risk explainer — how civil and criminal subpoenas reach cloud AI vendors directly and what the therapist cannot control about the vendor's response
• What is a BAA, actually — and what it does NOT cover — the structural limits of business associate agreements and why a signed BAA does not prevent the vendor's records from being subpoenaed in separate proceedings
• Psychotherapy notes vs. progress notes: what HIPAA actually says — which category evaluation reports fall into and what that means for patient access and legal discovery
• HIPAA for private-practice therapists — the 2026 rewrite — the full compliance posture for a solo practice and the AI scribe subsection of the 2026 risk landscape

This post is educational commentary, not legal, clinical, or compliance advice. HIPAA, FERPA, and state privacy law requirements applicable to psychological evaluation records vary by jurisdiction and by the clinician's role (evaluator, treating therapist, supervising clinician) and may change. Insurance pre-authorization requirements vary by payer and plan. The legal treatment of cloud AI scribe records in litigation, administrative proceedings, and insurance disputes is an area of developing law. Consult a licensed healthcare attorney before making documentation or technology decisions based on this content.