Post-termination therapy and the cloud AI scribe vendor archive: five adversarial proceedings where the vendor's record persists after the clinical relationship ends

Most discussions of cloud AI scribe risk focus on the active clinical relationship — sessions currently in progress, a client in active treatment, records generated in the course of ongoing care. That framing is incomplete. It misses the dimension that makes cloud AI scribe vendor archives structurally different from the therapist's own clinical file: the vendor's archive persists after the clinical relationship ends, under the vendor's own retention schedule, independently accessible through legal mechanisms that operate against the vendor as a separate custodian.

A therapist who terminates a clinical relationship has finite and knowable control over the clinical file. The therapist retains the file for the mandatory HIPAA retention period, transfers records on a proper written request, and destroys the file after the applicable retention period expires. The therapist knows what is in the file. The therapist knows when records have been requested or subpoenaed. The therapist can assert privilege and object to production. The clinical file is under the therapist's custody — the therapist is the custodian.

The cloud AI scribe vendor's archive is held under different terms entirely. The vendor is an independent custodian with its own retention schedule, its own production obligations when served with legal process, and no obligation to notify the therapist before producing records under HIPAA's authorized exceptions. When the clinical relationship ends and the therapist's last session note is written, the vendor's archive of every session in that relationship — every verbatim recording, every transcript — continues to exist under the vendor's infrastructure and the vendor's retention policies. That archive does not end because the clinical relationship ended.

The retention structure that creates post-termination exposure

HIPAA's Privacy Rule requires covered entities to retain their policies, procedures, and documentation for six years from the date of creation or the date last in effect, whichever is later. Business associates — which cloud AI scribe vendors are — operate under equivalent obligations. In practice, session audio and transcript data generated during an active clinical relationship falls within the category of records a vendor is obligated to retain for this period. Vendors whose HIPAA compliance posture is defensible typically retain at least this long; many retain longer under internal data governance frameworks that treat a longer retention window as a risk-reduction measure against future production requests.

This retention structure means that a clinical relationship that terminated in 2023 may have a vendor archive that remains accessible through 2030. A relationship that terminated in 2022 after three years of active treatment may have a vendor archive that a 2028 adversarial proceeding can reach. The end date of the clinical relationship is not the end date of the vendor's custodianship of the session records.

The therapist typically has no mechanism to confirm whether the vendor's archive still exists, whether it has been accessed, or whether it has been produced in response to legal process the therapist knows nothing about. Post-termination, the vendor is an opaque custodian holding session-level verbatim records — records that may document clinical conduct the therapist no longer clearly remembers from sessions that ended years ago.

Proceeding 1 — former client's malpractice lawsuit filed years after termination

Clinical malpractice statutes of limitations in most states run from the date of the negligent act or the date of discovery, and for claims involving minor clients, from the date of majority. A therapy relationship that ended in 2022 may generate a malpractice complaint in 2025 or 2027. The former client's attorney, in pursuing that claim, will conduct discovery against the therapist and will separately investigate what third-party custodians hold records of the clinical relationship.

A cloud AI scribe vendor that the former client's attorney identifies — through the therapist's business associate list, through vendor identification in discovery, or through the former client's own knowledge of how sessions were documented — is a Rule 45 subpoena target as a separate legal entity. Under HIPAA's judicial proceedings exception at 45 CFR 164.512(e), the vendor can produce session records in response to a qualifying court order or subpoena issued with appropriate procedural protections. If the vendor's retention schedule has not yet expired, verbatim session audio from every session in the clinical relationship — including sessions from years earlier — may be available to the plaintiff's attorney through this pathway.

This creates a specific forensic asymmetry the therapist may not anticipate: the plaintiff's attorney may arrive in litigation holding verbatim transcripts of sessions the therapist documented only in progress notes, from a relationship that ended years ago, documenting clinical conduct the therapist cannot clearly reconstruct from memory or from the notes alone. The therapist's own clinical file is one version of the record. The vendor's verbatim archive is another, potentially more complete version — and it is in the plaintiff's attorney's possession through a production pathway that required no cooperation from the therapist.

Proceeding 2 — former client's licensing board complaint about conduct during the prior relationship

Licensing board complaints about a therapist's professional conduct are not time-limited to the period of active treatment. A former client may file a complaint with a state licensing board years after the clinical relationship ended, alleging conduct that occurred during the relationship — boundary violations, inadequate care, failure to act on a crisis presentation, or other professional standard violations. The licensing board's investigative authority over the therapist does not expire when the clinical relationship does.

A state licensing board is a health oversight agency for HIPAA purposes under 45 CFR 164.512(d), with authority to conduct authorized oversight activities including investigations of healthcare providers. The board can issue a health oversight request directly to the cloud AI scribe vendor — without the former client's authorization and without advance notice to the therapist — to obtain session records relevant to the investigation. The vendor's obligation to respond to the board's health oversight request runs to the board, not to the therapist, and does not require the therapist's cooperation or consent.

The vendor's archive may contain verbatim session content from years earlier that is directly relevant to the alleged conduct. A therapist who has moved on from a clinical relationship, may not clearly remember specific sessions, and may be relying on progress notes that reflect the clinician's selective documentation rather than a complete verbatim record — faces a licensing board investigator who may have access to a more complete and less filtered record of what actually occurred in those sessions than the therapist's own documentation provides. As the BAA explainer documents, the business associate agreement governing the vendor's relationship with the therapist does not prevent the vendor from producing records in response to the board's authorized health oversight request.

Proceeding 3 — former client's divorce or custody proceeding where session content becomes contested evidence

A former client who was in therapy during a marriage may, years after both the therapy and the marriage end, find their session content at issue in a divorce or custody proceeding. Content from therapy sessions — disclosures about the former client's mental health history, statements about the other party, clinical assessments of parenting capacity — can be sought by opposing counsel in family court proceedings as relevant to child custody determinations, asset division disputes, or fitness-as-a-parent analyses.

The former client's own attorney may work to assert privilege over the clinical file — and in many jurisdictions, the psychotherapist-patient privilege survives the termination of the clinical relationship and can be asserted by the former client in civil proceedings. But privilege over the therapist's own clinical file is a separate legal question from a production request directed at the cloud AI scribe vendor as an independent custodian. Family courts have broad evidence-gathering authority, and a subpoena issued to the vendor directly — as a non-party in possession of business records relevant to the proceedings — operates in a different procedural context than a subpoena to the therapist.

The former client may not know that verbatim records of their therapy sessions exist in a vendor's archive independently of the therapist's clinical file. The therapist, post-termination, has no mechanism to monitor whether a family court subpoena has been served on the vendor or what the vendor has produced in response. The vendor's archive exists independently of both parties' knowledge or intentions, accessible through family court process directed at the vendor years after the last session.

Proceeding 4 — former client who has since become a mental health professional, and their own licensing board character and fitness review

Graduate clinical training programs in psychology, social work, marriage and family therapy, and counseling routinely require or strongly encourage personal therapy as part of professional formation. Students and trainees who were in personal therapy during their graduate years — using a therapist who documented sessions with a cloud AI scribe — may not think of those personal therapy records as professionally significant years later when they apply for state licensure.

State licensing board character and fitness applications typically ask about mental health treatment history. A former client who is now a license applicant may disclose that history on the application, triggering an inquiry into the treatment records. Or the board's background investigation may surface information about prior treatment through other channels. In either case, the licensing board — as a health oversight agency with authority under HIPAA 45 CFR 164.512(d) — can issue a health oversight request directly to the cloud AI scribe vendor that the former client's treating therapist used during the training-era personal therapy. As the subpoena explainer documents, the clinician's privilege over their own records does not extend to records independently held by a third-party vendor, and a health oversight request directed at the vendor does not require the former patient's authorization.

The former client — now a license applicant — may be entirely unaware that their training-era therapist used a cloud AI scribe, that a vendor holds verbatim records of those personal therapy sessions, or that the licensing board has independently obtained those records as part of a character and fitness investigation. The vendor archive from sessions that ended years earlier, during the former client's graduate training, is now a forensic artifact in the licensing board's investigation of the person who used to be the patient.

Proceeding 5 — post-termination investigation where the former client is the complainant and the vendor archive documents what the therapist cannot clearly remember

This proceeding combines the licensing board complaint pathway with a specific asymmetry that is unique to post-termination situations: the therapist's own memory of the clinical relationship may have faded significantly. A therapist who saw hundreds of clients over many years since a particular clinical relationship ended may not clearly remember specific sessions — what was said, what clinical decisions were made, what the therapeutic interactions consisted of in detail. The therapist's progress notes are the documentary record, but progress notes are selective — they reflect what the therapist judged worth documenting, not a complete verbatim record of every exchange.

A former client who remembers the sessions in detail — and who files a complaint alleging specific conduct — gives investigators a former-client account of those sessions. The licensing board investigator, or a malpractice plaintiff's attorney, who then obtains the vendor's verbatim archive of those same sessions has access to a third data source: the complete verbatim record of what occurred, at a level of detail that neither the therapist's notes nor the former client's memory alone provides. That verbatim archive was generated in real time during the sessions and has been sitting in the vendor's infrastructure since the day each session was recorded — waiting, accessible, under the vendor's retention schedule, independent of anything that happened after the clinical relationship ended.

The therapist confronting that archive in a post-termination proceeding is confronting a record they did not retain, cannot control, and may not have known was being created in the form the vendor holds it. The vendor's verbatim archive of a session the therapist documented in a progress note two lines long may be thirty minutes of audio documenting exactly what the therapist said and what the client said in response — at a level of precision that progress notes, written after the session with clinical judgment applied, do not match.

On-device processing and the single-custodian record

When session audio is processed entirely on the clinician's device — transcribed by Whisper.cpp, drafted by an on-device language model, never transmitted to cloud infrastructure — no vendor archive is created at any point during the clinical relationship. When the relationship ends, there is nothing in a vendor's infrastructure that persists. The only records of the terminated clinical relationship are those under the therapist's own custody: the progress notes, and any locally retained transcripts the therapist chose to keep on the clinician's Mac.

This single-custodian structure changes the post-termination exposure profile entirely. A malpractice plaintiff's attorney cannot reach a vendor archive that does not exist. A licensing board investigator cannot issue a health oversight request to a vendor that holds no records. A family court subpoena directed at a vendor returns nothing. A former client who later becomes a license applicant has no independently retained vendor archive reachable through their own licensing board's health oversight authority.

The terminated clinical relationship has one set of records — the therapist's own file — subject to the therapist's own custody, the therapist's own privilege, and the therapist's own production decisions. That is the structure a clinical record of a completed therapy relationship has always had before cloud AI scribes introduced an independent third-party custodian into the documentary chain of every session. The data-flow explainer documents what cloud AI scribes transmit and retain during active sessions; the retention of that data after the clinical relationship ends is the post-termination dimension this post addresses.

For therapists who see clients for extended periods — years of ongoing therapy, complex clinical relationships with significant disclosures across many sessions — the post-termination persistence of the vendor archive is not an edge case. It is the structural condition of every clinical relationship documented with a cloud AI scribe: the record of those sessions does not end when the clinical relationship does. It ends when the vendor's retention schedule expires — on the vendor's timeline, not the therapist's.

Further reading

• Can an AI therapy note be subpoenaed? A 2026 legal-risk explainer — how civil and criminal subpoenas reach cloud AI vendors directly as separate custodians and what the clinician cannot control about the vendor's response to process directed at the vendor
• What is a BAA, actually — and what it does NOT cover — the structural limits of business associate agreements and why a signed BAA does not prevent a vendor's session records from being reached through HIPAA's health oversight, public health authority, or court-order exceptions
• The 7 things Mentalyc, Upheal, and Blueprint actually send to their servers — the request-by-request data flow behind cloud AI scribes and what each artifact tier the vendor retains during active sessions, which persists post-termination under the vendor's retention schedule
• Mandated reporter pre-report assessment sessions and the cloud AI scribe vendor archive — the parallel analysis for vendor archive persistence during the pre-report assessment window: another case where the contested record is not the session the therapist most remembers but the sessions that led up to a clinical decision point
• Licensing board character and fitness review at initial licensure and the cloud AI scribe vendor archive — the licensing board's health oversight authority over vendor archives in the initial licensure context, which applies directly to the former-client-as-licensure-applicant proceeding described in this post

This post is educational commentary, not legal, clinical, regulatory, or compliance advice. HIPAA retention requirements, malpractice statutes of limitations, licensing board investigative authority, the scope of therapist-patient privilege post-termination, and family court discovery frameworks vary significantly by state and jurisdiction. Vendor retention schedules vary by vendor and may change over time. The forensic and evidentiary analysis in this post is intended to illustrate structural exposure categories, not to characterize the outcome of any specific proceeding. Consult a licensed healthcare attorney before making documentation, retention, or technology decisions for a clinical practice that includes long-term therapeutic relationships.