Security clearance adjudications and therapy records: the SF-86, DOHA hearings, and what cloud AI scribes hold

A records problem that does not exist for most therapy clients

For the overwhelming majority of therapy clients, the pathways by which session content reaches outside parties are limited: insurance billing creates an administrative trail, legal proceedings can compel records through subpoena, and mandatory reporting obligations require specific disclosures. The therapist's clinical records are the primary record, and the therapist is the primary — often sole — custodian.

Clients holding or seeking federal security clearances exist in a different legal environment. They have signed a release of information authorizing the federal government to obtain records from healthcare providers as part of a background investigation. The Defense Counterintelligence and Security Agency (DCSA), which conducts the majority of federal civilian background investigations, has a specific pathway to therapy records that does not require a court order. The Defense Office of Hearings and Appeals (DOHA) has adjudicative authority over clearance denials that can place mental health records squarely at issue in a formal proceeding. And the psychotherapist-patient privilege established in Jaffee v. Redmond (1996), while real, has limits in the national security administrative context that are different from its limits in ordinary civil litigation.

A cloud AI scribe operating in the therapist's office during sessions with this population creates an additional records layer that the applicant cannot control and the therapist does not hold: the vendor's independently retained archive of session audio.

The SF-86 release: what the applicant authorizes

Standard Form 86 (SF-86) — the Questionnaire for National Security Positions — is the primary application document for federal security clearances. Applicants sign a release as part of completing the form that authorizes federal agencies to obtain records from educational institutions, employers, courts, and healthcare providers.

The SF-86 mental health question (Question 21 in recent versions) asks about mental health consultations, treatment, and hospitalizations within a specified lookback period. The question includes an explicit exclusion for certain categories of counseling — typically including counseling related exclusively to marital, family, or grief issues not related to violence, and counseling that was not court-ordered, not related to substance use, and not directed toward a condition that interferes with job performance. Many clients in voluntary outpatient psychotherapy fall within this exclusion.

However, the applicant — not the therapist — determines whether the exclusion applies. That determination is legal advice that a security clearance attorney, not a clinician, is qualified to provide. Therapists should not advise clearance-holding clients about SF-86 disclosure obligations, and should be aware that a client's statement that they "don't need to report" therapy is the client's legal judgment, not a verified fact.

More importantly for documentation purposes: even when a client correctly determines that their therapy falls within the exclusion and need not be reported, the SF-86 release they signed broadly authorizes the government to obtain healthcare records in the course of the investigation. The release is not limited to records the applicant chose to disclose. And if therapy is discovered through other investigative channels — employer interviews, references, financial records, or the applicant's own statements — the government can request records from the therapist under HIPAA's national security exception without the applicant's separate authorization.

What therapy sessions with clearance-holding clients actually contain

Therapists who work in the Washington, D.C. area, in military communities, around federal contractor clusters, and in other clearance-dense populations often have more clearance-holding clients than they realize — many clients do not mention their clearance status, and the status may not be clinically relevant in ways the therapist would recognize.

But the content of sessions with clearance-holding clients can be adjudicatively relevant across multiple guideline categories, not just Guideline I (Psychological Conditions). The adjudicative guidelines that DOHA and DCSA apply cover thirteen specific concern categories:

A client who discusses financial stress — debt, a gambling problem, a period of unemployment, a divorce with significant asset disputes — has discussed Guideline F (Financial Considerations) subject matter. A client who discusses foreign travel for personal reasons, a foreign national family member, or a close relationship with a person from a foreign country has discussed Guideline B (Foreign Influence) subject matter. A client who discusses substance use — even past use, even in recovery — has discussed Guideline G (Drug Involvement and Substance Misuse) subject matter. A client who discusses a workplace conflict, a disciplinary action, or professional performance concerns has discussed Guideline E (Personal Conduct) subject matter.

None of this requires the therapist to connect it to the clearance process. It is simply the ordinary content of psychotherapy — the financial anxieties, relationship dynamics, professional stressors, and substance use histories that are the normal subject matter of therapy sessions. In a cloud AI scribe context, verbatim audio of those discussions exists in the vendor's archive. The vendor's record is not a clinical note filtered through the therapist's professional documentation judgment. It is everything that was said.

How DCSA background investigators access healthcare records

When a DCSA background investigator seeks healthcare records for a clearance investigation, the primary authorization is the SF-86 release the applicant signed. Under HIPAA's national security exception at 45 CFR 164.512(k), covered entities — including licensed mental health clinicians — may disclose PHI to authorized federal officials conducting national security and intelligence activities, including personnel security investigations.

In practice, investigators contact healthcare providers identified in the SF-86 (because the applicant listed them) or discovered through other investigative means (employer records, interviews, financial records). Contact typically takes the form of a written request accompanied by the signed release, or an in-person interview request. Therapists who receive such a request should consult their agency's or malpractice carrier's legal resources before responding — the scope of the release, the nature of the investigation, and applicable state licensing board guidance all bear on the appropriate response.

The key point for cloud AI scribe purposes is that a DCSA records request runs to the healthcare provider — the covered entity — not to the cloud AI scribe vendor. The vendor is not a healthcare provider; it is a business associate that processes PHI on behalf of the covered entity. A DCSA records request served on the therapist reaches the therapist's clinical records. It does not automatically reach the vendor's independently held session audio.

But the vendor's records are not unreachable. They are reachable through a separate records request served on the vendor, through civil subpoena in a DOHA proceeding, or through other legal process served on the vendor as a separate entity. The therapist's production of their own clinical records does not represent the totality of records available to an investigator who knows the sessions were processed by a cloud AI scribe vendor.

DOHA hearings and Guideline I adjudications

When a security clearance applicant receives a Statement of Reasons (SOR) raising concerns under Guideline I (Psychological Conditions), the applicant has the option to respond in writing or request a formal hearing before a DOHA administrative judge. Hearings under DOHA procedures are adversarial proceedings with documentary evidence, witness examination, and a written decision appealable to the DOHA Appeal Board.

Mental health records are frequently central to Guideline I hearings. The government's case typically relies on psychological evaluation reports, treatment records, and sometimes expert testimony about the applicant's psychological fitness. The applicant's defense typically includes favorable mental health evidence — treatment records showing resolution of the concerns, current provider statements, or independent psychological evaluations.

When an applicant places their mental health directly at issue by contesting a Guideline I denial, the applicant partially waives any privilege over records that are directly relevant to the contested mental health issues. The scope of that waiver is a contested legal question in individual cases, but as a practical matter, DOHA hearings routinely involve production of therapy records.

In this context, the cloud AI scribe vendor's independently held session audio is a distinct body of records with an independent legal status. The applicant's waiver — if any — runs to the mental health treatment records; the vendor's verbatim audio record of sessions may be characterized differently by the vendor's own legal counsel, subject to the vendor's own jurisdictional obligations, and not automatically within the scope of records the therapist has agreed to produce.

The result is a records environment that is more complex, and potentially more adverse to the applicant, than a world where the therapist's clinical notes are the only record of session content. A vendor whose independently held audio is subpoenaed in a DOHA proceeding will respond based on the vendor's legal obligations — not based on the therapist's clinical judgment about what to document, not based on the applicant's privilege assertions to the adjudicating authority, and not with the therapist's professional standing to contest the subpoena on the applicant's behalf.

The Jaffee privilege and its limits in this context

Jaffee v. Redmond, 518 U.S. 1 (1996), established that the Federal Rules of Evidence recognize a psychotherapist-patient privilege for confidential communications made to a licensed psychotherapist in the course of diagnosis or treatment. The privilege applies in federal civil proceedings.

The privilege's application in the national security administrative context is constrained in two significant ways. First, the SF-86 release authorization represents a knowing, voluntary waiver of the privilege for records within its scope — the applicant authorized government access to healthcare records as a precondition to clearance eligibility. Second, DOHA administrative proceedings, while adversarial, are not federal civil proceedings governed by the Federal Rules of Evidence in the same way; the DOHA rules of evidence apply, and the extent to which Jaffee limits DOHA's access to mental health records when the applicant has placed mental health at issue in the proceeding is not settled law.

More directly relevant to the cloud AI scribe question: Jaffee's privilege protects confidential communications made to the psychotherapist. The vendor is not the psychotherapist. Session audio held by a cloud vendor as the vendor's own business records is not obviously covered by a privilege that protects communications made to the treating therapist. An applicant asserting Jaffee protection over a vendor subpoena for session audio faces a significantly more difficult argument than asserting the same privilege over a subpoena directed to the therapist's own clinical records.

What the vendor's archive contains that the therapist's notes do not

The practical difference between the therapist's clinical documentation and the cloud AI scribe's verbatim audio comes into sharp focus in the clearance adjudication context.

A therapist documenting a session with a clearance-holding client exercises professional judgment about what to document in the clinical record. A progress note for a session discussing a client's financial stress might note "client reported ongoing financial concerns related to recent job transition; explored impact on mood and anxiety management strategies." The note captures the clinical content relevant to treatment.

Verbatim session audio captures everything: the specific dollar amounts of debt, the names of creditors, whether the client mentioned gambling, the foreign national spouse's employment circumstances, the client's self-reported substance use frequency, the professional conflict with a named supervisor, and the client's own assessment of how these matters relate to their clearance status. The gap between a clinical note's summary of adjudicatively relevant content and a verbatim audio record of it is not a marginal difference in a DOHA proceeding — it is the difference between a professional clinical record and a transcript.

This is the structural point that makes the vendor-custody layer particularly significant for clearance-holding clients. The therapist's documentation judgment — the professional act of deciding what belongs in a clinical record — is absent from the vendor's archive. The vendor holds the session; not the note the therapist made about it.

On-device processing and the single-custodian record

When session audio, transcript, and AI-assisted note drafts are processed entirely on the therapist's local device — under macOS network sandbox enforcement that prevents any network connection for audio, transcript, or note text — the vendor archive does not exist. The therapist's own clinical record is the sole record of session content.

For clearance-holding clients, the practical effect is that if DCSA requests records, if a DOHA proceeding raises mental health issues, or if the applicant's circumstances change in ways that make session content adjudicatively significant, the records available are the therapist's clinical notes: the product of the therapist's professional documentation judgment, subject to HIPAA, applicable privilege law, and the therapist's professional obligations to the client.

The independently held vendor archive — reachable through a separate records request served on the vendor, through civil subpoena in a federal proceeding, or through other legal process — does not exist because there is no vendor copy to reach. The technical explanation of what cloud AI scribes transmit describes why the vendor's retention of session audio is a structural choice of cloud-based architecture, not a necessary feature of AI-assisted note generation.

Therapists who work with clearance-holding populations — in the D.C. metro area, at VA medical centers serving veterans in security-sensitive roles, in military community mental health practices, and in private practice serving federal contractors — are not typically considering adjudicative guidelines when they choose a documentation tool. But for this population, the choice between cloud AI scribe and on-device processing is not just a HIPAA question. It is a question about who holds session content and in what form, at a point where that content can carry consequences for the client's professional life, livelihood, and legal position in a federal proceeding.

Frequently asked questions