AI scribe data retention: audio, transcripts, and notes
HIPAA sets no retention period for session audio, and session audio is not your clinical record. The signed note is the record, and state law usually says to keep it for seven to ten years. Audio recorded so an AI scribe can draft that note is a working file, and the best practice is to delete it once the note is finalized. When you delete any protected health information, HIPAA requires policies and procedures that ensure the PHI is rendered unreadable, indecipherable, and unable to be reconstructed, not just moved to a trash folder.
This guide covers the four separate retention clocks an AI scribe creates, what HIPAA requires for deletion, and a retention policy guide, all written for therapists and practice owners in 2026.
The short version
Retention obligations attach to the signed note, not the audio. An AI scribe creates four clocks: audio (delete once the note is final), transcript (your call, but it is PHI), the note (state law, commonly 7 to 10 years), and compliance records (6 years, HIPAA's only fixed retention rule).
Secure deletion means the data cannot be recovered. Deleting a file does not meet the standard; overwriting, purging, or destroying the media does.
Whether a scribe deletes audio by default matters more than whether deletion is possible.
Upheal deletes session audio by default once notes are generated and keeps no copies of what you delete.
How long should a practice retain session audio, and what does HIPAA require for secure deletion?
The best practice is to retain session audio only until the clinical note drawn from it is reviewed and signed, then delete it securely. You should then retain the signed note for the time required under your local state laws. The HIPAA Privacy Rule does not require covered entities to keep medical records for any particular period, and record retention is governed by state law. Read it at HHS, Does HIPAA require covered entities to keep medical records for any period?
Providers should remember that audio is not the clinical record. Your clinical record is the signed progress note. The audio is the source material the scribe used to draft it, and once the note is signed the audio has done its job. State retention law attaches to the record, and keeping audio for seven years alongside it does not make you more compliant. It means you are holding years of the most sensitive PHI you have, with no clinical or legal reason to, and every retained recording is something you must protect, produce on request, and eventually destroy.
An AI scribe creates four distinct retention clocks, and each has a different owner:
| What it is | Who sets the period | Defensible default |
|---|---|---|
| Session audio | You, within your vendor's options | Delete once the note is reviewed and signed |
| Session transcript | You, within your vendor's options | Delete once the note is final, unless you use features that need it |
| The signed clinical note | State law and your licensing board | Commonly 7 to 10 years for adults, longer for minors |
| Compliance documentation (policies, consents, BAAs, audit logs) | HIPAA, 45 CFR 164.316(b)(2)(i) and 45 CFR 164.530(j)(2) | 6 years from creation or last effective date |
The six year HIPAA rule is the one clinicians most often misapply. This rule covers the paperwork that proves you follow HIPAA, such as your policies, your signed BAAs, and your risk assessments. It does not cover the clinical record or audio.
Does an AI therapy scribe delete audio?
Some AI scribes delete session audio by default once the note is generated, some retain it until you delete it, and some never store audio at all because they transcribe in real time. The default is what matters. A vendor that can delete audio on request has left the decision, and the exposure, with you. A vendor that deletes by default has made the safe choice the one you get without thinking about it.
Before continuing with an AI scribe you should ask three questions:
- Is audio deleted automatically once the note is generated, or only when I delete it? The answer should be written in the vendor's privacy documentation or FAQ, and not only mentioned verbally in a sales conversation.
- If I choose to keep audio, what governs it? Keeping a recording for supervision or clinical review is a legitimate choice, but it may require the client's explicit consent and notice under state recording law and your professional ethics code. It should be your decision per session, not the vendor's default. "Possible future use" is not a clinical purpose.
- Is the transcript deleted with the audio, or separately? A transcript is PHI in text form and outlives the audio unless you address it. See the section on transcripts below.
Upheal deletes session audio by default once your notes are generated. A clinician who wants to keep a recording for supervision or clinical purposes can, but only with the client's explicit consent. For the broader picture of how note tools handle data, see our guide to the privacy of AI notetakers.
What HIPAA actually requires when you delete PHI
HIPAA requires that disposed PHI be rendered unreadable, indecipherable, and unable to be reconstructed, and it requires your practice to have written policies for how that happens. The specific rules are in the Security Rule's device and media controls at 45 CFR 164.310(d)(2), which require policies for the final disposition of electronic PHI and for removing it from media before reuse. HHS's guidance on disposal spells out the standard and gives examples for electronic media: clearing by overwriting, purging by degaussing, or destroying the media. Read it at HHS, What do the HIPAA Privacy and Security Rules require when disposing of PHI?
For a practice using an AI scribe:
- Deleting a file is not disposal. Moving audio to a trash folder or emptying a recycle bin leaves recoverable data. The standard is that it cannot be reconstructed.
- Your vendor does the deletion, under your BAA. For cloud stored PHI, the vendor is the business associate performing disposal on your behalf, so a BAA needs to cover it. Our HIPAA BAA checklist for an AI therapy scribe covers what that agreement should say. The vendor's documentation should say what deletion actually does to the data.
- A legal hold overrides the schedule. If a record is subject to a subpoena, court order, or active complaint, pause deletion for that client until it is resolved.
- HIPAA does not mandate one technology. It requires a reasonable method for the sensitivity of the data, documented in your policy. A written policy that names what gets deleted, when, and how is recommended. It is the compliance artifact, and it falls under the six year documentation rule.
Transcripts are the retention decision most practices skip
Providers sometimes don't make a data retention decision on the session transcript, because attention goes to the audio. A transcript is the entire session in text: every disclosure, every name, every detail about third parties. It is PHI, it persists after the audio is gone, and unless you decide otherwise it could sit in the vendor's system indefinitely.
There is a real tradeoff. Transcripts power useful things: regenerating a note in a different format, drafting a treatment plan from the session, producing a post session summary for the client, pulling exact quotes into a note. Delete the transcript and those features are gone for that session. Keep it and you hold a verbatim record you are responsible for.
The defensible position is a practice level rule rather than a per session decision. Decide whether you use transcript dependent features. If you do not, set transcripts to delete automatically once the note is generated. If you do, set a fixed window, use the features inside it, and let the transcript go after. Either way, write the choice down, because a documented policy is what HIPAA asks for. For a worked example of one vendor's transcript retention terms, see what SimplePractice's Note Taker does with your session transcripts.
Two smaller layers ride along with the transcript. A draft note that is never signed is still PHI, so abandoned drafts, duplicates, and drafts generated against the wrong client should be deleted rather than left in place. And in a group practice, transcript access should follow the role: a scheduler or biller needs the calendar or the claim, not the session text.
What state law says about the note itself
State law and your licensing board set the retention period for the signed note. Most fall between seven and ten years for adult clients, with longer periods for minors that typically run until several years after the client reaches adulthood. The APA's Record Keeping Guidelines recommend retaining complete records for seven years after the last contact with an adult client, or until three years after a minor reaches majority, whichever is later, as a baseline where state law is less specific.
This is the one clock the AI scribe does not change. The note the scribe drafted is your record once you sign it, and it is retained under the same rule as a note you typed yourself. Your vendor's role is to store it securely for as long as you decide and to return or destroy it when you leave, which is why a BAA should say that the practice, not the vendor, determines the PHI retention period.
An AI scribe data retention policy you can write in ten minutes
A written retention policy is the compliance document HIPAA expects, and it does not need to be long. Adapt the one below: replace the bracketed items and have it reviewed for your state.
AI documentation retention policy, [Practice name]
Session audio. Audio captured for AI assisted documentation is [deleted automatically once the clinical note is generated / retained for X days after the note is signed, then deleted]. Audio is retained beyond that point only with the client's explicit written consent and for a documented clinical or supervisory purpose.
Session transcripts. Transcripts are [deleted automatically once the clinical note is generated / retained for X days to allow note regeneration and treatment planning, then deleted].
Clinical notes. Signed clinical notes are retained for [X years] after the last date of service for adult clients, and until [X years after the client reaches age 18] for minors, per [state] law and [licensing board] requirements.
Compliance documentation. Consent forms, this policy, the vendor Business Associate Agreement, and related records are retained for six years per 45 CFR 164.316.
Deletion method. Deletion is performed by [vendor name] under the Business Associate Agreement dated [date], which requires PHI to be returned or destroyed at the practice's direction and rendered unable to be reconstructed. Local copies, if any, are destroyed by [method].
Legal holds. Scheduled deletion is paused for any record subject to a subpoena, court order, active complaint, or litigation hold until the matter is resolved.
Vendor termination. On ending the vendor relationship, the practice will export clinical records in [format] and direct the vendor to [return / destroy] all remaining PHI, including copies held by subprocessors.
Reviewed by: ____________ Date: ________ Next review: ________
Make sure to test the policy using nonclinical content and a fictional client, before a real session touches the tool:
- Record through every capture method you plan to use, generate a note, and sign it.
- Confirm the audio is gone once the note exists, and confirm what "gone" means with your AI scribe vendor.
- Trigger manual and automatic transcript deletion and check the recovery window, if any.
- Export the signed note and confirm the format is usable outside the platform.
- Ask what persists in backups and logs, and record the answer with the test date.
How Upheal handles retention
Upheal, an AI-native EHR and note-taking platform for mental health clinicians, is built so that the defensible defaults above are the defaults you get. As of September 2026:
- Session audio is deleted by default once your notes are generated. If you want to keep a recording for supervision or clinical purposes, that is possible, but only with the client's explicit consent.
- Transcripts and whole sessions can be deleted manually or set to delete automatically after a timeframe you choose, for your whole practice at once. Automatic deletion applies to past sessions as well as future ones, and data deleted automatically is recoverable for a four day grace period before it is permanently removed. Manual deletion is immediate and cannot be undone. Details are in Upheal's guide to automatic deletion.
- One limitation to know: without the transcript, that session cannot be reprocessed into a different note type, used to generate a treatment plan, or summarized for the client. Set your deletion window with that in mind.
- Upheal does not use session data to train AI unless you and your client both choose it. Where both consent, the de-identified transcript is kept for the duration of the service and one year after it was first entered, and de-identified derived datasets for five years. Consent can be withdrawn at any time, at which point the data is deleted. Re-identification codes are kept in a separate repository and used only to delete de-identified data on request.
- Under Upheal's Business Associate Agreement, the customer determines the retention period for PHI, and on termination PHI is returned or destroyed at the customer's choice, including copies held by subcontractors. HIPAA log files older than six years are deleted by default unless you tell Upheal you need them longer.
- Conversations with the Upheal Assistant are deleted after seven days of inactivity. They follow their own rule and are not session transcripts, so do not confuse the two when writing your policy.
- Deleting your Upheal account deletes the client data in it and Upheal keeps no copy, so export your records first.
- Upheal is HIPAA, PHIPA, PIPEDA, GDPR, and DPA compliant, has completed a SOC 2 Type II audit, and is continuously externally tested.
Upheal's own support documentation puts the principle plainly: "Upheal does not keep copies of your data; what we store is always up to you." The mechanics behind that, including de-identification and subprocessor handling, are on Upheal's privacy and compliance page.
If you want retention defaults you do not have to build yourself, try Upheal free.
Frequently asked questions
Does an AI therapy scribe delete audio?
Some do by default, some only on request, and some never store audio at all. The default is what matters, because a vendor that can delete on request has left the exposure with you. Upheal deletes session audio by default once your notes are generated.
Does the AI note-taking tool my therapist uses keep recordings of our sessions?
It depends on the tool and on your therapist's settings, and you have the right to ask. Well designed tools delete the recording once the note is written and keep only the note as part of your record. Your therapist's consent form should say what is captured and how long it is kept.
How long does HIPAA require me to keep therapy records?
HIPAA sets no retention period for clinical records; state law does, and most states require seven to ten years for adults. HIPAA's six year rule applies only to compliance documentation such as policies, consents, and business associate agreements.
Is deleting a file enough to satisfy HIPAA?
No, HIPAA requires disposed PHI to be unreadable, indecipherable, and unable to be reconstructed. Moving a file to trash leaves it recoverable. Overwriting, purging, or destroying the storage media meets the standard, and your written policy should say which method applies.
Should I keep session transcripts?
Only if you use features that need them, and then for a fixed window. A transcript is the whole session in text and persists after the audio is gone. If you do not regenerate notes or draft treatment plans from transcripts, set them to delete automatically once the note is generated.
What happens to my session data if I stop using an AI scribe?
Under a proper BAA, the vendor returns or destroys your PHI at your direction, including copies held by subprocessors. Export your clinical records first, since deletion cannot be undone. Test the export with fictional data before you rely on it.
The bottom line
The question behind "how long should I keep session audio" is usually "am I compliant." Keeping audio longer does not make you more compliant. It makes you responsible for more PHI than you need. Keep the note for as long as your state requires, keep your compliance paperwork for six years, and let the audio and, in most cases, the transcript go as soon as the note is signed. Also write the data retention policy down, because the written policy is the part HIPAA calls for.
Upheal is built with compliance by design: session audio is deleted by default, and you get the controls to change retention settings practice wide. Start free, no credit card required.
Last updated September 24, 2026. The retention policy on this page is a sample and not legal advice.
