Who can access a deceased client's therapy records under HIPAA?

Under HIPAA, the personal representative of a deceased patient's estate has the same rights to access the patient's protected health information as the patient had during their lifetime. The personal representative is the individual recognized under applicable state law as having authority to act on behalf of the deceased — typically the executor named in a will (for testate estates) or a court-appointed administrator (for intestate estates). The personal representative can request records access, authorize disclosures, and exercise other HIPAA rights that the patient held. There is one exception: if the covered entity knows that the deceased patient expressed during their lifetime a preference that specific information not be disclosed to a specific person, and if disclosure to that person is not otherwise required by law, the covered entity may honor that preference. Beyond the personal representative pathway, courts — including probate courts — can compel disclosure of therapy records through subpoena, summons, or court order, subject to any applicable privileges that the estate's attorney asserts on the therapist's behalf.

Blog · Legal & Compliance

Grief therapy records, deceased clients, and the probate-court subpoena risk

Q: Does HIPAA protect therapy records after a client dies?

Yes. Under 45 CFR 164.502(f)(1), HIPAA's Privacy Rule extends protection to individually identifiable health information about deceased individuals for 50 years following the date of death. Covered entities — including mental health providers — apply the same access and disclosure standards to deceased patients' records as they apply to living patients' records. The right to authorize disclosure does not expire at death; it passes to the personal representative of the deceased individual's estate — typically the executor named in a will or an administrator appointed by a probate court. A properly authorized personal representative may request access to the deceased patient's therapy records under the same HIPAA access framework that applied to the patient during their lifetime. The mental health privacy protections do not disappear at death, but they do not create an absolute bar to access either — they specify who has authority to authorize it and under what conditions.

Q: Can grief therapy notes be subpoenaed in a contested-will case?

In many cases, yes. Contested-will litigation frequently centers on testamentary capacity — whether the testator had the mental and legal capacity to execute a valid will at the time they signed it. The standard requires that the testator understood the nature of the testamentary act, knew what property they owned, could identify their natural heirs, and understood the relationship among those elements. Mental health records from the period around will execution are directly relevant evidence bearing on those questions. Both parties to a contested-will proceeding can subpoena mental health records from any therapist who treated the decedent during the relevant period. Whether the therapist can successfully assert psychotherapist-patient privilege in response to a probate subpoena depends on state law: some states recognize that privilege claims are limited or waived when the mental capacity of the deceased is directly at issue in a proceeding the deceased themselves initiated by executing a testamentary instrument. Grief therapists who worked with a client through anticipatory grief, estate planning considerations, or family conflict during the period around a will execution may find their clinical records sought in litigation years after the client's death.

Q: Does a cloud AI scribe vendor retain a deceased client's session audio?

Yes, unless the therapist has specifically requested deletion. Cloud AI scribe vendors retain session audio, transcripts, and intermediate draft artifacts for their stated retention periods — typically 30 to 90 days, sometimes longer depending on the platform and the therapist's plan tier. A client's death does not trigger automatic data deletion from a cloud vendor's infrastructure: the vendor has no way to learn that a client has died unless the therapist explicitly notifies them and requests deletion. The vendor's data retention runs on its own schedule, independent of the client's life status and independent of the therapist's own records management decisions. This means that session recordings from grief therapy — including audio that captures the client's disclosures about end-of-life plans, family dynamics, named beneficiaries, and mental state — may persist on cloud vendor infrastructure long after the client's death, accessible to the vendor's own legal process, to subpoenas targeting the vendor directly, and potentially to authorized access requests by the deceased client's personal representative.

2026-06-02 · 1,870 words · All posts

TL;DR

HIPAA protects a deceased client's therapy records for 50 years after death under 45 CFR 164.502(f)(1). The right to authorize disclosure passes from the patient to the personal representative of the estate — typically the executor or court-appointed administrator.
Probate courts routinely subpoena mental health records in contested-will proceedings. Testamentary capacity — whether the testator had the legal and mental capacity to execute a valid will — is exactly the kind of question a grief therapist's clinical notes can bear on.
Grief therapy sessions are high-disclosure by nature: end-of-life planning intentions, family conflict dynamics, named beneficiaries, and explicit descriptions of the client's mental and emotional state all appear verbatim in the session audio a cloud AI scribe has already captured.
A cloud scribe vendor retains that audio on its own infrastructure after the client dies. The vendor has no mechanism to learn of a client's death, so the data retention runs on its own schedule — independently of the therapist's records and independently of anything the estate subsequently decides about the deceased's privacy.
On-device note drafting keeps grief session audio and transcripts on the therapist's hardware. No cloud vendor becomes an independent custodian of a deceased client's sessions — or an independent target of legal process in estate litigation.

Grief therapists spend their clinical hours in some of the most legally significant territory in mental health practice. A client working through anticipatory grief — facing a terminal diagnosis, accompanying a spouse through end-stage illness, watching a parent's cognitive decline — routinely discloses in session the kinds of information that later become central to estate litigation: their own intentions about what they own and who they want to have it, the family dynamics that are driving conflict over those intentions, and their mental and emotional state at a specific point in time. These disclosures are clinical material in the session room. In a probate court, they are potential evidence.

The legal risk to grief therapy records is not hypothetical and is not limited to high-net-worth clients with contested estates. Contested-will proceedings arise across income levels whenever a family member believes that a testator's intentions were distorted by undue influence, cognitive decline, or acute psychiatric distress at the time of signing. Mental health records from the period surrounding the will execution are frequently subpoenaed in these proceedings. Grief therapists — who often work with clients precisely during the end-of-life periods most likely to produce estate-related conflict — are a predictable target.

In 2026, a growing number of grief therapists use cloud AI scribe tools to assist with session documentation. The HIPAA implications of those tools for deceased clients are under-examined. The cloud vendor that processed those sessions did not stop retaining that data when the client died. It has become an independent data custodian for sessions that may be legally significant in ways neither the therapist nor the client anticipated.

HIPAA protection of deceased patients' records

HIPAA's Privacy Rule does not expire at the patient's death. Under 45 CFR 164.502(f)(1), covered entities must treat PHI about deceased individuals with the same protections as PHI about living patients, and this obligation continues for 50 years following the date of death. A mental health provider who treated a client who subsequently died applies the same access and disclosure standards to those records that they would apply to records for a current living patient.

The mechanism for accessing a deceased patient's records under HIPAA is the personal representative framework. HIPAA defines a personal representative as the individual recognized under applicable state law as having authority to act on behalf of a deceased individual or their estate — typically the executor named in a valid will, or the administrator appointed by a probate court when the deceased died intestate. The personal representative has the same rights to request access to the deceased patient's protected health information as the patient had during their lifetime. They can receive records, authorize third-party disclosures, and exercise other HIPAA rights.

One modification applies: if the covered entity is aware that the deceased patient expressed a preference during their lifetime that specific health information not be disclosed to a specific individual, and if disclosure to that individual is not required by law, the covered entity may exercise professional judgment to honor that preference. This exception is narrow — it applies to known preferences the patient communicated, not to a general privacy-protective interpretation. It does not override court orders or valid legal process.

The practical implication is that a deceased client's therapy records are not sealed. They are protected by the same rules that applied during the client's lifetime, accessible through the same mechanisms — authorized request by the personal representative, court order, or subpoena — but with the patient's own authorization replaced by the estate's representative authority.

Probate litigation and the testamentary capacity subpoena

Contested-will proceedings are more common than most mental health providers realize. When a testator's family disagrees about whether the will accurately reflects the testator's genuine intentions — or whether the testator had the mental capacity to form those intentions — both sides of the dispute can use discovery to gather evidence. Mental health records from the period around will execution are discoverable evidence in many jurisdictions.

The legal standard for testamentary capacity varies by state but typically requires that the testator: understood the nature of the testamentary act (they were making a will, not signing an unrelated document); knew the general character and extent of their property; could identify their natural heirs and the relationship among them; and understood the plan of the disposition they were making. This is a relatively low bar compared to other legal capacity standards. A person experiencing moderate depression, processing grief, or managing early-stage cognitive decline may still meet the testamentary capacity standard. But the factual question of whether they met it at a specific moment in the past is what litigation is about — and mental health records from that period are direct evidence.

A grief therapist who worked with a client in the months before or after a will execution may have clinical documentation of the client's mental status, judgment, memory, insight, and decision-making capacity at exactly the relevant time. Both parties to a contested-will proceeding — the party defending the will and the party challenging it — may issue subpoenas to mental health providers seeking those records. Subpoenas reaching therapists' records in the context of civil proceedings are part of a well-established legal process; the psychotherapist-patient privilege that therapists can assert in response is real but limited and subject to state-specific exceptions.

One significant exception appears in many states' evidentiary codes: when the mental health of the deceased is directly placed at issue in a proceeding that the deceased themselves initiated — such as a will the deceased executed and which is now being probated — the patient-litigant exception or a deceased-patient exception may limit the effectiveness of privilege assertions. The argument is that the deceased voluntarily placed their mental state at issue by executing the will; the adverse party cannot be denied relevant evidence about that mental state. The scope and applicability of this exception varies by state and is a matter for the therapist's attorney, not the therapist, to navigate. But therapists whose clients are elderly, managing serious illness, or in documented conflict with family members should understand that their clinical records may become contested evidence in a proceeding years after the client's death.

What grief sessions actually contain

Grief therapy sessions are clinically rich in ways that are also legally significant. A client working through anticipatory grief may discuss, verbatim in session: the specific property they own and their intentions about who should receive it, the family relationships and conflicts that are shaping those intentions, their own mental and emotional state — including depression, anxiety, cognitive concerns, or medication side effects — their relationships with attorneys, financial advisors, and estate planning documents they are in the process of executing, and their fears about being manipulated, pressured, or misunderstood by family members in the context of those decisions.

A client in early bereavement may recount conversations they had with the deceased about the deceased's own intentions — direct evidence of the testator's state of mind that a probate court would find relevant. A client managing complicated grief arising from a contested inheritance may discuss the dispute in clinical detail, naming parties, describing alleged undue influence, and articulating their understanding of the deceased's actual intentions.

All of this session content — if processed by a cloud AI scribe — is captured in the session audio and verbatim transcript. Cloud AI scribes capture and retain intermediate records that are more complete than any clinical note: the audio preserves the client's exact words, tone, and any slips, hesitations, or restatements that the therapist may have summarized differently in a formal note. The transcript is the verbatim record. The note is an interpretive summary. In evidentiary terms, the audio and transcript are more probative than the note — and they exist on infrastructure the therapist does not control.

The vendor retention problem after a client's death

When a therapy client dies, the cloud AI scribe vendor that processed their sessions does not receive notification. The vendor has no mechanism for learning of a client's death — session audio is processed under the therapist's account, and the vendor knows nothing about the individual clients whose sessions are being processed beyond what appears in the audio itself. The data retention schedule — typically 30 to 90 days, depending on the platform and plan tier — runs on its own clock regardless of the patient's status.

This creates a custody problem. The therapist has knowledge of the client's death and can exercise judgment about how to respond to legal process in the estate context. The cloud vendor does not. The vendor's copy of the deceased client's sessions is legally its own data — held on its own infrastructure, subject to its own legal obligations, reachable through legal process directed at the vendor in the vendor's jurisdiction. A subpoena targeting the vendor's records in an estate proceeding does not go through the therapist's legal counsel; the vendor retains its own counsel to respond to its own subpoena. The BAA between the therapist and the vendor governs the vendor's obligations to the therapist; it does not govern the vendor's obligations to courts or litigants who serve process directly on the vendor.

The personal representative of the deceased client's estate could potentially reach the vendor through two pathways. The first is the authorized-access pathway under HIPAA's deceased-patient provisions: if the personal representative can establish their authority and make a proper HIPAA access request, the vendor — depending on how the BAA and the vendor's privacy policy are structured — may be required to respond as a business associate holding records on behalf of the covered entity. The second is the adversarial litigation pathway: a subpoena served on the vendor directly, in the vendor's jurisdiction, seeking the vendor's own records of sessions the vendor processed. The therapist's privilege assertion over the therapist's own records does not automatically extend to the vendor's separately-held copies of those same sessions.

On-device drafting for grief therapy

When note drafting stays on-device, the data-custody structure after a client's death is simpler. The therapist's hardware holds the session audio and transcript generated during treatment. The therapist's clinical records system holds the finalized notes. No third-party vendor holds independently subpoenable copies of the client's sessions. The therapist's records, in the therapist's custody, are the complete record.

When legal process arrives in connection with a deceased client's estate — a subpoena, an authorized request from the personal representative, or a court order — the therapist's attorney works with a single set of records in a single location. There is no parallel vendor infrastructure to notify, no out-of-state server to issue a separate subpoena for, no question about what intermediate artifacts the vendor retained that the therapist's own notes do not reflect.

The distinction between psychotherapy notes and progress notes under HIPAA is particularly relevant in this context. Progress notes — the structured clinical documentation that AI scribes typically generate, including SOAP, DAP, BIRP, and GIRP format notes — are part of the designated record set and are accessible to personal representatives under HIPAA's access provisions. Psychotherapy notes — process notes the therapist maintains separately from the clinical record — carry stronger legal protections and are not part of the designated record set. Grief therapists who document session content beyond the structured note may benefit from understanding which records fall into which category and how that affects what is reachable in probate proceedings.

TherapyDraft processes session audio entirely on the therapist's Mac — Whisper.cpp for transcription, an on-device language model for note drafting on Apple Silicon, no data transmitted to cloud infrastructure for audio, transcript, or note text. For therapists whose caseload includes grief work, anticipatory grief accompaniment, end-of-life clinical care, or clients navigating estate-related family conflict, the absence of a cloud vendor in the documentation chain means that a deceased client's sessions remain in the therapist's custody — not dispersed across independent infrastructure owners who have their own retention schedules and their own legal exposure. Solo plan starts at $49/month with a 10-session free trial and no card required.

Keep your deceased clients' sessions in your custody — not a vendor's.

TherapyDraft drafts SOAP, DAP, BIRP, and GIRP notes on your Mac with no cloud vendor in the chain. When a client dies, their session audio stays on your device — not on someone else's servers. 10 free sessions, no card required.

Join the waitlist — 10 free sessions, no card

Frequently asked questions

Does HIPAA protect therapy records after a client dies?

Yes. HIPAA's Privacy Rule extends protection to deceased individuals' PHI for 50 years after death under 45 CFR 164.502(f)(1). The same access and disclosure standards that applied during the patient's lifetime continue to apply. The difference after death is that the right to authorize access passes from the patient to the personal representative of the estate — typically the executor named in a will or an administrator appointed by a probate court. The therapist applies the same standards for releasing records: a properly documented request from the personal representative is treated the same as an authorization from the living patient. If the therapist knows the deceased patient expressed a preference that specific information not be shared with a specific person, the therapist may exercise judgment to honor that preference, unless disclosure is required by law or court order.

Who can access a deceased client's therapy records?

The personal representative of the deceased patient's estate — the executor of a will or a court-appointed administrator for an intestate estate — has the same HIPAA access rights to the deceased patient's records as the patient had during life. They can request records, authorize disclosures, and exercise other patient rights under HIPAA. Beyond the personal representative pathway, courts — including probate courts — can compel disclosure of therapy records through subpoena or court order, subject to any applicable privileges. In contested-will proceedings where testamentary capacity is at issue, both parties' attorneys can issue subpoenas to mental health providers who treated the decedent. Whether a privilege assertion will succeed in that context depends on state law, including whether the state recognizes a patient-litigant or deceased-patient exception to the psychotherapist-patient privilege when the decedent's mental state is directly at issue in a proceeding they initiated.

Can grief therapy notes be subpoenaed in a contested-will case?

In many cases, yes — and the privilege defense is uncertain. Contested-will proceedings turn on testamentary capacity: whether the testator had the mental and legal capacity to execute a valid will at the time of signing. Mental health records from the period around will execution are direct evidence bearing on that question. Both parties to the litigation can subpoena treating mental health providers for those records. The psychotherapist-patient privilege can be asserted in response, but several states recognize exceptions when the decedent's mental state is directly placed at issue by a proceeding the decedent themselves initiated — such as the will being probated. The scope of those exceptions varies by state and is a question for the therapist's attorney, not the therapist, to navigate in the specific proceeding. Grief therapists who worked with clients through anticipatory grief, end-of-life planning, or family estate conflict should be aware that their clinical records may become contested evidence years after the therapeutic relationship ended.

Does a cloud AI scribe vendor retain a deceased client's session data?

Yes, unless the therapist has actively requested deletion. Cloud AI scribe vendors retain session audio, transcripts, and intermediate draft artifacts for their stated retention periods — typically 30 to 90 days, sometimes longer. A client's death does not automatically trigger deletion: the vendor has no mechanism for learning that a client has died and no standard process for purging a specific client's data on that basis. The data retention schedule runs independently of the client's life status. This means that session recordings from grief therapy sessions — which may contain the client's disclosures about end-of-life plans, named beneficiaries, family conflict, and mental state — may persist on cloud vendor infrastructure for weeks or months after the client's death. That data is held on the vendor's own servers, under the vendor's own legal obligations, potentially reachable by legal process served on the vendor independently of the therapist's own records.

How does TherapyDraft handle grief therapy sessions differently?

TherapyDraft processes session audio entirely on the therapist's Mac — no audio, transcript, or draft note is transmitted to cloud infrastructure at any point. For grief therapy, this means that session recordings stay on the therapist's hardware rather than on a third-party vendor's servers. When a client dies, no cloud vendor holds an independent copy of their sessions. Legal process in probate or estate litigation goes through the therapist's records and the therapist's legal counsel — there is no parallel vendor infrastructure to subpoena separately, no out-of-state server holding a more complete version of the deceased client's sessions than the therapist's own clinical notes. TherapyDraft supports SOAP, DAP, BIRP, and GIRP note templates with a 10-session free trial and no card required.