Blog · Legal & Compliance

Neuropsychological evaluation documentation and AI scribes: cognitive profiling privacy

2026-06-04 · 1,920 words · All posts

TL;DR

Neuropsychological evaluations document cognitive profiles — IQ, memory index scores, executive function deficits, dementia staging — that carry lifelong consequences in disability, litigation, and guardianship proceedings.
A cloud AI scribe present for any portion of the evaluation — clinical interview, history-taking, feedback session, verbal dictation — captures this data and stores it in vendor infrastructure under its own retention and disclosure policies.
That vendor-held archive is reachable by subpoena in disability benefit litigation, personal injury cases, and guardianship proceedings — often by parties with adverse interests relative to the client.
The cognitive profile data in neuropsych records is highly re-identifiable: IQ profile, memory pattern, processing speed scores, age, and diagnosis create a near-unique cognitive fingerprint.
On-device AI scribe tools eliminate the vendor archive entirely. No cloud transmission, no third-party custody, no independent copy of cognitive profile data subject to breach or legal process.

Neuropsychological evaluations occupy a distinct position in the clinical documentation landscape. Unlike therapy progress notes — which describe session content and treatment trajectory — neuropsychological evaluation records generate a quantified cognitive profile: IQ composite scores, memory index scores, processing speed percentiles, executive function profiles, dementia staging determinations, and forensic findings on competency and capacity. These records are not primarily therapeutic; they are expert determinations with downstream legal, financial, and social consequences for the client that can persist for decades.

The scenario this post addresses: a neuropsychologist uses a cloud AI scribe — one of the major commercial products built on cloud transcription and language model APIs — during clinical interviews, history-taking sessions, or feedback meetings. The scribe captures what is spoken. It processes this through cloud infrastructure. It generates a transcript and draft notes that remain in vendor servers under the vendor's retention and disclosure policies. The result is that the most sensitive cognitive profile data in clinical practice now exists in two places: in the practitioner's records, and in a cloud vendor's archive that the practitioner does not control.

This post covers what neuropsychological evaluation records contain that makes them distinctively sensitive, who can reach vendor-held copies, and how the documentation workflow affects the privacy exposure the evaluation creates.

What neuropsychological evaluations document

A full neuropsychological evaluation battery typically spans multiple sessions and generates several distinct categories of records. The formal testing phase produces quantitative data: subtest scaled scores, composite index scores, and percentile ranks from instruments like the Wechsler Adult Intelligence Scale (WAIS-IV), the Repeatable Battery for the Assessment of Neuropsychological Status (RBANS), the Rey Auditory Verbal Learning Test, the Trail Making Test, the Stroop Color and Word Test, and the Montreal Cognitive Assessment (MoCA). These scores are typically recorded in specialized neuropsychological software or on paper protocols, not dictated verbally — so they are less likely to appear in a cloud AI scribe's transcript.

The clinical interview is different. Before testing begins, the evaluator conducts a thorough history-taking interview covering developmental history, educational records, occupational history, prior head injuries, substance use, psychiatric history, current medications, sleep, and the client's subjective experience of their current cognitive difficulties. After testing, the evaluator typically meets with the client and often a family member to discuss findings — explaining what the scores mean, what diagnoses are supported, what the implications are for daily functioning, work capacity, and legal status. Many neuropsychologists also dictate narrative sections of their report during or immediately after sessions while findings are fresh.

All of this spoken content — the history-taking interview, the behavioral observations narrated in real time, the feedback session, the verbal dictation — is precisely the content a cloud AI scribe is designed to capture. The result is that vendor servers hold transcripts of conversations in which the evaluator has summarized test findings, explained diagnoses, described functional impairments, and recorded history that the client may not have documented anywhere else in their healthcare record.

Why this data is distinctively sensitive

The cognitive profile produced by a neuropsychological evaluation is re-identifiable in ways that most clinical records are not. As the data-flow analysis covers, cloud AI scribe vendors receive audio and text that is tied to a specific evaluation session. Neuropsychological data compounds this: a profile that combines Full Scale IQ, memory index pattern, processing speed percentile, age at evaluation, educational attainment, occupational history, and diagnosis constitutes a cognitive fingerprint that is functionally unique. Even without a name attached, an adversary with access to auxiliary records can use a cognitive profile to re-identify a specific individual with high confidence.

This re-identifiability matters because neuropsychological evaluation records are actively sought by parties with adverse financial or legal interests relative to the client. The major downstream use cases for neuropsych data — disability benefit adjudication, personal injury litigation, guardianship proceedings, fitness-for-duty determinations — all involve third parties who benefit from accessing records that the client would prefer to keep private or control carefully.

A long-term disability insurer whose policyholder has filed a claim based on cognitive impairment following a traumatic brain injury has a direct financial incentive to obtain all available records of cognitive testing — including records held by third parties, including vendor archives. A personal injury defendant whose case turns on the plaintiff's cognitive damages has a parallel incentive. An adult child seeking guardianship of an aging parent over that parent's objection may seek all available cognitive records. In each of these scenarios, the cloud AI scribe vendor's archive is a target that the practitioner's BAA does not shield.

TBI documentation and the litigation context

Traumatic brain injury neuropsychological evaluations are among the most heavily litigated evaluation types. When a client sustains a TBI in an accident — motor vehicle collision, workplace injury, sports concussion — the evaluation documenting cognitive sequelae becomes central evidence in calculating damages. Plaintiffs argue that cognitive deficits are permanent and severe; defendants argue that deficits are temporary, pre-existing, or exaggerated. Both sides pursue every available record source.

The clinical interview in a TBI evaluation captures the client's first-person account of their pre-injury baseline, their injury event narrative, their current cognitive complaints, their daily functioning limitations, and the evaluator's behavioral observations of how the client presents during the session. A cloud AI scribe present for this interview creates a vendor-held transcript of this entire account — taken at a specific point in time, before litigation strategy has been developed, reflecting the client's raw recollection before attorney preparation.

As the subpoena analysis covers, records held by a cloud vendor as a business associate are reachable by legal process. The vendor's BAA does not prevent disclosure in response to a validly served subpoena; it requires notification and certain procedural steps, but it does not function as a privilege shield. In TBI litigation, a subpoena directed at a cloud AI scribe vendor for all records associated with an evaluation session could reach the transcript of the clinical interview that the evaluator never intended to be a standalone document in litigation.

Dementia staging records and the guardianship scenario

Dementia staging evaluations present a different risk profile. When an older adult is evaluated for cognitive impairment, the evaluation record documents not only a cognitive profile but a legal capacity determination. At what stage is the dementia? Can the individual manage their own finances? Can they make medical decisions? Are they at risk of exploitation? These determinations are directly relevant to guardianship, conservatorship, and healthcare proxy proceedings — which may be contested by family members with opposing interests.

A cloud AI scribe present for a dementia staging evaluation captures the evaluator's real-time observations of the client's orientation, attention, recall, language, and judgment during the clinical interview. It captures the feedback session in which the evaluator explains what the testing shows about the client's current capacity. It captures the client's own responses — which may reflect preserved insight, denial, or the specific pattern of preserved and impaired function that is diagnostically significant.

In a contested guardianship proceeding, the vendor-held transcript of this session — captured by a cloud AI scribe the client did not consent to in any meaningful way, held in infrastructure the client cannot access — may be sought by parties whose goal is to establish or defeat a guardianship over the client's objection. The client's most private cognitive disclosure is in a third-party archive that the practitioner's HIPAA notice does not adequately describe and that the client cannot easily reach to retrieve or delete.

Forensic competency evaluations and the criminal context

Neuropsychologists also perform forensic competency evaluations — assessments of whether a defendant is competent to stand trial, competent to waive Miranda rights, or responsible for their conduct at the time of an alleged offense. As the forensic evaluation analysis covers in the immigration context, forensic expert opinions are different from therapeutic records — they are created for a legal proceeding and the evidentiary stakes are high.

A cloud AI scribe present for a forensic competency evaluation clinical interview captures the defendant's account of the alleged offense, their understanding of court proceedings, their mental state history, and the evaluator's real-time observations. In a criminal proceeding, there are multiple parties — prosecution, defense, court — who may seek to access this material. The vendor's independent archive of the clinical interview is not protected by attorney-client privilege or work-product doctrine, because the vendor is not the evaluator's attorney and the vendor's records are independently held.

As the BAA explainer covers, a BAA governs how the vendor uses and safeguards data — it does not extend clinical privilege to the vendor's records. A forensic neuropsychologist who uses a cloud AI scribe for competency evaluation interviews has created a third-party archive of the evaluation that neither the HIPAA rules nor the BAA structure prevents from being reached by court order in the underlying criminal case.

Actuarial data and the retention problem

Neuropsychological test data has an unusual property: it is valuable to re-examine longitudinally. A cognitive profile taken at age 45 becomes diagnostically significant when compared to a profile taken at age 55. The rate of decline, the specific pattern of preserved versus impaired function, and the interaction with diagnosis over time are all clinically and forensically relevant.

This means that a cloud AI scribe vendor's archive of neuropsychological evaluation interview data does not become less sensitive over time — it becomes more sensitive. A vendor who retains transcripts indefinitely (and most cloud AI scribe terms of service do not specify short retention windows) holds a longitudinal record of a client's cognitive trajectory. In disability and estate litigation, cognitive decline trajectories are central evidence. A vendor archive that spans multiple evaluations over years is a comprehensive longitudinal cognitive profile — precisely the record that parties in litigation want most.

As the 2026 HIPAA framework covers, practitioners are responsible for ensuring that business associates protect PHI appropriately — but the practitioner's HIPAA policies and vendor BAAs do not control how long a vendor retains data or what longitudinal analysis the vendor performs across its dataset. Vendor terms of service govern retention, and those terms are not typically negotiated by individual practitioners.

What on-device processing resolves for neuropsychologists

An on-device AI scribe that processes audio, generates transcripts, and drafts evaluation notes entirely on the practitioner's local machine eliminates the vendor archive. There is no cloud infrastructure receiving the clinical interview. No third party holds a copy of the cognitive profile data. The practitioner is the sole custodian of the AI-generated notes, exactly as they would be if they dictated onto a handheld recorder that never left their desk.

No Business Associate Agreement is required for the documentation tool, because no PHI leaves the practitioner's device to reach a business associate. The downstream legal exposure is the same as it would be for traditionally documented evaluation records: the practitioner's own records are subject to subpoena and legal process, but there is no independent third-party archive to be reached separately. The cognitive profile data exists in one place — the practitioner's records system — rather than in two places, one of which the practitioner does not control.

For neuropsychologists working in TBI litigation, dementia staging, forensic competency, and disability evaluation contexts — where the downstream legal exposure of records is highest and the adversarial interest in reaching all available record sources is strongest — this architectural difference is material. TherapyDraft's on-device model runs local transcription via Whisper.cpp and on-device note drafting via a local language model on Apple Silicon. Audio, interview transcript, and evaluation notes never leave the practitioner's Mac.

Frequently asked questions

Are neuropsychological evaluation records protected under HIPAA?

Yes — neuropsychological evaluation records are protected health information under HIPAA to the same degree as any other clinical record. They include diagnoses, test scores, behavioral observations, and clinical determinations that constitute individually identifiable health information created by a healthcare provider. However, HIPAA provides the floor, not the ceiling. Some states have specific statutes governing the confidentiality of neuropsychological or psychological test data — for instance, requiring that raw test scores and protocols be treated differently from narrative reports. The American Psychological Association's Ethics Code also imposes obligations around test security that interact with how data can be disclosed. HIPAA's protections apply to the cloud AI scribe's archive of anything captured during the clinical interview portion of the evaluation.

Can a disability insurer subpoena a cloud AI scribe vendor's records from a neuropsychological evaluation?

Potentially yes. A cloud AI scribe vendor who holds records from a neuropsychological evaluation session is a business associate holding protected health information. That data can be reached by legal process — including subpoenas in disability benefit litigation — directed at the vendor as a third-party record custodian. The Business Associate Agreement with the vendor does not prevent the vendor from complying with a validly served subpoena; it requires the vendor to notify the covered entity and follow certain procedural steps, but it does not function as a bar against disclosure. In long-term disability insurance litigation, claimants and insurers routinely seek all clinical records related to the disabling condition — a broad category that can encompass evaluation interview audio, transcripts, and draft notes retained by a cloud AI vendor.

Does a cloud AI scribe vendor receive raw neuropsychological test scores?

Not typically — raw test data (score sheets, response booklets, subtest scaled scores) is usually generated on paper or in specialized neuropsychological software and is not part of the spoken session that a cloud AI scribe would record. However, the clinical interview portion of a neuropsychological evaluation — which the AI scribe does capture — routinely includes the evaluator summarizing test findings verbally, discussing performance in specific domains (memory, attention, processing speed, executive function), relaying scores to the client or family, and dictating the narrative interpretation. A cloud AI scribe present for the feedback session or any verbal summary portion will capture this interpretation of test results. It also captures the history-taking interview, behavioral observations documented in real-time, and any verbal note-drafting the evaluator does during or immediately after testing.

How is a neuropsychological evaluation record different from a therapy progress note for HIPAA purposes?

The key practical difference is the downstream use pattern and re-identifiability. Therapy progress notes primarily describe session content and treatment trajectory — they can be damaging if disclosed, but they are typically not the subject of aggressive third-party record acquisition campaigns. Neuropsychological evaluation records are routinely sought by third parties who have adverse interests relative to the client: disability insurers calculating benefit exposure, personal injury defendants measuring damages, employers challenging fitness-for-duty claims, and courts in guardianship and competency proceedings. The cognitive profile documented in a neuropsychological evaluation — IQ, memory index scores, executive function profile, processing speed — is also highly re-identifiable. Combined with age, diagnosis, and testing date, it constitutes a near-unique cognitive fingerprint that can be used to identify a specific individual even in contexts where names are removed.

Can a neuropsychologist use on-device AI tools for evaluation documentation without creating a business associate relationship?

Yes. An AI tool that runs entirely on a local device — processing audio, generating transcripts, and drafting notes without transmitting any data to remote servers — does not create a business associate relationship with a cloud vendor, because no PHI leaves the practitioner's device to reach a third party. The practitioner is the sole custodian of whatever records the tool generates, exactly as they would be if they dictated into a handheld recorder and transcribed themselves. No Business Associate Agreement is required for the documentation tool, because there is no business associate. TherapyDraft's architecture — local transcription via Whisper.cpp and on-device note drafting via a local language model on Apple Silicon — is specifically designed for this scenario. Audio, transcript, and evaluation notes never leave the neuropsychologist's Mac, leaving no vendor-held archive of cognitive profile data to be subpoenaed or breached.

Legal disclaimer: This post is educational content for mental health professionals and does not constitute legal advice. HIPAA requirements, state privacy laws, and professional ethics rules vary by jurisdiction and circumstance. Consult qualified legal counsel for guidance specific to your practice.