Psychiatric medication management documentation: AI scribes, controlled substances, and PDMP data

A psychiatric medication management appointment is not a therapy session that happens to involve prescribing. It is a distinct clinical encounter with a distinct documentation structure — typically 15 to 30 minutes, focused on medication response, tolerability, and dose adjustment rather than on the extended therapeutic relationship that drives a 50-minute therapy hour. The documentation it produces reflects that difference: mental status examination, reported adverse effects, controlled substance prescription details, Prescription Drug Monitoring Program query results, and brief suicidality screening are the core elements, not the session narrative arc and clinical formulation that anchor a therapy progress note.

That distinction matters for AI scribes. When a prescriber — a psychiatrist, a psychiatric nurse practitioner, a primary care clinician managing psychotropic medications — uses a cloud AI scribe for medication management visits, the vendor receives and retains session audio that contains a concentration of legally and regulatorily sensitive content unlike anything in a standard therapy note. This post examines what that content is, what the cloud vendor holds, and what on-device processing changes about the risk picture.

What a medication management visit actually documents

The typical psychiatric medication management progress note covers six areas. Each carries distinct sensitivity.

Medication list, dose, and schedule. The specific drug, dose, frequency, and any recent changes are the structural core of the note. For psychotropic medications, the drug name communicates a diagnosis without requiring an explicit diagnostic code. A prescription for lithium signals a bipolar disorder diagnosis; buprenorphine signals opioid use disorder; clozapine signals treatment-resistant schizophrenia. Medication-name inference of diagnosis is well-understood in insurance, legal, and investigative contexts. A list of current psychotropic medications is, in practice, a readable proxy for the patient's psychiatric diagnosis history.

Adverse effects and tolerability report. The patient's report of side effects, tolerability problems, and any medication-related functional impairment is documented at each visit. This record accumulates over time: it reflects the full history of what the patient experienced on each medication, including effects that may bear on employment fitness, driving safety, parental capacity, or disability status in subsequent proceedings.

PDMP query and controlled substance discussion. For any Schedule II–IV controlled substance — stimulants for ADHD (amphetamines, methylphenidate), benzodiazepines for anxiety, buprenorphine for opioid use disorder, sleep aids — prescribers in most states are required to query the state PDMP before prescribing or at regular intervals. The PDMP query returns the patient's fill history across all pharmacies in the state, often including fills from multiple prescribers. Prescribers typically document that the query was performed and what it showed. In session, this often involves a verbal review: the prescriber reads the results, discusses any discrepancies, and the patient responds. All of that verbal exchange is captured by a cloud AI scribe's microphone.

Mental status examination. The MSE — observations about appearance, behavior, speech, mood, affect, thought process, thought content, insight, and judgment — is a structured clinical observation that generates clinically and legally significant content. Observations about disorganized thought, suicidal ideation, paranoid content, or cognitive impairment in an MSE can bear directly on competency determinations, guardianship proceedings, and employment fitness evaluations.

Suicidality and safety screening. Standardized screening instruments — the PHQ-9, the Columbia Suicide Severity Rating Scale (C-SSRS), the Patient Health Questionnaire — are administered regularly in psychiatric medication management practice. The scores are documented, and the clinical response (safety plan activation, dose change, hospitalization referral) is recorded. These records represent the most legally sensitive element of the visit: a documented suicidality screen with elevated scores, and the prescriber's clinical response, is a primary target in wrongful death litigation, emergency commitment proceedings, and malpractice claims.

Informed consent for controlled substances and treatment changes. Prescribers document patient consent discussions for controlled substance prescriptions, treatment changes, and off-label uses. The content of those discussions — what risks were disclosed, what alternatives were presented, what the patient said — is a primary record in malpractice proceedings and DEA investigations involving controlled substance prescribing patterns.

What cloud AI scribes capture from a prescriber's session

When a cloud AI scribe is running during a medication management visit, the microphone captures the full verbal content of the encounter — the prescriber reading PDMP results aloud, the patient's account of side effects, the suicidality screening exchange, the discussion of controlled substance renewal. As we documented in the cloud AI scribes data-flow post, the vendor's pipeline typically involves raw audio upload to cloud transcription services, intermediate transcript generation, note drafting via a language model, and varying retention policies for each artifact tier. The vendor retains the raw audio and the verbatim transcript independently of the prescriber's own clinical records and independently of the note that the prescriber reviews and signs.

For medication management visits specifically, the vendor's retained data therefore contains:

• A verbatim record of the PDMP query discussion, including the fill history the prescriber read aloud
• The patient's self-reported controlled substance use history and any acknowledged discrepancies with the PDMP record
• Mental status exam observations — verbatim transcription of the prescriber's MSE documentation often includes clinically explicit characterizations of psychiatric symptoms
• Suicidality screen scores and the clinical response discussion
• Informed consent discussions for controlled substance prescriptions, including what alternatives were discussed and declined
• Any admission by the patient of non-prescribed controlled substance use or diversion that arose in the session

This is a record that exists on the vendor's infrastructure, is governed by the vendor's data retention policy, and can be reached by legal process directed at the vendor as a separate legal entity — not merely by legal process directed at the prescriber.

The PDMP intersection: a second independent record of controlled substance history

PDMPs are state-administered databases. Prescribers query them; they are not PHI in the HIPAA sense when held by the state agency. But the prescriber's clinical documentation of what the PDMP showed — and the patient's verbal responses to that discussion in session — is PHI held by the prescriber, and by the cloud AI scribe vendor that captured the session.

This creates an unusual situation. A patient's cross-pharmacy controlled substance fill history, as discussed in a clinical session, exists in three locations: the state PDMP database (accessible to authorized prescribers and law enforcement under state law), the prescriber's own clinical record (HIPAA-covered, subject to the prescriber's disclosure controls and applicable privilege), and the cloud AI scribe vendor's retained audio and transcript (HIPAA-covered but governed by the vendor's own retention policy and BAA). A business associate agreement does not prevent the vendor's records from being subpoenaed in proceedings directed at the vendor; it governs the vendor's permitted uses and disclosures, not the vendor's obligation to comply with legally valid court orders and subpoenas.

In a DEA investigation into a prescriber's controlled substance prescribing patterns, a discovery subpoena for cloud AI scribe records would return verbatim audio of every PDMP discussion, every dose adjustment conversation, and every patient-reported medication history across the subscription period. That is a materially different scope of record than what the prescriber's own structured clinical notes contain.

PMHNPs: combined prescribing-and-therapy encounters

Psychiatric nurse practitioners frequently structure their practice around combined encounters — a 30- to 45-minute visit that includes both medication management and brief psychotherapy, billed under appropriate E&M codes. This combined structure creates a documentation challenge that is distinct from either pure prescribing or pure therapy practice.

The session audio from a combined encounter contains both the medication management content (PDMP discussion, dose adjustment, adverse effect review, informed consent) and the psychotherapeutic content (session themes, client disclosures, clinical formulation elements, affective processing). HIPAA's enhanced protections for psychotherapy notes (45 CFR 164.501) apply only to notes that are documented separately from the progress note used for billing — and most PMHNPs document the combined encounter in a single integrated progress note, which disqualifies the therapeutic content from psychotherapy note protection. The result is that all of the session content — prescribing and therapy — is in a standard progress note format, with no enhanced protection for the therapeutic observations and client disclosures.

When a cloud AI scribe processes a combined PMHNP encounter, the vendor receives a single audio stream containing both the controlled substance discussion and the psychotherapy content. There is no structural separation in the audio that would allow the vendor to apply different retention or disclosure rules to the two components. The vendor's retained record is undifferentiated: the medication management data and the therapeutic disclosures are in the same file, governed by the same retention policy.

Subpoena reach into medication management records

The legal contexts in which a cloud AI scribe vendor's retained records from medication management visits could be subject to subpoena are broader than those typically considered for therapy notes alone. As we covered in the subpoena risk post, a subpoena directed at the vendor reaches the vendor's records independently of any privilege or HIPAA privacy argument the prescriber or patient might raise through the prescriber's own response to legal process.

For medication management records specifically, the subpoena risk surface includes:

• Disability and Social Security determinations — functional capacity evaluations and the medication history underlying them are central to disability claims
• Employment fitness proceedings — particularly for safety-sensitive occupations (transportation, healthcare, law enforcement) where psychotropic medication history is directly relevant to fitness determinations
• Custody proceedings — a parent's psychiatric medication regimen, suicidality screen history, and mental status exam record are frequently at issue in contested custody cases
• DEA investigations — prescriber DEA registration proceedings and controlled substance diversion investigations routinely seek clinical records as evidence of prescribing patterns
• Workers' compensation claims — psychiatric medication history and mental status exam records bear on causation and extent-of-disability determinations
• Civil malpractice litigation — informed consent documentation and suicidality screen records are primary targets in claims arising from adverse outcomes

In each of these contexts, the cloud AI scribe vendor's retained audio and transcripts from the relevant period represent a more complete and verbatim record than the prescriber's own structured progress notes — because the vendor retains the raw session audio that predates the note drafting and editing process.

On-device processing for prescribers on Apple Silicon

When session audio is processed entirely on the prescriber's Mac, the vendor's independent record does not exist. The Whisper.cpp transcription and on-device language model note-drafting pipeline produces a note draft on the clinician's device; the raw audio and intermediate transcript are never transmitted to cloud infrastructure. The full compliance architecture for solo private practice — Security Rule technical safeguards, BAA obligations, minimum necessary standard — is simpler when there is no cloud vendor in the data flow at all.

For medication management practices, the significance of this is specific: the PDMP discussion, the controlled substance titration history, the MSE observations, and the suicidality screening exchange all remain in one location — the prescriber's own clinical records — under one legal framework — HIPAA's covered entity rules governing the prescriber's own practice. There is no third party holding a verbatim record of what was said about the patient's controlled substance history or the patient's response to suicidality screening, reachable by a separate subpoena directed at that third party.

TherapyDraft processes session audio entirely on the clinician's Mac — Whisper.cpp for transcription, an on-device language model for note drafting on Apple Silicon, no data transmitted to cloud infrastructure. For psychiatrists and PMHNPs conducting medication management visits, session content stays on the device. Solo plan starts at $49/month with a 10-session free trial and no card required.

Further reading

• The 7 things Mentalyc, Upheal, and Blueprint actually send to their servers — the request-by-request data flow behind cloud AI scribes and what each artifact tier the vendor retains contains
• Can an AI therapy note be subpoenaed? A 2026 legal-risk explainer — how civil and criminal subpoenas reach cloud AI vendors directly and what the clinician cannot control about the vendor's response
• What is a BAA, actually — and what it does NOT cover — the structural limits of business associate agreements and why a signed BAA does not prevent a vendor's records from being subpoenaed
• Psychotherapy notes vs. progress notes: the HIPAA distinction that changes what AI scribes can produce — why most AI scribe output is a progress note rather than a protected psychotherapy note, and what that means for combined prescribing-and-therapy encounters
• HIPAA for private-practice therapists — the 2026 rewrite — the compliance posture for a solo practice and the AI scribe subsection of the 2026 risk landscape

This post is educational commentary, not legal, clinical, regulatory, or compliance advice. HIPAA requirements for psychiatric records, DEA record-keeping obligations for controlled substance prescriptions, PDMP query and documentation requirements, and applicable privilege frameworks vary by jurisdiction and clinical context. The interaction between HIPAA's Minimum Necessary standard, the business associate agreement framework, and third-party vendor legal process obligations is fact-specific. State pharmacy board requirements and DEA regulations for Schedule II–IV substances impose obligations that exist independently of and in addition to HIPAA. Consult a licensed healthcare attorney before making documentation or technology decisions for a medication management practice.