Psychedelic-assisted therapy, ketamine clinics, and cloud AI scribes: the vendor archive DEA proceedings and MAPS protocol governance cannot shield

What psychedelic-assisted therapy looks like in 2026 and where AI scribes enter

Three distinct modalities define what practitioners call psychedelic-assisted therapy in 2026, each with its own regulatory status, clinical structure, and documentation workflow.

Ketamine-assisted psychotherapy is by far the most common and the most relevant to private-practice therapists in the primary ICP for TherapyDraft. Ketamine is a Schedule III controlled substance with an extensive history of clinical use as a dissociative anesthetic; its off-label use in treating treatment-resistant depression has produced a substantial body of clinical literature. In the KAP model, a licensed therapist — LMFT, LCSW, LPC, PsyD, PhD — provides the psychotherapy component of treatment, working in coordination with a prescribing clinician (psychiatrist, nurse practitioner, or physician) who handles the medical administration. The therapist's work spans three session types: a preparation session prior to the ketamine administration, the medicine session (in which the therapist is present during or following the ketamine infusion, IM injection, or sublingual administration), and one or more integration sessions that follow the medicine session. Each of these is a distinct clinical encounter that a therapist might document with an AI scribe. The medicine session alone is typically two to four hours; the preparation and integration sessions run fifty to ninety minutes. A complete KAP sequence generates more audio content than several months of standard weekly therapy sessions.

Psilocybin-facilitated therapy became legal for licensed service centers in Oregon in 2023 under Measure 110's implementing framework (ORS Chapter 475A) and in Colorado in 2023 under Proposition 122. Oregon licenses psilocybin facilitators — who need not be licensed mental health therapists — to provide psilocybin services in licensed service centers. However, many licensed therapists who provide preparatory and integration services operate in private practice contexts alongside or in conjunction with licensed service centers, and the licensed-therapist-as-integrationist role is growing as psilocybin therapy expands into clinical practice. Psilocybin sessions are even longer than ketamine medicine sessions — typically five to eight hours — generating an especially substantial volume of session content.

MDMA-assisted therapy for PTSD completed FDA breakthrough therapy review based on the MAPS Phase 3 clinical trials. Therapists trained and credentialed in the MAPS protocol worked within a research structure during the trials; as the modality moves toward FDA approval and eventual clinical practice, the same trained therapists will provide MDMA-assisted therapy in clinical settings governed by the conditions of approval rather than by a clinical trial protocol. The MAPS medicine session runs approximately eight hours. The content disclosed during an MDMA-assisted PTSD session — trauma narratives processed in an altered state of consciousness, somatic experiences related to trauma, the subjective phenomenology of the MDMA experience itself — is among the most sensitive content generated in any therapeutic modality.

In all three modalities, the AI scribe enters the workflow at the session level. A therapist who uses a cloud AI scribe to generate session notes from the preparation session, the medicine session, or the integration session routes the audio content through a vendor's cloud infrastructure. What cloud AI scribes actually retain — verbatim audio, full transcripts, draft note iterations, prompt-response logs — means the vendor holds a comprehensive record of the session content that extends far beyond what appears in the therapist's own clinical notes.

What clients disclose in psychedelic-assisted therapy sessions

The clinical value of psychedelic-assisted therapy rests precisely on the depth of disclosure and processing that the altered state enables. Clients in KAP preparation sessions discuss the trauma history, current psychiatric symptoms, prior treatment history, current medication regimen, and specific intentions for the medicine session that the therapist will use to contextualize the experience and facilitate integration. Clients in medicine sessions — particularly in ketamine medicine sessions where the therapist is present and the client is verbal — may narrate the altered-state experience in real time, revisit traumatic memories with unusual vividness, report dissociative phenomena, make connections between current symptoms and historical experiences, and disclose content that they have not accessed in years of prior conventional therapy.

The substance use history is clinically routine in this context and legally consequential in others. A client who discusses prior recreational psilocybin, MDMA, or other controlled substance use in the context of psychedelic preparation is making a statement about Schedule I substance use that, in a different proceeding, could carry legal significance. A client who describes their experience of dissociation, memory fragmentation, or depersonalization in the context of trauma processing is creating a detailed symptom record that could be relevant to disability proceedings, custody determinations, or employment-related fitness-for-duty evaluations. A client who describes the interpersonal conflicts, relationship failures, or workplace incidents that formed the substrate of their treatment-resistant depression is creating a verbatim account of events that may bear on pending or future civil litigation.

The gap between the therapist's formal note and the vendor's verbatim archive is wider in psychedelic-assisted therapy than in most other modalities. A fifty-minute conventional therapy session generates perhaps thirty minutes of clinically relevant content; a four-hour ketamine medicine session generates four hours of content from which the therapist extracts a one-to-two page progress note. The vendor retains everything. In trauma processing modalities more broadly, the gap between the formal clinical note and the verbatim session content held by the vendor is a structural exposure that HIPAA's BAA framework does not close — it only establishes process requirements for how the vendor handles disclosures in response to legal process. In psychedelic-assisted therapy, the depth of disclosure and the duration of the session make that gap substantially larger than in conventional therapy contexts.

The regulatory and data governance frameworks — and where cloud AI scribes sit outside them

Three distinct regulatory and governance frameworks touch psychedelic-assisted therapy. Each addresses a different aspect of the clinical and research work. None creates a confidentiality protection that extends to the cloud AI scribe vendor.

The DEA's controlled substance documentation framework under the Controlled Substances Act (21 U.S.C. §§ 801 et seq.) governs the prescribing clinician's records: the prescription, the dispensing record, the administration record. In the KAP model, this means the prescribing psychiatrist or physician holds DEA-regulated records of the ketamine prescription and administration. The therapist who provides the psychotherapy component holds clinical records that are governed by HIPAA — not by the DEA's controlled substance documentation rules. A cloud AI scribe that captures the therapist's session audio is processing HIPAA-regulated PHI, not DEA-regulated controlled substance records. The DEA framework does not protect the vendor's archive, and DEA administrative authority — including the agency's broad subpoena power in registration proceedings under 21 U.S.C. § 877 — is not bounded by the controlled substance documentation framework. DEA can reach third-party document custodians in proceedings where the therapist's clinical records are relevant to a registrant's fitness to prescribe.

Oregon's psilocybin services regulatory framework (OAR Chapter 333, Division 333) governs licensed service centers and licensed facilitators: licensing requirements, training and certification standards, service center operations, and record-keeping by licensed facilitators and service centers. Licensed therapists who provide preparatory or integration services to psilocybin service center clients in a private-practice capacity operate under their own licensing board's jurisdiction and their own HIPAA obligations, not primarily under the Oregon psilocybin services framework. Their cloud AI scribe vendor sits entirely outside the Oregon psilocybin services regulatory structure.

The MAPS Phase 3 clinical trial IRB data governance framework governed the research records of MDMA-assisted therapy trial participants: the case report forms, protocol-required assessments, adverse event documentation, and research data collected under IRB-approved procedures. IRB data governance is distinct from HIPAA's BAA framework — it governs research records held by the sponsor and the site, not clinical records held by an individual therapist or by a third-party vendor the therapist engaged independently. A therapist who used a cloud AI scribe during MAPS protocol sessions was processing the session content through their own vendor relationship, outside the trial's data governance structure. IRB data governance does not protect the vendor's archive from legal process outside the trial structure.

Legal and regulatory proceedings where the vendor archive reaches adverse parties

DEA administrative inspection and Show Cause proceedings. DEA has broad authority to inspect the records of DEA-registered practitioners and to initiate Show Cause proceedings when the DEA Administrator has cause to believe that continued registration would be inconsistent with the public interest. In a proceeding involving a prescribing clinician who provided ketamine for KAP — and who worked with a specific network of therapists — DEA investigators may identify the treating therapists through the prescriber's referral network and seek records from those therapists and from any third-party vendors the therapists used. DEA administrative law judges have authority to compel production of records relevant to the registration proceeding through administrative subpoena. The therapist's cloud AI scribe vendor, holding verbatim session content from the KAP medicine sessions, is a potentially relevant third-party document custodian in any proceeding where the nature or conduct of those sessions is at issue. The vendor's records are reachable through DEA's administrative process in ways that neither the therapist nor the client may have anticipated when the BAA was signed.

State licensing board investigation. State licensing boards for psychology, social work, counseling, and marriage and family therapy have broad investigative authority over their licensees, including the power to compel production of records from third parties. Psychedelic-assisted therapy is an area of active licensing board scrutiny: as the modality moves from research settings into private practice, scope-of-practice questions, informed consent standards, and standard-of-care determinations are being actively developed and contested. A licensing board investigating a complaint about a therapist's KAP or psilocybin integration practice — whether the complaint concerns scope of practice, adequacy of informed consent, management of an adverse reaction, or boundary concerns arising from the extended medicine session — may issue a subpoena or administrative demand directly to the cloud AI scribe vendor. Subpoena authority extends to third-party document custodians who hold records relevant to the investigation, and the vendor has no privilege to assert and no licensure at stake in protecting the records. The emerging-modality context makes licensing board scrutiny of psychedelic-assisted therapy practitioners substantially more likely than in established modalities — and the vendor archive is particularly valuable to a board investigating whether what the therapist documented accurately reflects what occurred in the session.

Malpractice litigation. Malpractice in psychedelic-assisted therapy is an emerging area of litigation that will develop substantially as the modality expands from clinical trials into private practice. The causes of action in KAP malpractice cases are already being litigated in several jurisdictions: failure to adequately screen for contraindications, inadequate informed consent disclosures regarding the risks of dissociative states, failure to manage adverse reactions during the medicine session, and boundary violations arising from the extended intimate contact of the medicine session. In any of these cases, the verbatim content of the preparation session, medicine session, and integration sessions is potentially central evidence — both to the plaintiff's theory (to establish what actually occurred and what was disclosed versus what the therapist documented) and to the defense (to demonstrate the adequacy of informed consent discussions and the appropriateness of the therapist's conduct). A plaintiff's attorney can issue a Rule 45 subpoena directly to the cloud AI scribe vendor without engaging the therapist's privilege claims over the therapist's own clinical records. The vendor, as a third-party document custodian, responds to lawful civil process according to its own legal compliance procedures.

The MAPS protocol gap: research participants in clinical settings. Therapists trained in the MAPS protocol who transition from clinical trial work to clinical practice occupy a position that existing data governance frameworks did not anticipate. During the trials, the IRB data governance structure covered research records; participants had the protections of the human subjects research framework in addition to HIPAA. In clinical practice following FDA approval, those same trained therapists provide MDMA-assisted therapy under the conditions of approval — as licensed clinicians, not as research investigators. The IRB data governance structure no longer applies; the protections it provided to research participants do not carry forward into the clinical practice setting. A therapist who provides MDMA-assisted therapy in clinical practice and who uses a cloud AI scribe is operating under the same HIPAA BAA framework as any other licensed therapist — with the same exposure to third-party vendor records requests that any clinical therapist faces. The regulatory protections that apply in research and specialized treatment contexts do not translate automatically into equivalent protections in private clinical practice.

What on-device processing changes for psychedelic-assisted therapy practitioners

The clinical work of providing ketamine-assisted psychotherapy, psilocybin integration therapy, or MDMA-assisted therapy is unchanged by the choice of documentation tool. The therapist continues to provide preparation sessions, to be present during or following medicine administration, to facilitate integration, and to generate clinical notes that reflect the content and progress of treatment. What changes is whether the verbatim content of those sessions — including the extended altered-state disclosures, the trauma narratives, the phenomenological accounts of the psychedelic experience, and the sensitive personal history that forms the clinical substrate of the work — exists in a vendor archive that no party to the clinical relationship controls.

When a therapist uses TherapyDraft to document KAP preparation sessions, medicine sessions, and integration sessions, the session audio is captured, transcribed, and processed entirely on the therapist's Mac. No audio, transcript, or draft note text is transmitted to vendor infrastructure. The therapist's own clinical records — maintained under the therapist's own HIPAA obligations and the professional documentation standards applicable to the modality — remain the sole detailed documentation of those sessions. There is no vendor archive for DEA administrative proceedings to access, no third-party document custodian holding verbatim medicine session content for a state licensing board to subpoena, no document store for a malpractice plaintiff's attorney to reach through Rule 45 process.

This matters differently in psychedelic-assisted therapy than in conventional weekly therapy for two reasons. First, the session duration is substantially longer — a four-to-eight-hour medicine session generates a volume of content that creates a correspondingly large vendor archive if processed in the cloud. Second, the depth of disclosure during altered-state processing is frequently described by both clients and therapists as qualitatively different from conventional sessions — clients access and articulate content that they have not been able to access in prior treatment, content that may be legally significant in ways that neither the therapist nor the client can anticipate at the time of the session. The convergence of longer sessions and deeper disclosure makes the psychedelic-assisted therapy context one where the structural gap between the therapist's clinical note and the vendor's verbatim archive is both larger and more consequential than in most other therapeutic modalities.

On-device processing closes that gap entirely. The preparation session, the medicine session, and the integration session exist as clinical events documented in the therapist's own records — with no third-party custodian holding the verbatim content at a network address where DEA, a licensing board, a malpractice plaintiff, or an opposing party in any proceeding can direct legal process.

Frequently asked questions