Teletherapy cross-state licensure and cloud AI scribes: five adversarial proceedings for LCSWs and LPCs under the Social Work Licensure Compact and Counseling Compact

The Social Work Licensure Compact and the Counseling Compact resolved a specific access problem: a licensed clinical social worker or licensed professional counselor whose client relocated to another state could continue the therapeutic relationship by telehealth without waiting months to obtain full licensure in the client's new state. The compacts allow practitioners in member states to activate practice privileges in other member states through a streamlined administrative process, letting treatment continuity survive what had previously been an insurmountable regulatory gap.

What the compacts did not design for was the cloud AI scribe vendor. When an LCSW or LPC uses a cloud AI scribe to document cross-state telehealth sessions, the vendor's systems accumulate a timestamped, session-level archive of every telehealth encounter the therapist has conducted across every jurisdiction. The vendor is not a party to the licensure compact framework. Its obligations are defined by HIPAA, not by compact rules. HIPAA's health oversight disclosure provision at 45 C.F.R. § 164.512(d) permits the vendor to disclose those records to any state licensing board with investigative authority over the therapist — which, for a practitioner providing telehealth under compact privileges in multiple states, may be two or more boards simultaneously, each receiving the same session archive through independent requests the therapist never learns about until a formal investigation notice arrives.

Marriage and family therapists face a sharper version of the same problem. Without an operational national compact covering MFTs as of 2026 in most states, an MFT who provides telehealth to clients located in states other than their home state must hold full licensure in each of those states. Many do not. The cloud AI scribe vendor holds session records documenting each cross-state session with timestamp precision — records that any state licensing board can reach through the same health oversight authority, without the therapist invoking a compact framework that does not exist for MFTs.

Five adversarial proceedings demonstrate how the cloud AI scribe vendor archive multiplies the licensing and legal exposure of cross-state telehealth practice in ways that no BAA restriction and no compact limitation can contain. As the BAA analysis makes clear, a signed business associate agreement defines the vendor's permitted uses and disclosures — it does not override the independent disclosure authorities HIPAA grants to licensing boards, courts, and law enforcement.

The multi-jurisdictional record problem

Under both the Social Work Licensure Compact and the Counseling Compact, a practitioner who activates practice privileges in a member state is subject to the laws and regulations of the state where the client is located during the session — the practice state — including that state's scope of practice requirements, supervision requirements, and professional conduct standards. The practitioner's home state licensing board retains authority over the underlying license. Adverse actions taken in any compact member state are reported to a compact data system accessible to all member states.

This multi-state accountability framework is the compact's enforcement backbone. It prevents a practitioner from using compact privileges to escape discipline by relocating practice to a different state. What it also means is that a practitioner using compact privileges to provide telehealth is simultaneously subject to the oversight jurisdiction of two or more licensing boards — one for each state where a client is located during a session — and that each of those boards holds independent HIPAA § 164.512(d) health oversight authority over the sessions conducted in its jurisdiction.

The cloud AI scribe vendor operates in this multi-board environment as a neutral records custodian. Its records — verbatim session audio, AI-generated transcripts, draft notes — are timestamped and attributable to specific sessions. A vendor that receives a health oversight request from the practice state's licensing board will respond with records of sessions that occurred in that state. The same vendor, receiving a separate request from the home state board investigating the same therapist, responds with the same records. The two boards may be investigating the same underlying conduct — or entirely separate conduct that happens to involve the same session archive. The BAA the therapist signed does not restrict these independent disclosures, because the BAA cannot override the statutory health oversight disclosure authority that HIPAA grants to licensing boards. What the description of what cloud AI scribes actually send to their servers makes concrete is what that session archive contains and how it is classified — verbatim audio, AI-generated transcript, and all metadata the vendor's systems generate around each session.

Proceeding 1: practice-state unauthorized practice investigation

The most direct consequence of cross-state telehealth without proper licensure authorization is an unauthorized practice investigation by the state where the client was located during sessions. This occurs in three distinct scenarios under the compact framework: a practitioner who begins providing telehealth to a client in a practice state before compact privileges are formally activated; a practitioner who provides telehealth to clients in non-compact states that the compact does not cover; and an MFT who has no compact option and provides telehealth across state lines without full licensure in the client's state.

Both the Social Work Licensure Compact and the Counseling Compact require that a practitioner complete the compact privilege application and receive confirmation before providing services in a practice state. A practitioner who begins providing telehealth to a client in a practice state while the application is pending — even if the application is ultimately approved — has practiced without authorization during the gap period. Under most states' unauthorized practice statutes, unauthorized practice of a licensed profession is a criminal offense, typically a misdemeanor for a first offense with escalating penalties for continuing violations. A licensing board complaint from a client, a former colleague, or an insurance carrier auditor can trigger an unauthorized practice investigation that reaches back to the first session the therapist provided in the state.

The cloud AI scribe vendor's archive is the evidentiary foundation of this investigation. The vendor's session records, timestamped to each day and time the session was documented, provide the investigating board with a precise record of when sessions in the practice state occurred. The vendor's records may predate the compact privilege activation date by days or weeks. If the therapist argues that records were mislabeled or jurisdictional attributions were incorrect, the vendor's independent timestamped archive is the record the practice-state board uses to establish session timing. HIPAA § 164.512(d) permits the vendor to respond to the board's investigative request without the therapist's knowledge or consent while the investigation is in its preliminary phase — before a formal notice is issued, before the therapist retains counsel, before any opportunity to challenge the scope of the disclosure. The licensing board disciplinary proceedings analysis describes the HIPAA disclosure mechanics that operate when a board investigation reaches a vendor archive.

For MFTs providing cross-state telehealth without compact coverage, the same investigation pattern applies with greater exposure. An MFT seeing a client located in a state where the MFT holds no license has no compact framework to invoke. Every session documented while the client was in the unlicensed state is a separate instance of unauthorized practice. The cloud AI scribe vendor's session-by-session archive provides the investigating board with a complete log of those sessions — including sessions the practitioner may have believed were not practice-state sessions if the client did not disclose they had temporarily relocated to another state during the treatment period.

Proceeding 2: compact adverse action notification and multi-state disciplinary chain

The compact data system that records adverse actions against practitioners is the enforcement backbone of both the Social Work Licensure Compact and the Counseling Compact. When a licensing board in any member state takes an adverse action against a practitioner — a reprimand, a probation condition, a suspension, a revocation — the action is reported to the compact data system and is visible to the licensing boards of all other member states where the practitioner holds compact privileges. Each of those states may initiate its own adverse action proceeding based on the reported action, treating the reporting state's adverse action as grounds for reciprocal discipline under their own state licensing statutes.

An adverse action arising from documentation practices — inadequate session notes, informed consent deficiencies documented in the vendor archive, clinical conduct revealed by verbatim session transcripts — creates a chain of compact notifications that exposes the practitioner to discipline in every state where they hold compact privileges. A reprimand in one practice state for documentation deficiencies revealed by the vendor's session archive is not a single-state sanction: it generates notifications to every state in the practitioner's compact network, each of which may open its own investigation and issue its own independent health oversight request to the vendor for the same session records.

The cloud AI scribe vendor archive is the common evidentiary thread each board's investigation follows. A licensing board that accesses the vendor archive reaches not just the finished clinical notes the therapist created, but the verbatim AI-generated transcript of everything that occurred in the session — content that the therapist exercised professional judgment not to document in the finished note because it was not clinically significant or was outside the note's scope. That undocumented session content is in the vendor's transcript, and it is available to each board that issues a health oversight request. An adverse action proceeding that begins with a finished note complaint may expand to include vendor transcript content that broadens the scope of the disciplinary finding in ways the original complaint did not anticipate.

For practitioners holding compact privileges in five or six states, a single practice-state adverse action reported to the compact data system can generate five or six parallel licensing board investigations, each subpoenaing the vendor archive independently under health oversight authority, and each potentially escalating to additional sanctions. The compounding effect is architectural: the compact framework that made multi-state practice possible also made multi-state discipline possible, and the cloud AI scribe vendor archive is the record that feeds each parallel investigation without limit.

Proceeding 3: Medicaid billing audit and OIG investigation

Cross-state telehealth services billed to Medicaid create a federal oversight dimension that the licensure compact framework does not resolve. Medicaid in each state operates under federal oversight through CMS, and Medicaid billing for telehealth services requires that the billing provider hold licensure — or compact-authorized practice privileges — in the state whose Medicaid program is being billed at the time services were rendered. A practitioner who bills a practice state's Medicaid program for telehealth services provided while a compact privilege application was pending, or who bills a state's Medicaid program after compact privileges have lapsed for failure to renew, has submitted claims to a federal healthcare program that do not reflect authorized practice.

Medicaid program integrity units — and, for larger patterns of billing, the HHS Office of Inspector General — have administrative subpoena authority to request records relevant to a billing audit. The OIG's administrative subpoena authority under the Inspector General Act of 1978 extends to any person who may possess relevant information about the audited services. A cloud AI scribe vendor that holds session records from the audited service period is within the scope of OIG subpoena authority. The vendor's timestamped session archive is the independent third-party record that establishes which sessions occurred during which billing periods — a record that exists entirely outside the therapist's control and that the vendor will produce in response to an administrative subpoena under HIPAA's health oversight or law enforcement disclosure pathways.

False Claims Act exposure attaches to knowingly false claims to a federal healthcare program under 31 U.S.C. § 3729(a)(1)(A). A practitioner who billed Medicaid for sessions provided during a compact privilege gap — knowing that privilege activation had not been confirmed before the sessions were conducted — has submitted claims that may not reflect authorized services. The vendor archive is the evidentiary basis for establishing the session volume and timing that demonstrates the billing pattern: session dates from the vendor's archive, compared against compact privilege activation records from the compact data system, provide the auditor with a precise picture of which sessions were billed during authorized versus unauthorized periods. The practitioner's own billing records document the claims; the vendor archive independently documents the session dates that underlie those claims.

Proceeding 4: malpractice claim using unauthorized practice as negligence per se

When a therapist provides telehealth services in a state without proper licensure authorization — whether by practicing before compact privileges activate, by practicing in a non-compact state, or as an MFT without state licensure — the unlicensed status may constitute negligence per se in a subsequent malpractice claim. Negligence per se applies when a defendant's conduct violates a statute designed to protect a class of persons that includes the plaintiff, and the plaintiff's injury is of the type the statute was designed to prevent. State unauthorized practice statutes are designed to protect clients from being served by practitioners whose qualifications the state has not verified; a client who suffers harm in the course of therapy provided by an unlicensed or improperly authorized practitioner may invoke the unauthorized practice violation as per se proof of breach of the standard of care, shifting the burden to the therapist to show causation was broken.

A malpractice plaintiff's attorney who discovers or suspects cross-state licensure irregularities will seek to establish the timeline of unauthorized practice through the most reliable independent record available. The therapist's own session documentation is subject to dispute; the cloud AI scribe vendor archive is the independent third-party record that the plaintiff's attorney can reach through an FRCP Rule 45 subpoena to the vendor. The vendor is typically incorporated and operates in a state different from both the therapist's home state and the practice state — making it a third-party subpoena target for any federal court with nationwide subpoena authority.

A Rule 45 subpoena to the cloud AI scribe vendor may precede the therapist's own deposition. It is a discovery mechanism that operates without the therapist's cooperation and does not require challenging the therapist's own records. The vendor's session archive is the vendor's business records — HIPAA protected health information, but producible under Rule 45 in litigation under § 164.512(e). The therapist's clinical privilege protects the therapist's own records from compelled disclosure through certain mechanisms; it does not protect the vendor's independent business records from civil litigation discovery. As the analysis of AI therapy note subpoenas explains, the vendor archive occupies a distinct legal category from the clinical record that the therapist created — and that category is fully accessible in civil litigation.

Proceeding 5: home-state licensing board reciprocal discipline following adverse action notification

The compact adverse action notification mechanism creates a chain of discipline exposure that extends from the practice state to the home state and to every other compact member state where the practitioner holds privileges. When the practice state's licensing board takes an adverse action against a practitioner — whether for unauthorized practice during a privilege gap, for documentation deficiencies revealed by the vendor archive, or for clinical conduct revealed in verbatim session transcripts — the compact data system notifies every other member state. The home state licensing board receives that notification and must decide whether to initiate reciprocal discipline proceedings under its own licensing statute, treating the practice-state adverse action as the predicate for home-state review.

The home state's investigation is not derivative of the practice state's investigation — it is a new, independent proceeding with its own discovery, its own record requests, and its own independent HIPAA § 164.512(d) health oversight authority over the therapist's practice. The home state board investigating the same therapist for the same underlying sessions will issue its own subpoena or records request to the cloud AI scribe vendor. The vendor, having already produced records to the practice state board in the first investigation, receives a second independent request from the home state board and responds under the same health oversight authority. The result is that the same session archives are produced to two licensing boards conducting independent disciplinary proceedings — without the boards coordinating their discovery, without the therapist having any mechanism to limit the second production on the basis of the first, and without the vendor tracking how many boards have received records of the same sessions.

For a practitioner holding compact privileges in six states, a single practice-state adverse action generates compact notifications to all six. Each board in each state is a potential originator of a reciprocal discipline proceeding. Each proceeding generates its own independent request to the cloud AI scribe vendor. The vendor's session archive is produced in response to each request without limitation — the vendor has no obligation to track whether records are being produced to multiple boards simultaneously or to notify the therapist of each production. The therapist's licensing exposure is multiplied by the number of states in their compact network, and the cloud AI scribe vendor archive is the central evidence source for each multiplied investigation. For the LCSW or LPC who activated compact privileges to expand a telehealth practice and documented those sessions through a cloud AI scribe, the vendor archive is the record that travels wherever the compact's notification mechanism reaches. The PSYPACT analysis for psychologists describes the same multi-board disclosure dynamic under the psychologist-specific interstate compact — the structure is identical for LCSWs and LPCs under their respective compacts, though the specific compact rules and triggering conditions differ.

The compounding effect of multi-state practice

Each additional compact state in a practitioner's privilege network adds a licensing board with HIPAA § 164.512(d) health oversight authority over sessions the therapist conducted in that state. For an LCSW who holds home-state licensure and compact privileges in six practice states, there are seven licensing authorities that can reach the cloud AI scribe vendor's session archives — independently, without coordination, and without any requirement that a board notify the therapist before issuing a health oversight request while an investigation is in its preliminary phase.

The Social Work Licensure Compact and the Counseling Compact were designed to make multi-state practice accessible, and they succeeded: practitioners now regularly maintain compact privileges in multiple states. The documentation practices that served those practitioners in a single-state context — sessions documented through a cloud AI scribe whose vendor holds verbatim session audio and AI-generated transcripts — create a multi-state evidence architecture that the compact framework itself enables. The compact expands practice; the vendor archive expands disclosure exposure proportionally to the number of states in the practice network.

The AI-generated transcript is the particular record that makes the vendor archive valuable to each investigating board in ways that finished clinical notes are not. A state licensing board reviewing a complaint about a therapist's conduct in cross-state telehealth sessions is interested in what occurred during those sessions — not just what the therapist chose to document in the finished clinical note. The vendor's verbatim AI-generated transcript provides that record unfiltered by clinical judgment: it captures client disclosures, therapist responses, the texture of the therapeutic interaction, and anything the therapist said that the client might later characterize as harmful, inappropriate, or reflective of inadequate standard of care. A licensing board that accesses the vendor archive may find session content not reflected in the therapist's finished notes — content the therapist exercised judgment not to document because it was not clinically significant for the treatment purpose. That undocumented content is in the vendor's verbatim transcript, and it is available to each board that issues a health oversight request, in each state, independently. The cross-state HIPAA analysis for telehealth documentation addresses the additional layer of state privacy law variability that compounds the vendor archive exposure in jurisdictions with heightened state mental health record protections — a layer that applies alongside, not instead of, the multi-board disclosure exposure described here.

What on-device processing changes

On-device processing eliminates the multi-jurisdictional vendor archive before any of the five proceedings above can reach it. When a therapist uses TherapyDraft, session audio is captured on the clinician's Mac, transcribed by a locally running Whisper model, and drafted into a clinical note locally — without audio, without AI-generated transcript, and without draft note reaching a cloud AI scribe vendor. There is no vendor archive. There is no centralized session record that any licensing board in any jurisdiction can reach through a HIPAA § 164.512(d) health oversight request.

For cross-state telehealth practitioners under the Social Work Licensure Compact or the Counseling Compact, the absence of a vendor archive simplifies the multi-board exposure in every adversarial proceeding described above. An unauthorized practice investigation in a practice state reaches the therapist's own clinical records — which the therapist controls and which are subject to any applicable state privacy protections the therapist can assert through counsel. A compact adverse action proceeding has the therapist's finished clinical notes as the primary documentary record — notes that reflect the therapist's professional judgment about what to document, not a verbatim AI-generated transcript of everything that occurred unfiltered by clinical discretion. A Medicaid billing audit's session-count evidence is derived from billing records and the therapist's own session documentation, not from an independent vendor archive that the auditor can reach without the therapist's cooperation. A malpractice plaintiff's attorney who serves a Rule 45 subpoena on the vendor receives a response that there are no responsive records — because there is no vendor.

For MFT practitioners navigating cross-state telehealth without compact coverage, on-device processing provides the same elimination of multi-jurisdictional exposure. When the practice-state licensing board investigates unauthorized practice, the only session records accessible through HIPAA § 164.512(d) health oversight are the therapist's own clinical records held in the therapist's practice management system. The board does not have a cloud AI scribe vendor to subpoena for an independent account of which sessions occurred and when, which client was in which state, and what was said during sessions the therapist contests were or were not conducted in the practice state. The therapist's own session documentation is the session documentation.

For LCSW, LPC, and MFT practitioners whose cross-state telehealth practice creates multi-jurisdictional oversight exposure — whether through compact privileges that work as designed or through the absence of compact coverage that creates per-session unauthorized practice exposure — the documentation architecture determines whether that oversight reaches a single record source the therapist controls or a centralized vendor archive that every investigating authority in every jurisdiction can reach independently. There is no BAA provision and no compact rule that closes the gap once the vendor archive exists. On-device processing is the only documentation model that eliminates the archive before the gap opens.