This is Part 2 of 3 in a series about the risks of retaining therapy session transcripts. You can read Part 1 here, which covered why "de-identified" doesn't really mean what it sounds like.
When companies mention "de-identified" session transcripts, you'll typically hear another word too: de-coupled.
It sounds clean. It sounds technical. Heck, it sounds sophisticated and fancy.
But "de-coupled" can also mean something unsettling -- we can never delete it. But we'll get to that point later.
When a vendor says a therapy transcript has been "de-coupled", you can generally assume they mean the transcript is no longer directly connected in their database to the client record, the therapist record, the appointment record, etc. There is no direct database relationship between the transcript and the other database records that exist for that client or therapist.
This can reduce some risk. But it doesn't guarantee that the transcript can't be tied back to the therapist and/or client.
And the reason this is coming up at all is the same reason from Part 1 -- AI training. Companies want to retain therapy transcripts to train, test, and improve their AI systems. And "de-coupled" is increasingly being framed as the privacy solution that makes retention okay.
But if the transcript is still useful for AI training, it almost certainly still contains meaningful clinical and conversational detail. Removing the database link does not remove the conversation.
There's also a sneakier issue. Removing one explicit relationship doesn't mean every possible connection is wiped. Other traces can still exist:
- Timestamps
- Processing logs
- Session patterns
- Analytics events
- Backups
- Internal system metadata
Any one of those is a potential threat to identifying the original source of that transcript.
Here's a really simple example:
It's totally reasonable -- and extremely common -- for any sort of record (including transcript records) to be stored in a database along with the date and time it was created. That's just how database tables tend to work. (Not to get too technical!)
But you know what else has a date and time? Therapy session appointments. Start and end times, more specifically.
So even if the transcript and the appointment have been "de-coupled" in the database, could the two still be linked back together just by lining up their timestamps? Maybe! And that's just one example -- this is exactly the kind of thing that can re-link "de-coupled" data without anyone really meaning for it to happen.
And even if all of that gets scrubbed too, the transcript still contains very personal and specific details:
- Family situations
- Local events
- Workplace details
- School issues
- Legal timelines
- A rare diagnosis or rare circumstance
- The therapist's specialty
- Treatment history
- Community details
The direct database link may be gone. But the story from the session may still point right back to the person.
And here's another sneaky example:
You know what else may contain a reference or two to one of these details? A progress note. You know, the thing that most definitely is tied back to a client and their name and other identifiers.
Imagine a scenario where someone has access to both the progress notes and the transcripts -- all "de-coupled" from clients, of course. The progress note for a given session is going to share at least a few of those same details from the transcript. Same family situation or workplace issue or recent diagnosis. Same therapist style and language and phrasing.
Couldn't you still link the transcript back to a specific client by going through the progress note for that session? Probably! And progress notes are tied to a client record, because that's how documentation actually has to work.
So the "de-coupled" transcript suddenly isn't really de-coupled anymore. It's one match away from being right back to where it started.
Alright, now switching gears a bit. There's another issue we want to cover.
Imagine a client comes back a year later and says: "I don't want my session transcripts retained anymore. Please delete them."
Or a therapist contacts the vendor and says: "Please delete all retained transcripts related to my practice."
Those are totally reasonable asks. People change their minds. If they feel uncomfortable, they should be able to get these super private conversations removed from a third-party's database.
But if the EHR or AI Scribe has truly de-coupled the data, they will genuinely no longer have a way to connect those transcripts back to that client or that therapist. They will not be able to find them. (Because if they could, these transcripts weren't actually de-coupled!)
The same property that supposedly protects the data also makes it impossible to honor a deletion request.
This is a control issue. Once your therapy transcripts are stored in this way, you no longer have control over them. You have no practical way to get them removed.
That's it for Part 2! See you soon for Part 3!
Update: We've since posted a more thorough post on this topic, about retaining de-identified therapy session transcripts and why that's a bad idea, including talk about "de-coupling" and how it's not the perfect solution to guaranteeing anonymity of the transcript, if you want to give that a read next!
