May 31, 2026 Clinical

Play therapy documentation and minor PHI: what cloud AI scribes miss about child-centered therapy records

Q: What should play therapy session notes include?

A play therapy session note typically documents the date and duration of the session, the child's presenting affect and behavioral state at the start of the session, the play themes and modalities used (sand tray, art, puppets, directive vs. non-directive), the therapist's clinical observations of the play content and process, any verbal statements the child made during play, the therapist's interpretive assessment of the session's clinical significance, the child's response to interventions, progress toward treatment goals, and the therapist's plan for future sessions. For billing purposes, the note also needs the session CPT code, the diagnostic code(s) from the treatment plan, and the duration. Unlike adult progress notes, play therapy notes often focus on the symbolic content of play rather than stated self-report — the therapist is interpreting and translating the child's non-verbal communication into clinical language.

Q: Are play therapy notes different from regular therapy progress notes?

Yes, in important ways. Standard progress notes for adult talk therapy typically follow DAP (Data, Assessment, Plan) or SOAP (Subjective, Objective, Assessment, Plan) formats and heavily weight the client's verbal self-report in the Subjective and Data sections. Play therapy notes must document communication that is largely non-verbal — the child's play behavior, the themes that emerge in the playroom, the affect expressed through play, and the therapist's interpretive assessment of what the play communicates clinically. An AI scribe tool calibrated on adult therapy transcripts may generate inaccurate or clinically thin drafts for play therapy sessions because the session audio often contains more therapist narration and child sound than structured verbal exchange. The clinically meaningful content is the therapist's running interpretive commentary, not a patient-reported symptom description.

Q: Can play therapy notes be subpoenaed in custody cases?

Yes. Child therapy records, including play therapy session notes, can be subpoenaed in custody proceedings, child protective services investigations, and related family court matters. Play therapy notes are especially sensitive in this context because they may contain the therapist's interpretations of the child's play as reflecting the child's emotional experience of family dynamics — content that both parents' attorneys will want access to in contested custody cases. The therapist typically can assert the therapist-patient privilege on the child's behalf, but state law varies, and courts in custody matters sometimes order disclosure over privilege assertions when the child's welfare is at stake. If a cloud AI scribe vendor holds a copy of the session audio or transcript, the opposing party's attorney can subpoena the vendor separately from the therapist — potentially accessing session material before the therapist learns a subpoena was served. See our post on AI therapy note subpoenas for a detailed breakdown of how this works.

Q: Are child therapy notes HIPAA-protected?

Yes. Child therapy records are PHI (protected health information) under HIPAA for any covered entity — licensed therapists, counselors, and psychologists are covered entities. For minor clients, the parent or legal guardian is generally the personal representative for HIPAA purposes, meaning they have the right to access and authorize disclosures of the child's PHI. However, HIPAA contains specific exceptions: if state law gives the minor the right to consent to treatment without parental authorization (common for adolescents seeking mental health care for specific conditions), the minor generally controls their own PHI for that treatment. There are also exceptions when disclosing to a parent could put the minor at risk — for instance, if the minor is the subject of suspected parental abuse. Child therapists in divorce or custody situations should be especially careful about responding to records requests from one parent, as the other parent may have equal standing as a personal representative.

Q: How does on-device AI drafting work for play therapy notes?

With TherapyDraft, you record the session on your M-series Mac or load an existing recording file. whisper.cpp transcribes the session audio locally — the session audio never leaves your device. The local model (Qwen2.5 14B or Llama 3.1 8B, 4-bit quantized) drafts the session note using your own prior notes as style examples, so the output matches your clinical language and documentation format. For play therapy, the therapist's running commentary during the session — the narration of play behavior and interpretive observations — becomes the primary input for the draft. The therapist reviews the AI-drafted note, adds or modifies clinical interpretation as needed, and pastes it into their EHR. The session recording, transcript, and draft note all remain on the therapist's device. No cloud vendor receives the child's session audio.

Play therapy session notes are unlike any other clinical documentation. They capture what children communicate through symbolic play — sandtray narratives, puppet scenarios, art themes, and enacted story — and translate that non-verbal content into clinical language. When cloud AI scribes enter the child-therapy workflow, they receive session audio that contains some of the most sensitive protected health information in mental health practice: a child's disclosed experience, in their own words and acts, often including material about family dysfunction, abuse, and trauma. This post covers what play therapy documentation requires, what cloud scribes actually do with child session audio, and why the on-device alternative matters differently here than it does for adult therapy.

Play is the language of children in therapy. A child who cannot say "I am frightened" enacts it with the dollhouse family. A child who cannot name what happened buries a figure in the sand and then uncovers it, repeatedly. A child who cannot report trauma draws it — obliquely, in colors and shapes that a trained play therapist reads as clinical communication. The documentation the therapist writes after the session translates that communication into a clinical record: the treatment goals it addresses, the affect it reflects, the themes that have persisted across sessions, and the therapist's interpretive assessment of what the child is working through.

That documentation is PHI. It is protected, privileged, and — because the client is a minor — governed by a more complex authorization landscape than adult therapy records. It may also be subpoenaed. And when cloud AI scribes are used to draft play therapy notes, the session audio they receive is qualitatively different from an adult CBT session: it is a recording of a child's enacted therapeutic disclosure, not a structured verbal self-report.

The question for child therapists evaluating AI-assisted documentation is not only about efficiency. It is also: when the session audio from a play therapy session with a traumatized seven-year-old leaves your device and goes to a cloud vendor's servers, what exactly are you authorizing?

What play therapy session notes document — and why they differ from standard progress notes

Standard adult progress note formats — DAP (Data, Assessment, Plan) and SOAP (Subjective, Objective, Assessment, Plan) — are built around verbal self-report. The Subjective section captures what the client says about their experience. The Data or Objective section captures the therapist's behavioral observations. Assessment synthesizes both into a clinical impression. Plan documents next steps.

For play therapy, the Subjective section is largely absent — a six-year-old with selective mutism does not narrate their internal state. The clinically significant content shifts almost entirely to the therapist's observations and interpretations. A play therapy note might document: the child selected the dragon figure repeatedly across three sessions; today the dragon buried the small child figure in the sand before covering both with a pile of rocks; the therapist assessed this as reflecting themes of helplessness and entrapment consistent with the child's documented trauma history. There is no verbatim client self-report. The note is almost entirely the therapist's clinical translation of play behavior.

This has two implications for AI-assisted drafting. First, the primary input for the draft is the therapist's running narrative during the session — their real-time vocalization of what they observe and interpret as the session unfolds — rather than a structured verbal exchange with the client. A cloud AI scribe trained on adult therapy transcripts may produce shallow drafts for play therapy sessions because the verbal signal looks different. Second, the session audio captures the child's verbal output during play, which may include direct statements the child makes through or alongside their play — statements that are not structured self-report but that can be clinically significant and legally sensitive.

The documentation burden for play therapists is real. A full caseload of child clients means writing notes that require clinical interpretation — not just transcription — for each session. The note needs to document the specific play modalities and themes in clinical terms, connect the session's content to the treatment goals in a way that satisfies insurance documentation requirements, and record the therapist's assessment in a way that would be defensible in a records review. That takes time even for an experienced child therapist, and AI-assisted drafting that reduces blank-field time is genuinely useful.

The minor PHI landscape: who holds the rights to a child's therapy records

HIPAA's treatment of minor clients is more complex than the standard covered-entity framework that adult-practice therapists are used to. For most minor clients, the parent or legal guardian is the HIPAA personal representative — they hold the authorization rights to the child's PHI. They can request records, authorize disclosures, and direct how the records are used.

But HIPAA also recognizes that state law governs when minors can consent to their own treatment, and when that happens, the rules around the parent's right to access the records shift. Many states allow adolescents above a threshold age (typically 12 to 14) to consent to mental health treatment without parental authorization, particularly for specific conditions or circumstances — substance use, sexual health, outpatient mental health treatment in crisis situations. When a minor has consented to their own treatment under state law, HIPAA generally treats the minor as controlling their own PHI for that treatment. The parent does not automatically have access.

For younger children receiving play therapy — the core play therapy population — parents are typically the personal representative with full authorization rights. This creates its own complexity in divorce and custody situations: both parents may be legal co-representatives with equal standing to request records, regardless of which parent brought the child to therapy. A therapist who responds to one parent's records request without the other parent's knowledge may be creating a disclosure the other parent can dispute. Most play therapists are aware of this dynamic; what they are less aware of is that cloud AI scribe vendors can also be reached directly, bypassing the therapist's gatekeeping role entirely.

As we detail in our post on whether AI therapy notes can be subpoenaed, an attorney in a custody or child protective proceeding can serve a subpoena on the cloud vendor separately from the therapist. The therapist typically learns about a subpoena for their own records before responding and can assert privilege or seek a protective order. The therapist does not learn about a subpoena served directly on the vendor until after it has been served — potentially after a response has already been given. Play therapy session audio or transcripts held by a cloud vendor are reachable in exactly this way.

Abuse disclosures in play therapy sessions

Play therapy is disproportionately the modality in which children disclose abuse. This is not an accident — children who have experienced abuse often cannot make a verbal, structured disclosure to an adult authority figure. They can, however, enact what happened through play, in a setting where the therapist is trained to receive that communication without pressure or leading. The play therapy session is frequently where a mandated reporter's obligation arises.

The session audio from a play therapy session in which a child discloses abuse is not just clinical documentation. It may become evidence. The child's statements during play, the therapist's observations, and the session audio itself may all be relevant to a child protective investigation or a criminal proceeding. The therapist's session notes are the primary documentation artifact — but in a cloud AI scribe workflow, the vendor also holds a copy of the audio and a transcript.

This creates an unusual evidentiary situation. In most child abuse investigations, the therapist's records are accessed through a formal request or legal process directed at the therapist. The therapist can consult with an attorney, assert the privilege where applicable, and coordinate with the child's guardian about the disclosure. When the vendor holds an independent copy of the session material, that material is accessible through a separate legal channel — one that does not run through the therapist. Whether that is better or worse for the child's case depends on the circumstances, but it is a variable the therapist did not introduce intentionally and may not be aware of.

Our data-flow audit of major cloud AI scribes documents that most vendors retain session audio and transcripts beyond the note generation step. Retention windows vary — some vendors specify 30-day automatic deletion in their BAA, others default to 12 months or the duration of the customer relationship. A therapist who uses a cloud scribe for a play therapy session in which a child makes an abuse disclosure may not realize that the vendor's copy of the audio persists for months after the session ends.

What cloud AI scribes actually transmit from play therapy sessions

The data flow for a cloud AI scribe in a play therapy context follows the same mechanics as for adult therapy, as we document in our cloud AI scribe data-flow audit: session audio is transmitted to the vendor's servers, transcribed, and the transcript is used to generate a note draft. The audio and transcript are retained for a period specified in the vendor's privacy policy and BAA.

What differs for play therapy is the nature of what the audio contains. A 45-minute play therapy session with a six-year-old in a sand tray session might sound, on transcript, like: the therapist narrating the child's play actions, the child making sound effects and occasional statements in play-voice (the dragon says "no one can find me now"), the therapist reflecting the themes back, and occasional direct dialogue. The transcript is not a structured clinical interview. It is a window into the child's therapeutic process in a modality designed to be safe precisely because it is not direct verbal self-report.

That material — once transmitted to a cloud vendor's infrastructure — is held by an entity that is not the covered healthcare provider and not bound by the therapeutic relationship. The Business Associate Agreement covers the vendor's HIPAA obligations, as we explain in our BAA explainer. What the BAA does not do is give the vendor the therapist-patient privilege that would apply to the same material in the therapist's own files. It does not prevent the vendor from being subpoenaed. And it does not make the vendor a necessary participant in the authorization chain if a parent wants to change course about who has access to their child's records.

Play therapists who have their clients' parents sign AI documentation consent forms — as they should — often use forms that describe AI-assisted note generation in general terms. Fewer specifically name the vendor, describe the fact that session audio is transmitted to a cloud server, and identify the retention period. That level of specificity is what a properly informed consent for AI documentation of a minor's therapy should contain. Most current consent forms do not include it.

The on-device drafting workflow for play therapy notes

For play therapists on M-series Macs, on-device AI drafting addresses the data-custody problem directly. The session audio stays on the therapist's device from the moment it is recorded to the moment it is deleted. No cloud vendor receives the audio. No transcript is generated on a third-party server. The parent's consent for AI-assisted documentation covers the therapist's own device — the same authorization scope that has always covered the therapist's use of digital tools within their practice.

The practical workflow: after the session, the therapist loads the session recording into TherapyDraft on their Mac. whisper.cpp transcribes the audio locally — on an M2, a 45-minute session transcribes in roughly 9 minutes. The local model (Qwen2.5 14B-Instruct or Llama 3.1 8B, 4-bit quantized) drafts the session note using the therapist's own prior notes as style and format examples. For play therapy, the draft captures the therapist's narrative observations from the session audio and structures them into the note format the therapist uses — DAP, SOAP, or a practice-specific play therapy format.

The therapist reviews the draft. This step is where the play therapist's clinical judgment adds the interpretive layer that makes a play therapy note useful — connecting the session's play themes to the child's treatment history, to prior sessions, and to the therapist's clinical formulation. The AI draft reduces the blank-field problem; the therapist adds the interpretation. The completed note goes into the EHR. The session recording remains on the therapist's device.

The macOS network sandbox entitlement that TherapyDraft uses enforces this: the app has no network access for audio, transcript, or note text. The only outbound traffic is the Stripe license activation and an anonymous version-check — both are limited and specified. A therapist can confirm the enforcement by checking macOS's Network preference pane: no data transfer from TherapyDraft except the two permitted channels. This is the architectural HIPAA guarantee — not a promise in a BAA, but a design constraint verifiable from the outside.

For solo play therapists, TherapyDraft's Solo plan is $39/month or $349/year with a 10-session free trial and no credit card required. For group practices with multiple child therapists, the Group plan at $29/seat for 3+ seats keeps each therapist's device independent — the child sessions recorded by Therapist A stay on Therapist A's device, entirely separate from Therapist B's practice data.

Updating consent forms for AI-assisted play therapy documentation

If you use any AI tool — cloud or on-device — for play therapy documentation, your clients' parents need an informed consent that specifically addresses AI. For cloud tools, that means: name the vendor, describe that session audio is transmitted to the vendor's servers, specify the retention period from the BAA, and give the parent the right to decline and have notes written manually. For on-device tools, the disclosure is simpler: session audio is processed on the therapist's device, is not transmitted to a third-party server, and is handled under the same security and retention policies as the therapist's other electronic records.

Child therapists in custody or high-conflict family situations should review their consent forms with particular care. The parent who brings a child to therapy may not be the sole personal representative, and the consent they signed for AI-assisted documentation may not bind the other parent. Getting both parents' signatures on the AI documentation consent — or at least documenting the custody arrangement's implications for records access — reduces the risk of a records dispute that surfaces the AI documentation question as a side issue.

For a broader compliance framework — including the subprocessor-inventory exercise that helps you identify every vendor who touches your clinical data — see our HIPAA for private-practice therapists — the 2026 rewrite. The subprocessor audit is especially relevant for child therapists who have adopted several digital tools over the years: practice management system, telehealth platform, e-fax service, and now AI scribe. Each is a potential subprocessor that needs to be named in your HIPAA documentation and, if they receive child PHI, in your clients' families' consent forms.

Frequently asked questions

What should play therapy session notes include?

A play therapy note documents the session date and duration, the child's presenting affect and behavioral state, the play modalities used (sand tray, art, puppets, directive vs. non-directive), the therapist's clinical observations of play themes and content, any verbal statements the child made, the therapist's interpretive assessment of the session's clinical significance, progress toward treatment goals, and the plan for future sessions. For billing, the note also needs the CPT code, diagnostic code(s), and session duration. Unlike adult progress notes, play therapy notes center on the therapist's clinical translation of non-verbal communication rather than client self-report.

Are play therapy notes different from regular therapy progress notes?

Yes. Standard adult therapy progress notes weight verbal self-report heavily. Play therapy notes document what the child communicates through play behavior — the therapist observes, interprets, and translates that non-verbal content into clinical language. An AI scribe tool calibrated on adult therapy transcripts may generate incomplete drafts for play therapy sessions because the verbal signal in the audio is structured differently: more therapist narration, child sound, and play-voice than structured symptom report. The therapist's running interpretive commentary during the session is the primary input, not a patient-reported symptom description.

Can play therapy notes be subpoenaed in custody cases?

Yes. Child therapy records can be subpoenaed in custody proceedings and child protective investigations. Play therapy notes are especially sensitive in custody cases because they may contain the therapist's interpretation of how the child's play reflects their experience of family dynamics. Therapists can assert privilege, but courts sometimes order disclosure over privilege assertions when the child's welfare is at stake. When a cloud AI scribe vendor holds a copy of the session audio or transcript, an attorney can subpoena the vendor directly — accessing session material without the therapist learning about it first. See our full analysis of AI therapy note subpoenas for detail on how this works.

Are child therapy notes HIPAA-protected?

Yes. Child therapy records are PHI for any HIPAA-covered entity. For most minor clients, the parent or legal guardian holds the personal representative rights — they can access records and authorize disclosures. Exceptions exist when state law allows minors to consent to their own treatment, when disclosure to a parent could put the minor at risk, or in abuse and neglect situations. In custody cases, both parents may have equal standing as personal representatives, which creates records-access complexity. A cloud AI scribe vendor who holds a copy of the child's session material is a business associate under HIPAA — but the BAA does not give the therapist the same control over the vendor's files as the therapist has over their own records.

How does on-device AI drafting work for play therapy notes?

With TherapyDraft, you load the session recording on your M-series Mac. whisper.cpp transcribes locally — a 45-minute session takes about 9 minutes on an M2. The local model drafts the note using your own prior notes as style and format examples. The therapist reviews the draft, adds clinical interpretation, and pastes the final note into the EHR. The session recording, transcript, and draft all remain on the therapist's device. No cloud vendor receives the child's session audio. The macOS network sandbox enforces this architecturally — not as a policy promise but as a technical constraint.

Check your current note tool's data posture

Our BAA Coverage Gap Quiz walks through five questions about your current session note setup — which vendors handle your session data, what they retain, and what happens in a legal process scenario. Five questions, sixty seconds, runs entirely in your browser with no data sent anywhere. Child therapists can embed it on their own site as a parent-education resource on AI documentation in child therapy.

Run the BAA Coverage Gap Quiz

Try TherapyDraft for child and play therapy practice

TherapyDraft's private beta is free for 10 sessions — no credit card. The signed macOS app runs whisper.cpp and a 4-bit local model directly on your M-series Mac. Session audio, transcript, and note draft never leave your device — including session audio from play therapy with minor clients. For solo child therapists, the Solo plan is $39/month or $349/year. For group practices, the Group plan is $29/seat for 3+ seats, with each therapist's device fully independent.

Join the private beta

This post is general information about play therapy documentation practices and clinical data exposure as of 2026. It is not legal advice, clinical supervision, or professional guidance, and does not establish a professional relationship. Questions about documentation standards, consent form requirements, or records-access obligations for your specific practice, jurisdiction, and licensing board should be addressed to an attorney and to your professional association. HIPAA minor-client rules and state law governing minor consent vary significantly; verify requirements for your state. Nothing in this post should be relied on as legal or clinical guidance for a specific situation.