Family therapy records, custody disputes, and AI scribes: what the whole family's PHI means for documentation

Individual therapy creates a straightforward documentation structure: one therapist, one patient, one set of records. The HIPAA framework was designed around this model. Group therapy, as the group session PHI explainer details, already strains this framework — one session audio holds multiple unrelated clients' protected health information simultaneously. Family therapy strains it in a different and more legally consequential way.

In family therapy, the participants are related — which means the session doesn't just contain multiple people's PHI, it contains PHI that intersects with the legal structure of the family unit itself: parental rights, guardianship, custody arrangements, and the specific access rights each parent holds over their minor child's health records. When a cloud AI scribe processes a family therapy session, the vendor receives audio containing all of this — and becomes a potential target in any legal proceeding where the family's relationships, parenting capacity, or the children's wellbeing are at issue.

This post examines what makes family therapy documentation legally distinct, how custody proceedings create specific subpoena pressure on both therapist records and AI scribe vendor records, and why the architectural-privacy case for on-device documentation is particularly strong for therapists working with families.

What a family therapy session actually contains

A typical family therapy session with two parents and two children captures, in a single audio recording:

• The children's protected health information. Each child's mental health status, behavioral patterns, school difficulties, trauma responses, and stated experiences about their home environment — all disclosed verbally in session. Voice biometrics (a HIPAA identifier) tie each child's voice to their identity throughout the recording.
• The parents' own individual disclosures. Parents in family therapy regularly disclose their own mental health histories, relationship conflicts, substance use, trauma histories, and parenting struggles. These disclosures appear in the session record even though the identified patient is the child. They are PHI attributable to the parents and potentially relevant to a custody evaluation.
• Family dynamics that no clinical note fully captures. The raw audio preserves the tone, affect, and interpersonal dynamics of the session — a parent's frustration, a child's distress response, the pattern of who interrupts whom, emotional escalation and de-escalation. The therapist's progress note documents their clinical observations. The vendor's recording documents everything.
• Names and details of third parties. Family members not in the room — a grandparent, a new partner, an absent parent — are frequently named and discussed. Their situations and behaviors, as described by the family members present, appear in the session audio.

The family therapist's documentation task is to produce a per-session progress note (sometimes per-member notes in more complex family systems) that captures the clinical work and treatment progress. AI-assisted documentation offers real efficiency here — family sessions are often 60 to 90 minutes of dense interpersonal content that is genuinely time-consuming to summarize well. The documentation efficiency argument is real. The privacy argument from the other direction is also real.

Minor-client PHI and the parental access rule

HIPAA's treatment of minor-client records is more complicated than many therapists realize. The general default is that a parent is the "personal representative" for their minor child — meaning the parent has the same access rights to the child's health records as the child would have as an adult. For family therapy, this means either parent with legal custody can typically request and receive the family therapy records documenting their child's participation.

This default has important state-law exceptions. Many states allow minors above a certain age — commonly 12 or 14 — to consent to their own outpatient mental health treatment without parental notification. California, Illinois, Oregon, Washington, and several other states have these provisions. When a minor has consented to their own therapy under state law, HIPAA defers to that state rule and allows the minor to control access to their own records, effectively removing the parents as personal representatives for that specific treatment relationship.

Family therapy complicates this further: a session that was conducted as family therapy — with the parents' knowledge and participation — likely falls outside the minor-consented-individual-therapy framework regardless of state minors' rights provisions, because the parents were present as participants and consented to the session themselves. But the boundary between "family therapy record" (accessible to both parents) and "individual minor therapy record" (potentially minor-controlled) is not always clean, particularly in practices that run both family and individual sessions with the same child.

The relevant point for AI scribe documentation: when the legal access question is already complicated at the therapist-records level, adding a cloud vendor who holds the raw session audio creates an additional layer of legal exposure that the therapist does not fully control.

How custody proceedings generate subpoenas for family therapy records

Family therapy records are among the most frequently sought records in custody proceedings. When mental health, parenting capacity, co-parenting dynamics, or the child's wellbeing are at issue in a custody case — which is most contested custody cases — both parties' attorneys will typically seek relevant therapy records. The standard routes:

• Subpoena to the therapist for records production or deposition testimony. The therapist responds under their jurisdiction's applicable privilege law, which may allow assertion of therapist-patient privilege (or its equivalent) to resist or limit disclosure. The outcome depends on the state, the specific legal theory being litigated, and the judge's ruling on privilege.
• Records request from the parents using their parental-representative access rights under HIPAA. A parent with legal custody does not need a court order to request their minor child's records from the therapist directly. Both parents can request independently. This route does not require a subpoena and bypasses the privilege question entirely for records the parent has an independent access right to under HIPAA.
• Subpoena to the cloud AI scribe vendor, when one was used. This is a route that many therapists and most clients do not anticipate. As the subpoena risk explainer details, a Business Associate Agreement governs the vendor's HIPAA obligations — it does not constitute a privilege or bar to valid court process. The vendor, as a commercial company in a specific jurisdiction, responds to subpoenas under applicable state and federal law, not under the terms of the BAA they signed with the therapist.

The third route is the most underappreciated. A custody attorney who knows that the family used an AI scribe service can subpoena the vendor for session recordings. The vendor holds raw audio — not the therapist's clinical summary of what clinically mattered, but the verbatim recording of what every family member said. In a custody case, these are meaningfully different things. The raw audio of a child describing their home environment, a parent's emotional response to their co-parent's allegations, a family member's account of a specific incident — these are exactly the kinds of material that custody evaluators and family court judges want access to.

The dual-target problem in custody proceedings

When a cloud AI scribe is in the data-custody chain, a custody proceeding involving the family creates two distinct legal targets for the same session content:

Target 1: The therapist's records. Progress notes, any signed consent or intake forms, the treatment summary. These are protected by therapist-patient privilege under applicable state law. Whether privilege holds in a specific custody case depends on state law, the legal theory at issue, and judicial discretion. The therapist (with their own attorney) manages this exposure.

Target 2: The cloud vendor's copy of the session audio. The full recording, the verbatim transcript, the intermediate outputs the vendor's model produced. As the data-flow explainer covers, vendors typically retain audio for 30 to 90 days after processing. The vendor responds to this subpoena independently. The therapist's privilege assertion against their own records does not necessarily protect the vendor's separately-held copies.

The same reasoning applies here as with the couples therapy divorce-discovery scenario: the couple's — or family's — reasonable expectation was that therapy content remained within the therapeutic relationship. The AI scribe silently added a third party to that relationship who holds their own copy of the session. That third party's liability and disclosure obligations in response to legal process are governed by commercial law and the vendor's jurisdiction, not by the therapeutic privilege the therapist might otherwise assert.

For family therapy specifically, the stakes are higher because custody proceedings are adversarial. Both parents' attorneys are actively seeking any material that advantages their client. A cloud vendor holding raw family session audio is a valuable target. The BAA explainer covers in detail what a Business Associate Agreement cannot do — and preventing valid subpoena compliance is on that list.

What cloud vendors receive from family sessions

For context on the data-flow specifics, the standard cloud AI scribe workflow for family therapy is similar to individual or group sessions:

1. The therapist uploads the session audio (or streams live) to the vendor's API.
2. The vendor's speech-to-text model produces a full verbatim transcript with speaker diarization — each voice segment attributed to its speaker (Parent A, Parent B, Child, Therapist).
3. The language model processes the attributed transcript to draft the session note.
4. The vendor retains the audio, the transcript, and the note draft for their specified retention period.

At step 2, the vendor has labeled each family member's voice. At step 4, those voice-labeled recordings and transcripts sit on the vendor's infrastructure. The labeled transcript is particularly significant in a custody context: it is not just an audio file where an attorney would need to do their own identification work — it is a speaker-attributed document that explicitly links each family member's name to their specific verbal disclosures throughout the session.

On-device processing: the vendor disappears from the chain

The architectural argument for on-device family therapy documentation is straightforward. If the family session audio is processed entirely on the therapist's Mac — transcription via whisper.cpp locally, note drafting via a local language model — no audio leaves the device. There is no cloud vendor. The vendor-subpoena route does not exist, because there is no vendor holding any copy of the session.

The therapist's own records — progress notes, any local audio the therapist retains on practice hardware — remain subject to the usual legal analysis: therapist-patient privilege, parental-representative access rights, court orders in custody proceedings. That analysis existed before AI scribes and continues to apply after. On-device processing does not change the therapist's own legal obligations. It removes an entire category of third-party exposure that only exists when a commercial vendor has been added to the data-custody chain without the family fully understanding what that means.

For families with contested custody, pending divorce proceedings, or any situation where the therapy content could become legally significant, the difference between "our session was processed locally on the therapist's computer" and "our session was uploaded to a cloud service that retains audio" is not a technical distinction — it is a material legal distinction about who holds what and who can be subpoenaed for it.

TherapyDraft's on-device workflow handles family sessions the same way it handles individual ones: record or drag in the audio, select the family therapy note template, and the local models transcribe and draft on the therapist's Mac. For practices handling both individual and family sessions, the architecture is consistent — no session audio leaves the device regardless of session type.

Further reading

• Group therapy notes and HIPAA: when one session holds a dozen clients' PHI — the multi-party PHI problem in group settings, which shares structural similarities with family therapy
• Can your couples therapy notes be subpoenaed in a divorce? — the couples therapy scenario in custody and divorce proceedings, a close parallel to family therapy records exposure
• Can an AI therapy note be subpoenaed? A 2026 legal-risk explainer — how subpoenas reach cloud AI vendors and what a BAA cannot prevent
• The 7 things Mentalyc, Upheal, and Blueprint actually send to their servers — a category-by-category breakdown of cloud scribe data flows including audio retention
• What is a BAA, actually — and what it does NOT cover — why a Business Associate Agreement does not prevent valid subpoena compliance by the vendor
• HIPAA for private-practice therapists — the 2026 rewrite — the full compliance posture for solo and small-group practice including AI documentation and minor-client record considerations

This post is educational commentary, not legal or clinical advice. HIPAA regulations, state minors' consent laws, therapist-patient privilege rules, and subpoena procedures vary significantly by jurisdiction. The rules governing parental access to minor-client therapy records, the scope of family therapy privilege, and the legal obligations of cloud vendors in custody proceedings depend on the laws of the applicable state and the jurisdiction of any legal proceeding. Consult a licensed healthcare attorney for guidance specific to your practice, client population, and jurisdiction.