Therapist practice closure and the orphaned cloud AI scribe vendor archive: five adversarial proceedings that reach the archive after the practice is gone

When a solo therapist plans to close their practice, the compliance checklist is well-established. Notice to current clients at least 30 to 90 days in advance, depending on state requirements. A records disposition plan: transferring active clients to new providers, archiving closed files with a compliant medical records storage vendor, allowing clients to request copies, and establishing a process for future records requests from the closed practice. A successor trustee arrangement for the records archive if the therapist is retiring or dying. Coordination with the state licensing board and malpractice carrier. The process is documented in ethics board guidance, state regulations, and professional liability insurance policies.

What is rarely documented in those checklists — because it did not exist in meaningful form until the 2020s — is the cloud AI scribe vendor archive. A therapist who spent the last several years of their practice using a cloud-based AI scribe to transcribe sessions and generate note drafts created, in that process, a separately held record of every documented session: raw audio, transcription output, draft note content, and session metadata, retained by the vendor under the vendor's own HIPAA obligations and business record retention schedule. That archive is not the therapist's clinical file. It is the vendor's records — held independently, under a different custodian, accessible through legal processes directed at the vendor without the therapist's involvement.

When the practice closes, the therapist terminates the business associate agreement, disposes of or transfers clinical files per state law, and stops practicing. The vendor archive does not follow the same closure logic. It persists under the vendor's own retention schedule, orphaned from any active covered entity relationship, and accessible to anyone who knows where to look — which typically means anyone involved in adversarial proceedings touching on the period when the sessions were documented.

What the BAA termination actually does — and does not — accomplish

HIPAA requires that a business associate agreement include provisions governing what happens to protected health information when the BAA is terminated. The standard requirement is that the vendor must return or destroy all PHI received from or created on behalf of the covered entity when the agreement ends, if feasible. If return or destruction is not feasible, the vendor must extend the protections of the BAA to the PHI and limit further use and disclosure to the purposes that make return or destruction infeasible.

The "if feasible" qualifier does significant practical work. Cloud AI scribe vendors hold audio files, transcription outputs, note drafts, and associated metadata in cloud storage architectures where deletion of specific data from all backup and archival tiers is operationally complex. Vendors frequently invoke the infeasibility provision — not necessarily in bad faith, but because their systems are built for data ingestion and retention, not for surgical deletion of one practice's data across all storage tiers on a specific date. The BAA termination obligation tells the vendor to try and, if it cannot, to maintain protections.

The practical result is that a therapist who terminates their cloud AI scribe BAA when closing their practice should not assume that termination produces immediate, complete deletion of the vendor's archive. The vendor's archive may persist for months or years under the vendor's own retention schedule. The structural limits of business associate agreements mean that a signed BAA and a properly executed termination are not the same thing as the data being gone — and the protections the vendor is required to maintain do not prevent disclosure through applicable HIPAA exceptions, including the judicial proceedings exception and the health oversight exception.

Proceeding 1 — malpractice or professional negligence civil litigation

A former client who believes they were harmed by the therapist's conduct during the practice period may file a malpractice or professional negligence action after the practice has closed. The timing creates a distinctive records access structure: the therapist may have properly disposed of clinical records per state retention requirements, the therapist is no longer practicing and may lack institutional support for records management, and the cloud AI scribe vendor is still independently holding session documentation from the period in question.

In civil litigation, the plaintiff's attorney can serve a Rule 45 subpoena on the cloud AI scribe vendor as a non-party in possession of relevant business records. Under HIPAA's judicial proceedings exception at 45 CFR 164.512(e), the vendor may respond to a qualifying subpoena with satisfactory assurances without patient authorization. The therapist is the defendant, not the vendor — the subpoena is directed at the vendor as a separate entity, and the vendor's production obligation runs to the court issuing valid process, not to the therapist who may object to the production.

The malpractice carrier's defense counsel is simultaneously conducting its own investigation. Defense counsel also wants the vendor's session archive — to understand what the sessions showed, to locate documentation supporting the therapist's clinical decision-making, and to identify whether the record contradicts the plaintiff's characterization of what occurred. Defense counsel can reach the same vendor archive through the same judicial proceedings exception. The retired or former therapist has two parties seeking the same vendor archive for opposing purposes in litigation the therapist is a defendant in — with no active practice infrastructure to support managing the records access demands and no advance notice of what the vendor is producing to either party.

This differs structurally from the equivalent scenario for a therapist who never used a cloud AI scribe: that therapist's litigation adversaries reach only the therapist's own clinical records, which are in one place, managed by the therapist or the records archive the therapist established on closure. A cloud AI scribe vendor's archive is a parallel custodian the litigation adversaries can reach independently.

Proceeding 2 — licensing board investigation initiated after retirement

A complaint filed with a state licensing board does not require the therapist to be currently practicing to be investigated. Former clients can file complaints about conduct that occurred years ago. Other therapists, supervisees, or members of the public can file complaints. The board can initiate investigations based on information that comes to its attention through other proceedings. A retired therapist who surrendered their license or simply allowed it to expire is still subject to investigation for conduct that occurred during the license's active period.

The licensing board has health oversight authority under HIPAA 45 CFR 164.512(d). State licensing boards are recognized health oversight agencies, and their investigation activities — including licensure investigations and investigations of potential violations of professional standards — fall within the health oversight exception that permits covered entities and business associates to disclose PHI without patient authorization.

When a licensing board investigates a retired therapist, the board's records request typically goes to the therapist (or former therapist) and to the records custodian responsible for the practice's closed files. A therapist who retained a medical records storage company to hold the closed practice's files has a clear records custodian for the board to reach. But the cloud AI scribe vendor is a separate custodian holding the same sessions at a different level of documentation fidelity — verbatim transcription, draft notes, session audio — that the therapist's clinical file does not reproduce.

The board can issue a health oversight request directly to the vendor, reaching documentation that no longer exists in the therapist's own clinical file. State law may require therapists to retain records only for a defined minimum period — seven years after the last session, ten years in states with longer requirements — after which the therapist (or records custodian) can properly destroy the files. A therapist who properly destroyed records after the required retention period may still have the vendor's archive accessible to a licensing board investigating conduct from that same period, because the vendor's retention schedule and legal obligations are independent of the therapist's records retention decisions.

Proceeding 3 — former client's independent civil litigation where therapy history is relevant

Former clients become parties to civil litigation for reasons unrelated to their therapy: personal injury lawsuits, custody disputes, employment discrimination cases, insurance coverage disputes. In those proceedings, the former client's therapy history during the closed practice period may become relevant evidence — and the opposing party's attorney in that litigation can reach the cloud AI scribe vendor's archive through civil discovery, independently of the closed practice's records disposition arrangements.

In this scenario, the therapist is not a party to the litigation. The opposing party is subpoenaing the vendor to access documentation about the former client's mental health history, functional capacity, statements made during therapy sessions, or treatment progress. The post-termination persistence analysis documents how the vendor archive remains accessible after a clinical relationship ends; practice closure adds the layer that the vendor archive may be the only accessible copy of that documentation — the clinical file having been properly archived, transferred, or destroyed per the practice closure plan.

The former client, who may not know their former therapist used a cloud AI scribe, has no way to consent to or resist the vendor's independent production. The therapist, having closed their practice, receives no notice of the subpoena directed at the vendor. The practice closure plan that seemed comprehensive — proper records disposition, client notifications, records archive establishment — had no mechanism for addressing a separately accessible vendor archive that continues to hold verbatim session documentation for years after closure.

Proceeding 4 — criminal investigation of the closed practice

Criminal investigations of therapists can arise after practice closure: insurance fraud and Medicaid billing fraud investigations, investigations of inappropriate boundary violations or sexual misconduct, HIPAA breach investigations by the Department of Justice, and investigations of healthcare fraud under the False Claims Act. These investigations look at conduct during the practice period, and they use legal tools that reach records held by parties other than the subject of the investigation.

A federal grand jury subpoena or state equivalent, a search warrant, or a civil investigative demand can be directed at the cloud AI scribe vendor for session documentation from the practice period. Criminal subpoena authority does not require a civil litigation framework or a patient's private right of action — it operates through the government's investigative authority, which in healthcare fraud investigations typically encompasses records held by business associates of the subject practice.

In a billing fraud investigation, for example, prosecutors want session documentation to verify whether services billed actually occurred and whether the services rendered matched the billed service codes. The therapist's clinical records — if they were maintained in a manner consistent with the fraud — may not provide useful evidence. The cloud AI scribe vendor's independent archive, which captured what actually happened in sessions regardless of what was entered in the EHR or billed to insurers, is a source of contemporaneous documentation that the billing fraud investigation can reach independently of what the practice's own records show.

The therapist, having closed their practice and potentially believing the investigation risk ended with the practice, may not know the vendor is producing session archives to a grand jury. The data the vendor actually holds — verbatim session transcription, not just the final progress note — is a more granular source than anything in the therapist's own clinical file, particularly when the therapist had reason to document sessions minimally. The orphaned vendor archive is a backstop that criminal investigators can reach independently.

Proceeding 5 — estate administration when the therapist dies in practice

A therapist who dies while still in active practice leaves a records management situation their estate must resolve: active clients who need to be transferred to new providers, clinical records that must be properly archived, licensing board notification, malpractice carrier coordination, and practice dissolution. The ethics board guidance on therapist death covers these obligations in varying levels of detail depending on the jurisdiction.

What the ethics board guidance typically does not address is the cloud AI scribe vendor archive, because it is a relatively recent records category and one that the estate administrator — who is usually a family member, not a HIPAA-trained healthcare administrator — will not know to look for. The estate administrator who is managing the clinical records disposition may not know the practice used a cloud AI scribe, may not know where the vendor's session archive is, and may not know that the BAA needs to be formally terminated to trigger even the limited protections that BAA termination provides.

In the meantime, the vendor archive is being accessed. Former clients' attorneys serving subpoenas for records needed in their clients' own litigation. Licensing board investigators following up on complaints that came in before the therapist's death and are still pending. Successor providers to whom active clients have transferred and who want complete session documentation. These parties may serve process on the vendor directly, accessing documentation from the estate-period sessions without any involvement from the estate administrator, who may be simultaneously trying to understand what the practice's records obligations even are.

The structural problem is that the vendor archive is a parallel records custodian that does not operate through the estate administration framework. The estate administrator's authority extends to the deceased therapist's business records and assets — but the vendor's session archive is the vendor's property, held under the vendor's HIPAA obligations. The estate administrator cannot simply demand the vendor delete the archive, because the vendor has its own retention obligations that the estate administrator cannot unilaterally override. The archive persists as an independently accessible record while the estate is being administered, potentially for years.

The single-custodian structure on-device processing provides

The practice closure risk profile of cloud AI scribe documentation is not primarily about any vendor's bad faith or inadequate data protection practices. It is a structural consequence of having created a second custodian for session documentation. When that custodian is a cloud AI scribe vendor, the vendor has its own legal existence, its own HIPAA obligations, its own retention schedule, and its own production obligations in response to valid legal process. Those attributes do not disappear when the therapist's practice closes.

A therapist who spends a career using on-device AI scribe tools — processing session audio locally on their Mac, generating transcriptions and note drafts without transmitting data to cloud infrastructure — never creates a vendor archive. When they close their practice, there is no separately held, independently accessible record of their sessions that outlasts the clinical records they control. The practice closure records management plan covers everything: the clinical files are the record.

Former clients' attorneys subpoenaing records from the closed practice reach the therapist's own clinical file, held by the records archive the therapist established. A licensing board investigation reaches the same records. A criminal investigation reaches the therapist's own documentation. An estate administrator closing the practice after the therapist's death manages one set of records, not two. There is no orphaned vendor archive sitting in a cloud system, persisting under a vendor's retention obligations, accessible through processes the therapist cannot see and the estate administrator does not know exist.

The practice closure scenario makes visible a documentation risk that operates at lower stakes during active practice but becomes structurally significant at the end of a career or at the end of a practice's life. A BAA provides contractual protections during an active practice relationship. On closure, those protections — contingent on termination provisions and feasibility qualifications — may leave a substantial archive intact. The decision to use on-device processing is, among other things, a decision that closes cleanly: when the practice closes, the documentation risk closes with it.

Further reading

• Can an AI therapy note be subpoenaed? A 2026 legal-risk explainer — how civil and criminal subpoenas reach cloud AI vendors directly as separate custodians, and what the therapist cannot control about the vendor's response to process directed at the vendor
• What is a BAA, actually — and what it does NOT cover — the structural limits of business associate agreements, including what the BAA termination provisions actually require versus what most therapists assume they require
• The 7 things Mentalyc, Upheal, and Blueprint actually send to their servers — the data-flow analysis documenting what the vendor actually holds and retains: raw audio, transcription output, draft note content, and session metadata — the full scope of what becomes an orphaned archive on practice closure
• Post-termination therapy and the cloud AI scribe vendor archive — how the vendor archive persists after an individual clinical relationship ends; practice closure extends this to the entire practice's session archive simultaneously
• Therapy platform acquisitions, asset sales, and bankruptcy — what happens when the vendor entity changes hands; the related but distinct scenario from practice closure, where it is the therapist's practice that closes rather than the vendor

This post is educational commentary, not legal, clinical, regulatory, or compliance advice. HIPAA BAA termination requirements, state records retention laws, ethics board guidance on practice closure, and the legal processes that reach cloud AI scribe vendor archives vary by jurisdiction and specific context. The feasibility of PHI destruction on BAA termination is a fact-specific question that turns on the specific vendor's systems and BAA terms. Criminal subpoena authority and its application to healthcare business associates involves statutory and procedural considerations not fully addressed here. Estate administration of a deceased therapist's practice, including HIPAA obligations and vendor archive management, involves both HIPAA and state probate law. The analysis in this post is intended to illustrate structural exposure categories for therapists approaching practice closure, not to characterize the outcome of any specific proceeding. Consult a licensed healthcare attorney and your professional liability carrier before making documentation or technology decisions for a practice approaching closure or transition.