WPATH mental health letters, gender-affirming care assessments, and cloud AI scribes: the vendor archive state AGs, custody courts, and licensing boards can reach

WPATH mental health assessments as a distinct clinical documentation context

Mental health professionals who conduct gender-affirming care assessments are doing something categorically different from ordinary therapy: they are generating a diagnostic record with direct legal and medical consequences. The formal product of the assessment — a WPATH Standards of Care 8 letter of support for hormone therapy, puberty-suppressing medication, or surgical care — is a structured clinical document. But the assessment sessions that produce the letter capture far more than the letter itself contains.

WPATH SOC 8 (September 2022) provides the clinical framework for these assessments. For gender-affirming surgical interventions, SOC 8 Chapter 12 specifies that a qualified mental health professional assessment addressing gender incongruence, any relevant mental health history, and capacity for informed consent supports optimal care. For gender-affirming hormone therapy, SOC 8 and its associated guidance acknowledges that an informed consent model can be appropriate in many adult cases, but many clinicians, and many surgical referral requirements, continue to require a formal mental health letter. In practice, mental health assessment letters remain standard in a wide range of gender-affirming care contexts — particularly for surgical referrals, for minors requiring parental consent or court authorization, and for patients in systems that require documented clinical review before proceeding.

The assessment sessions themselves are comprehensive. A clinician conducting a WPATH assessment may conduct multiple sessions covering gender history from childhood through the present, DSM-5-TR diagnostic criteria for gender dysphoria (302.85 in adults, 302.6 in children), co-occurring mental health conditions and their current management status, substance use history and current status, social transition status (name, pronouns, social relationships), family and relationship dynamics including support or opposition from family members, medical history relevant to gender-affirming care, employment and financial circumstances that may affect care access or stability, prior attempts at accessing gender-affirming care, any history of trauma that intersects with gender identity, and the clinician's assessment of decisional capacity for the specific procedure being considered. For surgical referrals, the assessment may also address the patient's realistic expectations of surgical outcomes and their understanding of irreversibility where applicable.

The formal WPATH letter synthesizes this assessment into a structured clinical document, typically one to three pages. What it contains is a fraction of what was said in the sessions that produced it. A cloud AI scribe processes the full assessment sessions. For an analysis of what cloud AI scribes technically transmit and retain, see our post on what cloud AI scribes actually send to servers. In a WPATH assessment context, the gap between the letter and the session content is particularly significant because of what that content reveals — and what legal proceedings in 2026 want to reach.

What cloud AI scribes capture in WPATH assessment sessions that the formal letter does not

The formal WPATH letter produced by a mental health assessment is a carefully constructed clinical document. It addresses the criteria it needs to address and omits what is not clinically necessary for the referral decision. The verbatim session content that generated the letter is comprehensive in ways the letter is not designed to be.

Full gender history with granular chronology. Assessment sessions typically elicit a complete narrative of the patient's gender experience — childhood cross-gender feelings and behaviors, adolescent identity development, first awareness of gender dysphoria, prior attempts to suppress or reconcile gender incongruence, timeline of social transition steps, current name and pronoun use across different contexts (family, workplace, medical, social), and any prior gender-affirming care including hormone use or prior surgical procedures. The formal letter may note that the patient has a longstanding history of gender incongruence. The session archive contains the patient's complete verbatim account of that history, with names, places, dates, and relationships.

Mental health and psychiatric history in full diagnostic depth. WPATH assessments require the clinician to evaluate co-occurring mental health conditions and assess their status with respect to the planned care. Assessment sessions explore prior psychiatric diagnoses, hospitalization history, current psychiatric medications, prior treatment history including any prior therapists or prescribers, suicidality history and current safety, trauma history, dissociation, personality structure, and any substance use history. The formal letter may note that co-occurring conditions are stable or that relevant history has been reviewed. The session archive contains the patient's verbatim account of their psychiatric history and trauma narrative — content that, in many circumstances, would qualify as psychotherapy notes if held in the therapist's own records, but that the cloud scribe vendor holds as its commercial business records.

Family dynamics and relationship context. Assessment sessions often explore whether the patient has support from family members, partners, or significant others. This exploration can reveal family members by name, family opposition to the care being considered, family circumstances that may create safety concerns, relationship status and stability, and the patient's social network. In cases involving minors, parental support or opposition is central to the assessment. The formal letter may note the degree of social support available; the session archive contains verbatim discussion of specific family dynamics, relationships, and conflicts.

Capacity assessment and informed consent discussion. The clinician's capacity assessment — including the patient's understanding of the specific procedure, its risks, its benefits, and its irreversibility where applicable — is discussed in session as an interactive exchange. The formal letter states the clinician's conclusions. The session archive contains the verbatim discussion through which the clinician reached those conclusions, including the patient's specific statements about their understanding of what they are consenting to. This verbatim exchange is particularly significant in proceedings where the adequacy of the informed consent process is at issue.

Discussion of accessing care across state lines or internationally. Patients in states where gender-affirming care has been restricted or criminalized often discuss in assessment sessions how they are accessing care — travel to other states, telehealth from providers in more permissive jurisdictions, or plans to seek care outside the US. These discussions occur in the verbatim session archive. For patients in states where certain care has been criminalized, or for parents helping minors access care across state lines, this content in the vendor archive has direct implications for criminal investigations.

The WPATH SOC 8 framework and what it does not govern

WPATH Standards of Care 8 sets the clinical framework for gender-affirming care assessments. It specifies the professional qualifications required of assessing clinicians, the domains that should be addressed in a mental health evaluation, and the content that a letter of support for medical gender-affirming care should address. WPATH SOC 8 is a clinical standards document. It governs clinician professional practice in conducting the assessment. It does not address what happens to the session content when a cloud AI scribe processes the sessions.

State licensing boards — the clinical social work board, the professional counseling board, the marriage and family therapy board, the psychology licensing board — govern the mental health professional's conduct in their jurisdiction. Licensing board regulations address professional competence, scope of practice, informed consent obligations, record-keeping requirements, and professional conduct in general. They do not address cloud AI scribe vendor data retention or the accessibility of vendor business records through legal process.

A HIPAA business associate agreement between the therapist's practice and the cloud AI scribe vendor is required when the vendor handles protected health information on the covered entity's behalf. The BAA obligates the vendor to implement appropriate safeguards and to notify the covered entity of breaches. For a detailed analysis of what a BAA does and does not protect, see our post on what is a BAA and what it doesn't cover. Critically: the BAA does not prevent the vendor from complying with lawful legal process. HIPAA expressly authorizes covered entities and business associates to disclose protected health information in response to lawful legal process under 45 CFR 164.512(e) (judicial and administrative proceedings) and 45 CFR 164.512(f) (law enforcement). When a state attorney general or a family court issues process directed at the cloud AI scribe vendor, the BAA does not prevent the vendor from producing its records. The vendor is required to notify the covered entity (the therapist) if legally permissible to do so before producing records, but notification is not prevention.

The result is a structural gap in the governance framework: WPATH SOC 8 governs the clinician's assessment practice, state licensing boards govern the clinician's professional conduct, and HIPAA governs the covered entity's information practices and the vendor's obligations as a business associate — but none of these frameworks prevent the vendor from complying with legal process directed at the vendor's own records. The vendor's verbatim archive of a WPATH assessment session is the vendor's commercial business records, separately accessible through legal process the therapist cannot control.

Five adversarial proceedings that reach the WPATH assessment vendor archive

State attorney general criminal investigations of gender-affirming care providers

As of 2026, multiple states have enacted legislation restricting or criminalizing gender-affirming care — including in some states gender-affirming surgical care for adults, and in a broader set of states gender-affirming care for minors. State attorney general offices in several jurisdictions have opened investigations of gender-affirming care providers, including mental health professionals who wrote letters of support for care that is alleged to constitute a criminal violation under the state's statute.

A state AG criminal investigation has access to substantial investigative legal process. Grand jury subpoenas are available under state grand jury rules and can compel production of business records from third parties. State administrative subpoenas under state health code enforcement provisions are available for regulatory investigations. Out-of-state vendors can be reached through state court process or, in federal investigations, through federal grand jury subpoenas under 28 U.S.C. § 1783 and related authority. HIPAA authorizes vendor compliance with law enforcement process under 45 CFR 164.512(f) when accompanied by appropriate legal requirements.

The therapist's own clinical records — WPATH letters, assessment notes, and clinical records held in the covered entity's records system — are subject to the therapist's HIPAA-governed access decisions and any applicable legal privileges. The vendor's separately held verbatim session archives are the vendor's commercial business records. A grand jury subpoena or state administrative subpoena directed at the vendor reaches those records independently. The therapist may not be a party to that subpoena process, may receive no advance notice, and has limited legal standing to contest a subpoena for a third party's own business records.

Custody proceedings involving a transgender minor

When a therapist conducts a WPATH assessment for a transgender minor — whether supporting puberty-suppressing medication, cross-sex hormone therapy, or surgical care — and one parent opposes the care in a custody proceeding, the vendor archive becomes a contested discovery target. The parent opposing care, through their attorney, can issue a Rule 45 subpoena in the custody proceeding to the cloud AI scribe vendor seeking all session records processed by the vendor related to the minor. The Rule 45 subpoena is directed at the vendor as a third-party business record custodian, not at the therapist.

The vendor's archive of the WPATH assessment sessions contains the full verbatim content of every session — the minor's complete gender history, the family dynamics discussion (including the opposing parent's characterization in the minor's own words), the capacity assessment, and any discussion of how the minor and their supportive parent have been navigating the legal and medical landscape. This content is not in the formal WPATH letter, which addresses the clinical criteria and the clinician's professional assessment. The vendor's verbatim archive contains what was said in session, in full.

The minor's HIPAA rights run against the covered entity — the therapist or practice. They do not give the minor control over what the vendor independently retains or produces in response to legal process directed at the vendor. Whether the minor's therapist-patient privilege extends to bar the vendor's production of its own business records is a legal question with no settled answer in most jurisdictions, and is not a safe assumption. For a broader analysis of how therapy records intersect with custody proceedings, see our post on family therapy records and custody proceedings.

Insurance prior authorization review and fraud investigation

Gender-affirming care — particularly gender-affirming surgical care — often involves insurance prior authorization processes. Insurers in states that cover gender-affirming care may request clinical documentation including the WPATH assessment letter, diagnostic records, and treatment history. In routine prior authorization review, this process involves the formal records the therapist provides. Where an insurer initiates a fraud investigation or a retroactive review of prior authorization decisions, the investigative process may be broader.

Insurance company special investigations units (SIUs) conducting healthcare fraud investigations have access to civil subpoena authority in state court proceedings and can reach third-party business records. An insurer alleging fraudulent misrepresentation in a WPATH letter — for example, that the formal letter contained conclusions not supported by the clinical assessment, or that the therapist's qualifications were misrepresented — might seek the vendor's verbatim archive of the assessment sessions as evidence of what was actually discussed compared to what the formal letter states. The vendor's archive as a comparison document against the formal letter is a pattern that appears in licensing board investigations as well, as discussed below.

Even in non-fraud contexts, insurer review of gender-affirming care decisions has been contested in some jurisdictions, and the scope of insurer discovery rights in administrative appeals and civil litigation over coverage denials has expanded. A cloud AI scribe vendor's archive of an assessment session may become relevant to coverage disputes in ways that the formal WPATH letter alone would not create.

State licensing board investigations

State licensing boards — clinical social work, professional counseling, marriage and family therapy, and psychology boards — have administrative subpoena authority under HIPAA's health oversight exception at 45 CFR 164.512(d). When a licensing board investigation reaches a mental health professional who wrote WPATH assessment letters, the board's investigative process can extend to the cloud AI scribe vendor's records through administrative subpoena authority directed at the vendor as a holder of health-related records.

Licensing board complaints involving WPATH assessments can come from multiple sources: a parent who objected to a minor's gender-affirming care and alleged the therapist was not qualified to conduct the assessment; a patient who received care and later disputes the therapist's assessment; a medical provider who believes the letter did not accurately reflect the clinical assessment; or in states where certain care has been restricted, a complainant alleging the letter facilitated care that violates state law. For a broader analysis of licensing board investigative process and cloud AI scribe vendor archives, see our post on licensing board complaints and AI scribe records.

The board's access to the vendor's verbatim archive creates a comparison document: what the formal WPATH letter stated versus what was actually discussed in the assessment sessions in full verbatim detail. This comparison is precisely what licensing boards use to evaluate whether a clinical assessment was conducted competently and whether the formal record accurately represents the clinical process. When the vendor's session archive contradicts or reveals nuance absent from the formal letter, the board's investigative picture of the assessment is materially different than if the board reviewed the formal letter alone.

Civil rights litigation — bidirectional exposure

Civil rights litigation involving gender-affirming care creates bidirectional exposure for the WPATH assessment vendor archive. Transgender individuals asserting discrimination claims — in employment, in healthcare access, in housing — may use their own therapy and assessment records as evidence of the harm they experienced, including records of the period during which they were seeking access to gender-affirming care. In these cases, the patient may seek to introduce evidence from their own treatment history, and the defendant's discovery process may seek the vendor's archive to examine that history in full.

In the opposing direction, states and private parties challenging gender-affirming care providers have brought civil litigation in multiple jurisdictions, seeking declaratory or injunctive relief regarding specific care practices. These civil proceedings can involve civil discovery — Rule 45 subpoenas, civil investigative demands, and state-law discovery mechanisms — that reach third-party business records including cloud AI scribe vendor archives. A provider sued under a state gender-affirming care restriction act may find that their vendor's archive is subpoenable by the plaintiff in that civil proceeding.

The formal WPATH letter produced by the assessment is one document; the vendor's verbatim archive of the assessment sessions is another body of records, held by a third party, that can be independently subpoenaed in civil discovery without going through the therapist. For a foundational analysis of why therapy notes are subpoenable, see our post on can an AI therapy note be subpoenaed.

On-device processing and the WPATH assessment context

On-device processing eliminates the vendor archive entirely. When a mental health professional conducts a WPATH assessment using an on-device AI scribe — audio processed locally on the clinician's device, no session content transmitted to or retained by a commercial vendor — the legal proceedings described above find nothing at the vendor. A grand jury subpoena to the cloud AI scribe vendor produces no records because the vendor holds no records. A Rule 45 subpoena in a custody proceeding produces nothing from the vendor because there is nothing to produce. A licensing board administrative subpoena directed at the vendor reaches nothing.

The therapist's own clinical records — the WPATH assessment letter, the clinical notes documenting the assessment process, and any psychotherapy notes the therapist maintains separately — remain the sole documentation of session content. Those records remain subject to the therapist's HIPAA-governed records management, applicable legal privileges, and the therapist's ability to respond to and contest legal process directed at the therapist's own records. The patient's HIPAA rights, including the right to restrict disclosures and to assert applicable privileges, run in their normal way against the covered entity. There is no separately held third-party archive that bypasses those protections.

On-device processing does not affect the clinical quality of the WPATH assessment or the formal letter. The clinician's ability to generate a comprehensive letter that addresses WPATH SOC 8 criteria, documents diagnostic reasoning, and provides the clinical information needed by the receiving provider or surgeon is unchanged. What changes is the documentation architecture: instead of two bodies of records — the therapist's formal records and the vendor's verbatim commercial archive — there is one, held by the covered entity, subject to the governance framework that applies to covered entities and that patients have the rights against.

Practical implications for mental health professionals conducting WPATH assessments

Mental health professionals conducting WPATH assessments in 2026 are working in a legal environment that did not exist in 2022 when SOC 8 was published. The convergence of state-level criminal restrictions on gender-affirming care, active AG investigations, contested custody proceedings involving transgender minors, and ongoing civil rights litigation means that the documentation generated in WPATH assessment sessions has legal exposure in multiple adversarial directions simultaneously.

Informed consent for WPATH assessments must address AI scribe use specifically. Standard informed consent for therapy addresses what the therapist does with records. Patients seeking WPATH assessments are often acutely aware of the legal landscape for gender-affirming care and have made careful decisions about what they discuss and with whom. Disclosure that a cloud AI scribe creates a separately held verbatim archive at a commercial vendor — an archive the patient has no HIPAA rights against and that is reachable through legal process the patient cannot control — is material to the patient's decision about how to engage in the assessment. Informed consent forms written for a general therapy population were not designed to address this architecture.

Minor assessments require heightened consideration. When the patient is a minor seeking gender-affirming care, the custody and family dynamics that often surround that care create a specific adversarial risk profile. A parent who opposes the care has incentive and legal tools to reach all available records — including vendor archives. The minor's own therapeutic disclosures about family dynamics, the opposing parent, and how they and their supportive parent are navigating the legal and medical system can be particularly sensitive.

The state legal landscape for cross-border care access requires documentation care. Patients who are accessing gender-affirming care across state lines, or who discuss plans to do so in assessment sessions, are generating session content that may be relevant to criminal investigations in states where that care is restricted. The formal WPATH letter would not typically document the specifics of cross-border care access discussions. The verbatim vendor archive would.

WPATH SOC 8 and licensing board guidance have not addressed this gap. As of 2026, WPATH SOC 8 and its associated guidance do not address cloud AI scribe use in gender-affirming care assessments. State licensing board regulations addressing gender-affirming care assessment competency requirements similarly do not address vendor data practices. Mental health professionals are working in a guidance gap that their professional frameworks have not yet closed. The practical implication is that clinicians conducting WPATH assessments are making documentation technology choices — including cloud AI scribe adoption — without any professional guidance framework that addresses the specific legal exposure those choices create in 2026.

Conclusion

WPATH mental health assessment sessions for gender-affirming care generate some of the most legally sensitive documentation produced in mental health practice in 2026. The formal letter produced by the assessment is a structured clinical document. The verbatim session content that generated it — gender history, psychiatric history, family dynamics, capacity assessment, cross-border care discussions — is retained by cloud AI scribe vendors as independently subpoenable commercial business records.

Five adversarial proceedings can reach that vendor archive through legal process that does not require going through the therapist and that a HIPAA business associate agreement cannot prevent: state AG criminal investigations of gender-affirming care providers, custody proceedings where a parent opposes a minor's care, insurance fraud reviews, licensing board administrative subpoenas, and civil rights litigation in both directions. WPATH SOC 8 guidance, state licensing regulations, and standard informed consent frameworks were not designed for this legal landscape and do not address the vendor archive problem.

On-device processing eliminates the vendor archive. It restores a single-record architecture in which the therapist's own clinical records — subject to HIPAA governance, legal privileges, and the patient's HIPAA rights — are the sole documentation of what happened in the assessment sessions. For gender-affirming care assessments in 2026, that architecture is not merely a privacy preference. It is a clinical documentation decision with direct legal consequences for both the therapist and the patient.