Licensing board character and fitness review for initial mental health licensure and cloud AI scribes: five adversarial proceedings where the vendor archive becomes evidence in the applicant's own licensing process

The character and fitness review is a standard component of the initial licensure process for mental health professionals in every state. When a graduate student completes their LMSW training and applies for an LCSW license, when a counseling graduate student applies for an initial LPC license, when an MFT trainee completes supervised hours and files their first MFT license application, or when a PsyD intern applies for initial psychologist licensure, the state licensing board asks a version of the same question: have you received mental health treatment, and if so, does that history reflect on your present fitness to practice?

The question is not punitive in its design. Most state licensing statutes frame character and fitness review as an inquiry into whether an applicant's history suggests impairment that would affect their ability to practice safely — not whether they have sought help. Many boards emphasize that seeking mental health treatment is healthy and should not alone disqualify an applicant. The practical reality is that disclosing mental health treatment history opens an investigation pathway, and that investigation pathway may lead to a cloud AI scribe vendor that holds verbatim session audio and AI-generated transcripts from the applicant's own therapy as a client.

The applicant did not choose the tool their therapist used to document sessions. They did not read or approve the AI-generated transcripts. They may not have known their sessions were transcribed by a cloud-based AI model at all. But the vendor the therapist contracted with holds those transcripts as its own business records — records classified under HIPAA as protected health information, but fully accessible to a state licensing board conducting health oversight activities under 45 C.F.R. § 164.512(d). The vendor's records are not the therapist's records, and the therapist's clinical privilege does not extend to protect business records the vendor independently generated and holds in its own systems.

Five adversarial proceedings show how the character and fitness review process — when intersected with the cloud AI scribe vendor archive — creates disclosure pathways that differ structurally from anything the initial licensure process was designed to produce. As the BAA analysis explains, a business associate agreement defines the vendor's permitted uses and disclosures but cannot restrict the independent disclosure authorities HIPAA grants to health oversight bodies conducting authorized investigative activities.

The character and fitness disclosure mechanism and the HIPAA health oversight pathway

State licensing boards ask mental health license applicants to disclose prior mental health treatment in order to identify applications from practitioners whose condition might currently impair their capacity to practice. The disclosure obligation typically takes the form of a checkbox question on the license application — "have you been treated by a mental health professional in the past five years?" or a similar formulation — followed by a space for the applicant to provide dates, treating providers, and a brief description. Some states use a more targeted question: "have you been hospitalized for a psychiatric condition?" Others ask about current impairment rather than past treatment, specifically to avoid discouraging treatment-seeking.

Whatever the specific formulation, disclosure triggers a character and fitness investigation. The investigation process typically begins with a request for the applicant's consent to obtain treatment records directly from the treating clinician. The consent request is framed as routine, and most applicants provide it — declining to cooperate with an authorized board investigation creates an inference problem more serious than the underlying disclosure in most applicants' situations. Once the board obtains the treating clinician's clinical records, it reviews those records against its character and fitness standards, which typically ask whether the applicant has demonstrated that any impairment has been addressed and that their current condition does not pose a risk to clients.

The treating clinician's clinical records are the product of clinical judgment: the clinician documented what was clinically significant, what the treatment plan required, what progress the client demonstrated, and what functional limitations or risks were relevant to the treatment. What the treating clinician did not document — the texture of specific sessions, spontaneous client disclosures about functioning outside the clinical focus, the full verbal content of sessions that the clinician exercised professional discretion to summarize rather than transcribe — is in the cloud AI scribe vendor's verbatim transcript.

The licensing board investigating the character and fitness question has HIPAA § 164.512(d) health oversight authority independent of the applicant's consent to the treating clinician's records. Health oversight authority permits a covered entity or business associate to disclose protected health information to a health oversight authority conducting oversight activities authorized by law, including investigations of health care practitioners and prospective health care practitioners. A state licensing board conducting a character and fitness investigation of an initial licensure applicant is a health oversight authority. The cloud AI scribe vendor that holds verbatim session records from the applicant's therapy is a business associate holding protected health information about the applicant. HIPAA § 164.512(d) permits that disclosure. The applicant's consent to the treating clinician's production does not limit the board's independent authority to reach the vendor.

This structure is distinct from the licensing board disciplinary proceedings that reach a practicing licensee's client records through a complaint about the licensee's practice: in that scenario, the practicing therapist's cloud AI scribe vendor holds records of the sessions the therapist conducted as a clinician. In the initial licensure context, the applicant is on the other side of the therapeutic relationship — they are the client whose therapy records are the subject of the investigation, not the clinician whose practice records are under review. The structure of HIPAA's health oversight disclosure authority is the same; the identity of the person whose sessions are in the vendor archive is different.

Proceeding 1: initial LCSW or LPC application — character and fitness investigation triggered by mental health treatment disclosure

An LMSW graduate who has completed supervised hours and is applying for LCSW licensure discloses on their application that they received individual therapy for anxiety during the final year of their graduate program. The therapy was standard — they sought support while managing the demands of their program, their practicum, and a personal transition — and they have been functioning well. Their therapist was a licensed clinician in private practice who documented their sessions using a cloud AI scribe.

The licensing board's character and fitness process requests the applicant's consent to obtain records from the treating clinician. The applicant consents. The board receives the treating clinician's clinical notes: a treatment plan, progress notes, a discharge summary noting successful completion of therapy with no current impairment. The board reviews the notes and identifies a reference in one session's progress note to a period of elevated distress — language the therapist included as clinical context for the treatment approach. The board requests additional information about the period of distress: did it affect the applicant's ability to manage their practicum responsibilities? Was it addressed in supervision?

The additional information the board requests from the applicant may not resolve its concern, because the board's concern is about what occurred during those sessions — and what occurred is in the cloud AI scribe vendor's verbatim transcript of those sessions, not in the treating clinician's summary notes. The board may issue a HIPAA § 164.512(d) health oversight request to the cloud AI scribe vendor for all session records associated with the applicant's treatment. The vendor holds verbatim audio and AI-generated transcripts. Those transcripts include the full content of every session — not just what the treating clinician found clinically significant to document, but everything the applicant said in the sessions the therapist used the cloud AI scribe to transcribe.

The applicant does not know this request has been issued. HIPAA § 164.512(d) does not require the vendor to notify the patient that records have been requested by a health oversight authority while an investigation is in its preliminary phase. The applicant's first indication that the vendor's records are in the board's file may be at a formal hearing — after the preliminary investigation has concluded and the board has made a preliminary determination that the character and fitness question warrants formal review. What the description of what cloud AI scribes actually send to their servers makes concrete is what that vendor archive contains — and what the licensing board receives when it issues that request.

Proceeding 2: LPC licensure application following disclosure of a graduate training therapy requirement

Many accredited counseling graduate programs require students to receive a specified number of hours of personal therapy as part of the training curriculum. The rationale is clinically sound: a counselor who has experienced their own therapeutic process develops professional competence in ways that supervision alone cannot supply. The requirement is an acknowledged, documented part of the curriculum — not a voluntary choice the student made for personal reasons but a mandatory training activity the program required for completion.

When an LPC applicant discloses mental health treatment history on their initial license application, some disclosures are framed around the program-required therapy. The applicant may believe that disclosing a mandated training requirement — rather than voluntary treatment for an identified concern — places the disclosure in a category the board's character and fitness review is not primarily targeting. That framing does not change the nature of the licensing board's investigation pathway.

A licensing board that receives a disclosure of mental health treatment — regardless of whether the treatment was voluntary or program-required — has the same HIPAA § 164.512(d) health oversight authority to investigate the nature and content of that treatment. The clinical instructor or supervisor who recommended the treating therapist may have used a cloud AI scribe in their own practice; the treating therapist the program referred the student to may have used one. The vendor that holds session records from the program-required therapy holds them as business records subject to HIPAA's health oversight disclosure provision — not as protected training records or educational records under FERPA.

A licensing board that investigates an LPC applicant's program-required therapy is not asking whether the applicant complied with the training requirement — it is asking whether what occurred in those therapy sessions reflects on the applicant's current fitness to practice. The vendor's verbatim transcripts of the program-required therapy sessions may contain disclosures the applicant made to their therapist in the context of a training relationship that they understood to be part of their professional development — disclosures about their reactions to clinical training, their challenges in the practicum setting, their concerns about clients. Those disclosures are in the vendor archive, accessible to the licensing board, and not protected by the training rationale under which the therapy was required.

Proceeding 3: initial PsyD or PhD psychologist licensure application after an internship-year acute mental health episode

The psychology internship year — the APPIC-matched predoctoral internship — is among the most stressful periods in the training pipeline for clinical and counseling psychologists. A PsyD or PhD intern who experiences an acute mental health episode during the internship year may receive outpatient follow-up therapy with a clinician separate from the internship training site. That therapist may use a cloud AI scribe. The intern's licensing application, filed after internship completion, asks about psychiatric hospitalization or acute mental health episodes requiring treatment.

A licensing board that reviews an application disclosing acute-episode treatment seeks to assess whether the episode represents resolved distress or an ongoing condition that might affect the applicant's capacity to practice with clients in a psychologist role. The board's investigation will typically request the treating clinician's clinical records and may require a current evaluation by a board-approved examiner. The investigation may also reach the cloud AI scribe vendor that holds session records from the outpatient follow-up therapy.

The internship context adds a specific complexity. An intern who experienced an acute episode during internship and disclosed it to the training director — as many training sites require — has created a training site record of the episode. The training director's report to the APPIC system and the training site's own records document the episode at the training level. The cloud AI scribe vendor's records from the outpatient follow-up therapy are separate from those training records: they are HIPAA protected health information held by the vendor, accessible through the licensing board's health oversight authority, and not derivative of the training site records the board may also obtain. The board may reach both sets of records through independent pathways — the training site's records through the applicant's written authorization, and the vendor's records through HIPAA § 164.512(d) — and may compare them for consistency.

The AI-generated transcript of outpatient follow-up sessions may capture the intern's account of what occurred during the acute episode in greater detail than the clinical notes the therapist wrote. The verbatim content — the intern's own words describing the episode, their functioning during the period, and their recovery — is in the vendor archive in the form the intern expressed it, not in the form the therapist chose to document it. A licensing board assessing current fitness may find the verbatim account more informative than the clinician's narrative summary. The analysis of AI therapy note subpoenas describes how the vendor's records occupy a distinct legal category from the clinical record the therapist created — a category that is accessible to the licensing board through HIPAA health oversight rather than through the judicial subpoena mechanisms most practitioners associate with record access in adversarial proceedings.

Proceeding 4: character and fitness appeal following initial denial — new discovery pathways to the vendor

A licensing board that determines, after its character and fitness investigation, that an applicant does not meet the fitness standards for initial licensure issues a preliminary denial. The applicant has the right to appeal the preliminary denial through the board's administrative process — typically an opportunity to submit additional evidence and, in some states, to appear at a formal hearing before the board or a hearing officer.

The appeal proceeding is not a fresh start. The board retains the investigation file, including any records it obtained from the treating clinician and from the cloud AI scribe vendor during the preliminary investigation. The appeal proceeding adds a new layer of discovery: the applicant, in preparing their response to the preliminary denial, may submit additional records and evidence, including updated clinical records from ongoing or resumed therapy. The board, in preparing its case for the formal hearing, may supplement its existing record with additional requests to the same vendor or to new vendors holding records from therapy the applicant undertook after the preliminary denial.

Many applicants who receive a character and fitness preliminary denial resume or intensify therapy in the period between the preliminary denial and the appeal — both for genuine therapeutic support and as a demonstrable step toward addressing the board's concerns. If that post-denial therapy uses a cloud AI scribe, the new vendor holds a new session archive: records from the therapy the applicant undertook specifically to address the board's character and fitness concerns. The board's health oversight authority over the applicant — who remains a prospective mental health practitioner seeking licensure — extends to those new therapy sessions through the same HIPAA § 164.512(d) mechanism. A new health oversight request to the new vendor for sessions from the post-denial period is within the board's investigative authority, and the new vendor's verbatim transcripts may contain the applicant's own candid account of the character and fitness process — including their reactions to the preliminary denial, their view of the board's concerns, and their assessment of their own situation — in sessions they sought for support during an already difficult period.

The applicant's attorney in the appeal proceeding can advise the applicant about their options and about the board's discovery authority, but the structural problem is that on-device processing is the only architectural intervention that would have eliminated the vendor archive before the appeal proceeding began. At the appeal stage, the vendor archive already exists.

Proceeding 5: reapplication following voluntary withdrawal — HIPAA's absence of a re-investigation restriction

An applicant who learns, during the character and fitness investigation, that the licensing board has issued a HIPAA § 164.512(d) health oversight request to the cloud AI scribe vendor holding their therapy records may choose to withdraw their initial license application voluntarily rather than continue through a formal hearing process with the vendor's records in the board's file. Voluntary withdrawal is sometimes presented as a strategic option: it avoids a formal denial on the record, preserves the option to reapply, and removes the immediate pressure of a pending formal proceeding.

Voluntary withdrawal does not eliminate the vendor archive. The vendor's session records continue to exist in the vendor's systems for as long as the vendor's data retention policy requires — a period that may be years, determined by the vendor's standard retention schedule rather than by any outcome in the licensing process. HIPAA does not impose a time limit on a health oversight authority's ability to request records from a vendor in connection with a new investigation of the same person. A licensing board investigating the same applicant's reapplication is a new health oversight activity — it may issue a new request to the same vendor for the same session records, or for new session records if the applicant received additional therapy between the withdrawal and the reapplication.

Reapplication also typically requires disclosure of the prior application and voluntary withdrawal. Most state licensing boards ask applicants to disclose prior applications, prior denials, and prior withdrawals. The character and fitness review for the reapplication begins with knowledge of the prior investigation, including whatever the board learned from the cloud AI scribe vendor during that investigation. The applicant who withdrew to avoid the formal hearing has not reset the clock — they have added a new disclosure obligation to the subsequent application and preserved the vendor's archive for re-use in the new investigation cycle.

For an applicant whose prior application withdrawal was itself prompted by the vendor archive problem, the reapplication presents a recursive structure: the same structural issue — a vendor archive from prior therapy that the board's health oversight authority can reach — persists into the new application cycle. What the therapist-as-patient analysis describes for practicing therapists seeking their own personal therapy applies with equal force to training professionals seeking therapy during the licensure pipeline: the therapist who treats them makes the architectural choice that determines whether a vendor archive exists. A treating therapist using cloud AI scribe creates a vendor archive that exists independently of any licensing outcome. A treating therapist using on-device processing creates no vendor archive to subpoena — in the first application, in the appeal, or in the reapplication.

The specific problem of verbatim transcripts in character and fitness proceedings

The common thread across all five proceedings is the distinction between the treating clinician's clinical notes and the cloud AI scribe vendor's verbatim AI-generated transcripts. Clinical notes are the product of professional judgment: a licensed clinician reviews the content of a session and documents what is clinically significant, what the treatment plan requires tracking, and what reflects the client's progress. What the clinician decides is not significant enough to document — the spontaneous content of a session that doesn't fit the treatment focus, the client's disclosures about external circumstances the clinician noted but didn't pursue, the texture of a session that informed the clinician's approach without producing a documentable clinical finding — is not in the clinical notes.

It is in the vendor's verbatim AI-generated transcript. The AI model transcribes the session as spoken — without clinical judgment about significance, without professional discretion about what serves the treatment purpose to document, and without any filter for what the client would expect to persist in a permanent, searchable record. A licensing board that accesses the vendor's transcripts receives what occurred in those sessions in a form the therapist never produced and the client never reviewed: a complete, verbatim record of every session the therapist documented using the cloud AI scribe.

For a mental health training professional who sought therapy during graduate school or internship — often in the context of significant personal and professional stress that is inherent to the training pipeline — the verbatim transcript may capture disclosures made in the relative safety of the therapeutic relationship that the applicant would not have chosen to document themselves or to share with their licensing board. The therapist exercised professional judgment not to include those disclosures in the clinical notes because they were not clinically significant for the treatment purpose. The vendor's transcript preserves them because the AI model was transcribing everything, not evaluating what to document.

The character and fitness process asks whether an applicant's history reflects on their present fitness to practice. A licensing board that reviews verbatim session transcripts from the applicant's own therapy has access to a record the applicant never produced, never approved, and never contemplated would be reviewed in the context of their license application. The structural solution — the only solution that addresses the problem before the application is filed — is a treating therapist who uses on-device processing, which produces no vendor archive for any licensing board to reach at any stage of the character and fitness process.

What on-device processing changes

On-device processing eliminates the vendor archive at the point of creation. When a therapist uses TherapyDraft, the session audio is captured on the clinician's Mac, transcribed by a locally running Whisper model, and processed locally by a quantized language model to produce a draft clinical note. No session audio, no AI-generated transcript, and no draft note leaves the clinician's device or reaches a cloud AI scribe vendor. The vendor archive that HIPAA § 164.512(d)'s health oversight provision reaches does not exist, because no vendor ever held those records.

For a mental health training professional who receives therapy while in graduate school, during the internship year, or in any period that will precede a character and fitness review, the question of whether their therapist uses on-device processing determines what the licensing board's investigation can reach. If the treating therapist uses a cloud AI scribe, the vendor holds verbatim session audio and AI-generated transcripts that the licensing board can request under health oversight authority — in the initial application investigation, in any appeal proceeding, and in any reapplication cycle. If the treating therapist uses TherapyDraft, the licensing board's investigation reaches only what the treating therapist documented in the clinical notes: records held by the clinician, protected by HIPAA, and accessible only through legal process directed at the clinician — process that the clinician can respond to through counsel and, where applicable, by asserting any protections the state's psychotherapist-patient privilege extends to health oversight proceedings.

The character and fitness disclosure obligation creates the investigation. The vendor archive determines what the investigation can reach. For training professionals who will face character and fitness review as a condition of entering the profession they are training to join, knowing that their treating therapist uses on-device processing is the structural protection that determines whether the licensing board's investigation is bounded by the clinical record their therapist chose to create, or extends to a verbatim archive their therapist's AI vendor created and that neither the therapist nor the applicant controls.

The BAA analysis is directly applicable: no BAA between the therapist and the vendor restricts the vendor's response to a HIPAA § 164.512(d) health oversight request from a state licensing board. The BAA governs the vendor's permitted uses and disclosures in contexts that HIPAA itself does not address — it cannot override the statutory disclosure authority Congress gave to health oversight authorities. On-device processing is the only architectural intervention that eliminates the vendor archive before the health oversight authority needs to reach it.