Blog · Legal & Compliance

Mandated reporting and AI scribes: what therapists document when a client discloses abuse

Q: Does therapist-client privilege protect disclosure records in mandatory reporting situations?

In most US jurisdictions, mandatory reporting laws explicitly override therapist-client privilege for the purpose of the report itself and related proceedings. A clinician who makes a mandatory report to CPS is generally immune from civil liability for the disclosure, and the privilege does not apply to compel the clinician to withhold the report. However, the scope of the privilege waiver varies by state — some states limit it to the specific reportable information, others to the full therapy record. Importantly, even where a therapist successfully asserts privilege to resist disclosure of a clinical record in court, that privilege assertion applies to the therapist's own records. It does not govern records held by a cloud AI scribe vendor, which is a separate legal entity. The vendor's retained audio and transcripts are a distinct record from the therapist's clinical file, and any privilege assertion must be made against the vendor's production separately — a more complex legal undertaking than asserting privilege over one's own records.

2026-06-03 · 1,820 words · All posts

TL;DR

When a client discloses reportable abuse in a therapy session, the verbal content of that disclosure — exact words, sequence, details — is the most forensically significant record the clinical file will ever contain.
HIPAA permits the clinician's report to CPS under the mandatory-reporting exception (45 CFR 164.512(a)(1)), but that exception says nothing about records a cloud AI scribe vendor retains from the same session.
When a cloud AI scribe was running during the disclosure, the vendor independently holds a verbatim audio record of what was said — a record reachable by CPS investigators, prosecutors, family court attorneys, and licensing boards via subpoena to the vendor as a separate custodian.
In criminal child abuse prosecutions, the earliest disclosure narrative — before any formal forensic interview — carries substantial evidentiary weight. The cloud vendor's verbatim session audio is exactly that document.
A therapist-client privilege assertion covers the clinician's own records; it does not govern the vendor's separate obligation to respond to legal process directed at the vendor.
On-device processing eliminates the vendor's independent record: the disclosure audio is transcribed locally, no cloud copy exists, and the clinician's progress note is the primary record under the clinician's own custody.

A session in which a client discloses what appears to be reportable abuse is not just another progress note. It is a documentation event with distinct clinical, legal, and regulatory dimensions. The clinician's record of the disclosure — what the client said, in what order, with what level of detail — may become the most forensically significant document in the clinical file. And when a cloud AI scribe was running during that session, the vendor independently holds a verbatim audio record of every word the client spoke, captured and retained on the vendor's infrastructure independently of anything the clinician writes down.

This post examines what mandated reporting documentation actually contains, what HIPAA permits and requires when a mandatory reporting obligation arises, and what the presence of a cloud AI scribe changes about the custody structure of that record. This is a distinct analysis from Tarasoff and duty-to-warn documentation, which concerns future-oriented threats to identifiable third parties; mandated reporting concerns client disclosures of past or present abuse of a victim, and the documentation and legal consequences that follow are structurally different.

Who is a mandated reporter and what triggers the duty

Every US state has mandatory reporting statutes requiring mental health professionals to report suspected child abuse, neglect, or both to child protective services (CPS). Most states also extend the obligation to cover abuse, neglect, or exploitation of vulnerable adults — elderly individuals and adults with disabilities. Professional licenses covered in every state's statute include LCSW, LMFT, LPC, psychologists, and licensed counselors; many states extend coverage to unlicensed interns, trainees, and supervised practitioners.

The threshold varies by state but is generally formulated as "reasonable cause to suspect" or "reasonable belief" — not proof, not clinical confirmation, not certainty. The duty arises when the information the clinician receives would give a reasonable professional cause to suspect abuse or neglect. A verbal disclosure in session that meets this threshold triggers the reporting obligation, typically within 24 to 72 hours depending on state law. The clinician's documentation of that session — specifically, the clinical basis for the decision to report or not report — is part of the professional record.

What the disclosure session record contains

The session in which a client first discloses reportable abuse has a distinct content structure. Progress notes from that session typically include several categories of information that do not appear in a routine therapy progress note.

The verbatim disclosure narrative. Clinical training in mandatory reporting universally emphasizes documenting the client's actual words as closely as possible, especially for child-related disclosures. Forensic and legal professionals look for the "first narrative" — the account the person gave before any formal investigative interview, before any contamination through repeated questioning. What the client said, in what sequence, using what specific language, with what level of detail, is the core of the disclosure record. Courts recognize that early disclosures occurring in therapeutic settings are among the most forensically significant records available precisely because they precede the formalized investigative process.

Clinical indicators observed in session. The behavioral and affective presentation of the client during and after the disclosure — emotional state, consistency of the account, any physical observations, visible distress or dissociation — is documented as clinical context for the reporting decision. In cases involving child clients, caregivers' behavioral patterns or collateral reports may also appear.

The clinician's reasoning about the reporting threshold. Why the clinician concluded the information met or did not meet the reporting threshold is documented both for clinical record purposes and for any subsequent licensing board inquiry. A licensing board investigating a clinician's mandatory reporting conduct will focus on what the clinician knew at the time, what clinical judgment was applied, and how that reasoning was documented. A cloud AI scribe's verbatim audio of the session in which this reasoning was discussed aloud is directly relevant to that inquiry.

Consultation documentation. Many clinicians consult with a supervisor, attorney, or colleague before filing a report — a conversation in which they describe the disclosure in clinical terms to get a second opinion on whether the reporting threshold is met. Some of those consultations occur by phone while the client is still in the waiting area or in session. If the consultation was conducted with the session audio still running, the cloud AI scribe may have captured the consultation discussion as well as the original disclosure.

The HIPAA mandatory reporting exception and what it does not cover

HIPAA's Privacy Rule provides a specific exception at 45 CFR 164.512(a)(1) permitting covered entities to disclose PHI without patient authorization when the disclosure is required by law. State mandatory reporting statutes qualify — a clinician who reports suspected child abuse to CPS is not violating HIPAA. The disclosure to CPS is permitted without patient consent and without triggering the standard Privacy Rule authorization requirements.

That exception governs the clinician's own disclosure to CPS. It does not govern what a cloud AI scribe vendor does with the session audio it retained from the same visit. The vendor is not making the mandatory report; the vendor is retaining audio and transcripts under its own data retention policy, governed by the business associate agreement the clinician signed with the vendor. The HIPAA mandatory reporting exception creates no obligation — and grants no permission — for the vendor to retain, produce, or limit the disclosure of its copy of the session record. As we analyzed in the BAA explainer, a business associate agreement governs what the vendor can do with data it already holds — it does not eliminate the vendor's obligations under legal process directed at the vendor as a separate custodian.

What cloud AI scribes capture and retain from a disclosure session

When a cloud AI scribe is running during the session in which a client discloses abuse, the microphone captures the complete verbal record of that disclosure. As the cloud data-flow analysis documents, the vendor's pipeline typically involves raw audio upload to cloud infrastructure, intermediate transcript generation, note drafting via a cloud language model, and retention policies for each artifact tier that vary by vendor. The vendor retains the raw audio and verbatim transcript independently of the clinician's own progress note.

From a disclosure session, the vendor's retained data includes:

The client's verbatim disclosure, in the client's own words, in real-time sequence — the earliest available first-narrative record
The clinician's in-session responses and follow-up questions, which may have elicited additional detail the vendor now holds separately from the clinician's notes
Any telephone consultation the clinician conducted with the session audio still running — a supervisor discussion, an attorney call, a colleague consultation, captured as ambient audio
The client's reaction to the clinician's explanation of the reporting obligation, if that conversation occurred during the same session
Any collateral disclosures — a caregiver in the room, a child's statements, a second party's account — that were captured on the open microphone

This is a record that exists on the vendor's infrastructure as a distinct artifact, governed by the vendor's data retention policy, and reachable by legal process directed at the vendor independently of any process directed at the clinician.

Who can reach the vendor's disclosure record

Several categories of legal proceeding have strong interests in accessing the verbatim disclosure record from a therapy session.

Criminal prosecution. In criminal cases involving child abuse or sexual assault, prosecutors and defense attorneys actively seek early disclosure narratives — the account the victim or witness gave before any formal forensic interview, before any consistency problems arose from repeated questioning. The therapy session in which a client first disclosed abuse is precisely that record. A cloud AI scribe's verbatim audio of that session, held by the vendor as a separate legal entity, is reachable by criminal subpoena directed at the vendor under HIPAA's court-order exception at 45 CFR 164.512(e).

Family court and custody proceedings. Abuse allegations arising in the context of separated parents generate some of the most intensely litigated family court disputes. When a child or adult client discloses abuse in therapy, either party to a custody proceeding may seek access to the clinical record, and may independently seek the vendor's records via subpoena. The vendor's verbatim audio is a different source than the therapist's progress note — it is a separate document from a separate custodian, and any privilege assertion must be made against the vendor's production independently.

CPS investigation. Child protective services investigators routinely seek corroborating clinical records when investigating abuse reports. A clinician's progress notes may be sought; resistance on privilege grounds is possible in some jurisdictions. A CPS subpoena or administrative request directed at the cloud AI scribe vendor for the same session is directed at a separate legal entity under a different analysis. As the subpoena explainer documents, the clinician's privilege over their own records does not extend to records held by a third party.

Licensing board proceedings. Licensing boards investigating whether a clinician properly discharged a mandatory reporting obligation — reported when required, documented the decision adequately, consulted appropriately — are directly interested in the verbatim record of what the clinician knew at the time. The vendor's audio provides a more complete record of that session than the clinician's own progress note, which is written after the fact and reflects the clinician's selective documentation choices.

Post-report documentation and the ongoing record

After a report is filed, the clinical record continues to accumulate documentation with distinct legal significance. The fact of the report and the date filed, the case number assigned by CPS, the client's response when informed of the report, subsequent session content related to the disclosure and its aftermath, and any ongoing safety planning all generate notes that are structurally connected to the original disclosure session. If a cloud AI scribe is used across multiple subsequent sessions, the vendor accumulates a longitudinal record of how the situation developed — from initial disclosure through the investigation period and into the therapeutic work that follows.

This longitudinal record on the vendor's infrastructure is particularly relevant in cases where the clinical relationship continues for months or years after the report. All of those sessions are separate artifact tiers on the vendor's servers, each independently reachable by legal process directed at the vendor.

On-device processing and the single-custodian record

When session audio is processed entirely on the clinician's device — transcribed by Whisper.cpp, drafted by an on-device language model, never transmitted to cloud infrastructure — the disclosure session audio has one custodian: the clinician. The only records that exist after the session ends are the clinician's own progress note and, if retained, a local transcript on the clinician's Mac. There is no vendor holding a parallel verbatim record of the disclosure that is independently reachable by subpoenas directed at the vendor as a separate entity.

This single-custodian structure does not change the clinician's mandatory reporting obligations — those arise from state law and exist entirely independently of the note-taking tool the clinician uses. What it changes is the evidentiary footprint of the disclosure: the verbatim first-narrative record exists only in the clinician's possession, subject to the clinician's own privilege assertions and record-keeping decisions, rather than on a third-party vendor's infrastructure where its accessibility is governed by the vendor's legal obligations rather than the clinician's.

For school-based clinicians who are mandated reporters — school counselors, school psychologists, school social workers — the analysis applies similarly: any AI scribe used during sessions in which students disclose abuse creates an independent record on the vendor's infrastructure that exists under the vendor's retention policy, regardless of whether that session's records are governed by FERPA or HIPAA.

Frequently asked questions

Does HIPAA require a therapist to report child abuse?

HIPAA does not itself mandate that therapists report child abuse. The reporting obligation arises from state mandatory reporting statutes, which exist independently of HIPAA. What HIPAA does provide is a specific Privacy Rule exception at 45 CFR 164.512(a)(1) that permits covered entities to disclose PHI without patient authorization when disclosure is required by law — state mandatory reporting statutes qualify. A therapist who reports to CPS is not violating HIPAA; the Privacy Rule permits the disclosure. This exception operates as a carve-out from the general prohibition on unauthorized PHI disclosure; it does not require the report. The legal mandate to report comes from state law. Importantly, this exception governs the clinician's own disclosure to CPS — it says nothing about records a cloud AI scribe vendor independently holds from the same session.

Can a cloud AI scribe's records be subpoenaed in a child abuse investigation or prosecution?

Yes. A cloud AI scribe vendor that retains session audio or transcripts from a disclosure session is a distinct legal entity holding independent records. A subpoena directed at the vendor — in a criminal prosecution, a CPS administrative proceeding, or a family court matter — can compel the vendor to produce those records. HIPAA permits disclosure without patient authorization in response to court orders and qualifying subpoenas under 45 CFR 164.512(e). The therapist's privilege assertions or HIPAA preferences do not govern the vendor's obligation to respond to legal process directed at the vendor as a separate custodian. In criminal proceedings involving child abuse, the verbatim audio of the client's first disclosure narrative from a therapy session may be actively sought by prosecution or defense — it is the earliest available account of the events, predating any formal forensic interview.

What is the difference between mandated reporting documentation and Tarasoff duty-to-warn documentation?

Mandated reporting and Tarasoff duty-to-warn arise from different legal frameworks and document different clinical events. Mandated reporting — child abuse, neglect, or vulnerable adult abuse — is triggered by a client's disclosure of past or present abuse of a victim, and the duty requires reporting to CPS or adult protective services. The documentation records what the client disclosed and the clinician's decision-making about the reporting threshold. Tarasoff duty-to-warn arises when a client makes a credible threat of serious physical harm to an identifiable third party — a future-oriented duty triggered by threat content, not abuse disclosure. The documentation records the threat, dangerousness assessment, warning or protection steps, and clinical reasoning. Both create records with significant forensic dimensions, but they involve different statutes, different agencies, different disclosure directions, and different documentation structures. A single session can, in principle, trigger both obligations simultaneously — and a cloud AI scribe running during that session holds a verbatim record of both events on the vendor's infrastructure.

Does therapist-client privilege protect disclosure records in mandatory reporting situations?

In most US jurisdictions, mandatory reporting statutes explicitly override therapist-client privilege for purposes of the report itself and related proceedings — a clinician who makes a mandatory report is generally immune from civil liability for the disclosure, and the privilege cannot be invoked to prevent the report. However, the scope of the privilege waiver varies by state; some limit it to the specific reportable information, others to the full therapy record. Crucially, even where a therapist successfully asserts privilege to resist production of a clinical record in a court proceeding, that assertion governs the therapist's own records. It does not cover records independently held by a cloud AI scribe vendor. The vendor is a separate legal entity holding its own copy of the session data; any privilege claim against the vendor's production must be made separately and involves a different legal analysis — one that does not benefit from the longstanding common-law and statutory foundations that support therapist-client privilege over the clinician's own records.

How does TherapyDraft help with documentation in mandated reporting situations?

TherapyDraft processes session audio entirely on the clinician's Mac using Whisper.cpp for transcription and an on-device language model for note drafting on Apple Silicon. No audio, transcript, or draft note is transmitted to cloud infrastructure. In sessions where a client discloses reportable abuse — generating the most forensically sensitive verbal content in the clinical record — session audio stays on the clinician's device. There is no vendor independently holding a verbatim record of the disclosure that is reachable by subpoenas directed at a separate custodian. The clinician's progress note remains the primary clinical record, authored by the clinician and subject to the clinician's own privilege and retention decisions. TherapyDraft supports SOAP and DAP note formats with a 10-session free trial and no card required.