42 CFR Part 2 Records, an AI Scribe, and a Box in the Closet: Running the Model Inside Your SUD Clinic

Where does the audio of Tuesday's 10 a.m. session physically go?

Ask that in a room of practice owners and you get a pause. Somebody says the scribe vendor is HIPAA compliant. Somebody else says there is a business associate agreement on file. Both may be true and neither answers the question, which is a question about geography: a client with an opioid use disorder diagnosis said something out loud in a room in your building, a microphone turned it into a file, and that file left the building over the internet to a server you cannot point to on a map. If your program is federally assisted and treats substance use disorder, that file is not ordinary protected health information. It is a 42 CFR Part 2 record, and Part 2 has never cared how convenient your software is.

The three kinds of material in a behavioral health practice that are supposed to stay put

First, Part 2 records. Substance use disorder treatment information carries consent and redisclosure rules stricter than HIPAA, and the 2024 alignment rule tightened rather than loosened the paperwork around who may receive what. Every downstream party that touches those records inherits obligations, and "the vendor processes it briefly and does not retain it" is a sentence you want in a signed agreement, not in a sales deck.

Second, psychological test materials. If your practice does testing — the MMPI-3, the WAIS or WISC, the Conners, continuous performance measures — the publisher agreements you signed to buy those kits restrict disclosure of item content and raw protocol data, and your state board's ethics rules back that up. Uploading a scanned protocol with the items visible to a general-purpose cloud service is a problem that has nothing to do with HIPAA and everything to do with the contract in your filing cabinet.

Third, the contracts nobody reads until renewal: county behavioral health contracts, school district agreements for on-site counseling, and EAP contracts with self-insured employers. These routinely contain data-handling clauses stricter than federal law — specific storage locations, subcontractor notification, sometimes a flat prohibition on transmitting recordings outside named systems. Your clinical director signed it in 2023 and it is still binding in 2026.

What actually changed in 2026

Running AI locally means the model sits on hardware you own, inside your building, so the session audio, the chart and the test protocol are processed without ever crossing your network boundary. That was possible before and it was miserable — slow, expensive, and noticeably worse than the cloud version. Two things moved in 2026. On-device and on-premises processing matured, with Qualcomm's Dragonwing-class processors making local work practical on ordinary hardware rather than a rack of servers. And large organisations stopped treating on-premises as the legacy option: Cisco, rolling a personal AI agent out to roughly 90,000 employees, has explicitly emphasised on-premises handling for control and data protection.

The cost picture flipped too. For high-volume, repetitive work — and a practice that records 900 sessions a month is high volume — running locally comes in around 90% cheaper than sending each one to the cloud, because you paid for the box once.

flowchart LR
  A["Session recorded in therapy room"] --> B["Clinic server in the closet"]
  B --> C["Note drafted locally"]
  C --> D["Clinician reviews and signs in the EHR"]
  D --> E["Audio destroyed on schedule"]
  B --> F["Nothing leaves the building"]
  D --> G["Claim goes out, chart stays in"]

A day in a 24-clinician outpatient program

Start at intake. The intake coordinator finishes a 75-minute biopsychosocial with a new client, and the draft assessment — presenting problem, history, risk screen, provisional diagnosis, initial goals — is written on the box in the closet before she has walked back to her desk. She edits it, because it is a draft and she is the clinician of record, and pushes it into the EHR.

Mid-morning, the psychologist finishes a WISC administration. The scoring summary and behavioral observations are drafted locally. The item content never goes anywhere. That is the difference between a workflow her licensing board would approve and one that would make an ethics committee uncomfortable.

Afternoon, the Part 2 side of the house. Your SUD counselors run four group sessions, and group notes are the documentation black hole of behavioral health: one counselor, eight clients, eight individualized notes required, each needing an individualized response tied to that client's plan. Drafted locally from the counselor's dictation right after group, they are ready to edit at 4:30 instead of at home at 9 p.m. And no roster of eight people's names, diagnoses and group attendance ever crossed the internet.

What the box costs and when it pays for itself

Illustration only, with assumptions stated: 24 clinicians, an average of 38 billable sessions per clinician per month, so roughly 912 sessions. Assume a cloud scribe priced per clinician per month and a one-time local setup amortised over three years.

Two honest caveats on that table. Cloud scribe pricing varies enormously and some vendors will negotiate hard at 24 seats, so run your own quote. And $14,000 assumes one capable machine, a UPS, and a weekend of setup by someone competent — if you do not have that person, add a consultant, and if your closet is actually a coat rack in a converted dental office, add air conditioning. The number that does not move is the last two rows, and for practices with Part 2 records or a county contract, those rows decide it.

The credential and compliance work you still have to do

Local does not mean unregulated. You still owe a security risk analysis under the HIPAA Security Rule, and a machine sitting in your building is now part of it: who has physical access to that closet, what happens when it is stolen, is the drive encrypted at rest, who holds the key. Backups need the same treatment. Retention needs a written schedule — if you keep session audio for 30 days, keep it for 30 days, and be able to show the deletion actually happens.

You also owe your clients an honest disclosure and, where it applies, consent. "We use an AI tool to help write notes; it runs on our own equipment and the recording is deleted after the note is signed" is a sentence a client can understand, and it goes in your informed consent packet, not in a footnote on your website.

Where to keep a human, and where local makes it worse

The clinician signs. Always. A drafted note is a draft, and the specific danger in behavioral health is that a well-written draft is persuasive — it reads like a real note even when it has quietly softened a risk statement or dropped the detail about the client's access to a firearm. Read the risk paragraph of every draft as if you wrote none of it.

Do not put crisis assessment on the box. Safety planning, risk level, hospitalisation decisions — those are clinical judgments with your license attached. And be realistic about a genuine downside of running locally: when it breaks on a Thursday, there is no vendor status page, there is you. Practices that do this well pick one person, usually the practice manager, as the owner of that machine, and write down what to do when it stops working — which is, on any given afternoon, "clinicians write notes the old way and nobody misses a session."

Frequently asked questions

Is a HIPAA business associate agreement enough for Part 2 records?

A business associate agreement addresses HIPAA. Part 2 adds its own consent and redisclosure requirements that follow the record to everyone who touches it. Ask counsel to review any AI vendor arrangement specifically against Part 2 rather than assuming a standard agreement covers it. Practices that keep the processing on their own hardware simply have less of this conversation to have.

Will a local setup write notes as well as the cloud version?

For structured clinical documentation — a SOAP or DAP note from a session recording, an intake summary, a group note — the gap has closed to the point where most clinicians cannot pick the difference in a blind read. For long, unusual reasoning tasks the frontier cloud models are still ahead. Note drafting is not one of those tasks.

We are a solo practice with 40 clients. Does this make sense?

Usually not on cost alone — a single subscription is cheaper than a machine. It makes sense if you do testing, hold Part 2 records, or have a contract clause that forces it. Solo psychologists doing custody or forensic evaluations are the clearest case, because the material is the most restricted and the stakes if it moves are highest.

Can we run the phone system locally too?

Parts of it. The recording and transcription of calls can be handled on your own equipment; the telephone network itself obviously cannot. The practical split most practices land on is: scheduling and intake questions handled by a hosted agent under a business associate agreement with clinical content kept out of it, and anything involving a chart handled inside the building.

Where the phone fits

Most of what arrives on a behavioral health practice's phone line is not clinical — it is "are you taking new clients", "do you take Aetna", "I need to move Thursday", "how much is a session without insurance". CallSphere builds AI voice and chat agents that answer those calls and web chats around the clock, book appointments, and capture the referral details so nothing sits in voicemail overnight. Keep the clinical record inside your building; let the front-desk questions be answered at 8 p.m. on a Sunday, when a third of behavioral health calls actually come in.