AI Medical Intelligence
HTI-2 & USCDI v5 Provenance Rules for AI Notes
Clarifies ONC HTI-1/HTI-2 status: USCDI v3 is mandatory, v5 is voluntary. Learn provenance tagging rules for AI-generated PHP/IOP notes.
ONC HTI-2 and USCDI v5 Data Provenance Requirements for AI Documentation: The 2026 PHP/IOP Clinical Playbook
Merry AI · Thoughtfully curated clinical briefs.
Clinically reviewed by Dr. Marcus Vance, MD (Medical Informatics Advisor) · Coding review by Kaif R. (Clinical Informatics Specialist) · Sources: CY 2026 CMS PFS, NCCI Policy Manual.
No federal rule mandates USCDI version 5 in 2026. ONC's HTI-1 final rule made USCDI v3 the required certification baseline on January 1, 2026. HTI-2 proposed USCDI v4, but those certification provisions were not finalized. USCDI v5 is a voluntary advancement target. AI-generated PHP/IOP notes must therefore carry the USCDI Provenance data elements (Author Organization and Author Time Stamp), plus a clinician-attested author recorded through the HL7 FHIR US Core Provenance profile.
This playbook gives multi-site Partial Hospitalization (PHP) and Intensive Outpatient (IOP) Clinical Directors an operational standard. It answers three questions: who is the author of an AI-drafted note, how provenance survives cross-site exchange, and how provenance metadata defends E/M, psychotherapy add-on, and CPT G2211 claims during audit.
USCDI v3 is the enforceable 2026 baseline; USCDI v5 is voluntary
The regulatory sequence matters for procurement. HTI-1, published January 2024, required certified health IT to support USCDI v3 by January 1, 2026. The HTI-2 proposed rule (July 2024) would have adopted USCDI v4. The December 2024 HTI-2 final rule addressed TEFCA, and the USCDI v4 certification update was not finalized.
USCDI v5 was published by ONC in July 2024 as the next version of the standard. Developers can advance to newer USCDI versions only when ONC approves them through the Standards Version Advancement Process (SVAP). Confirm the SVAP status with your EHR vendor before you contract against a specific version.
The Provenance data class is stable across versions. Author Organization and Author Time Stamp have been required USCDI elements since version 1. Any AI documentation pipeline that captures them correctly today stays compliant through v3, v4, and v5.
Build to USCDI v5 now; certify to USCDI v3 today.
USCDI Provenance requires Author Organization and Author Time Stamp on every note
Author Time Stamp records when the clinical content was authored. For AI-assisted notes, record two timestamps: the time the draft was generated and the time the clinician attested. A single timestamp conflates machine drafting with clinical judgment, and auditors notice the gap.
Author Organization identifies the accountable entity. In a multi-site PHP/IOP network, this must resolve to the specific licensed site (with its NPI and CCN where applicable), not a parent holding company. Payers reconcile the organization on the note against the billing provider on the claim.
FHIR US Core Provenance operationalizes these elements. The Provenance resource links to the DocumentReference or Composition. Each agent entry carries a role, and the target references the note version. Merry AI writes back a Provenance resource with every signed note.
The attesting clinician is the author; the AI scribe is an agent
An AI scribe cannot hold authorship. Medicare signature requirements (Program Integrity Manual, Chapter 3, §3.3.2.4) require a handwritten or electronic signature from the practitioner responsible for the service. The scribe is a software agent that assembles text; the clinician authors, verifies, and attests.
Map FHIR participant roles explicitly. Use these assignments so provenance is unambiguous across exchange partners:
- Author and attester: the psychiatrist, psychiatric NP, LCSW, or psychologist who signs.
- Assembler: the AI scribe application, recorded as a Device reference with software version.
- Custodian: the site organization that maintains the legal record.
- Transmitter: the system that sent the note to an HIE or TEFCA participant.
HL7 security labels add a machine-readable AI flag. The HL7 v3 ObservationValue code AIAST (AI asserted) can tag content generated by AI. Pair it with clinician attestation so receiving systems see both the AI origin and the human verification.
The clinician signs; the software assembles. Record both.
HTI-1 DSI source attributes bind certified developers, not standalone scribes
The 45 CFR 170.315(b)(11) Decision Support Interventions criterion required certified developers, by December 31, 2024, to disclose source attributes for predictive DSIs they supply. These attributes cover intended use, training data, validity, fairness, and ongoing maintenance.
Most ambient AI scribes are not certified Health IT Modules. Their obligations come from state law, payer contracts, and HIPAA. If scribe output feeds a predictive DSI in your EHR, the EHR developer carries the source attribute obligation for that intervention.
Clinical Directors should still request a source attribute sheet from any AI vendor. Ask for the model family, update cadence, and known failure modes in psychiatric terminology. Treat a refusal as a procurement red flag.
Multi-site PHP/IOP networks must stamp provenance per site and discipline
PHP and IOP care is team-delivered. A single patient day may include group psychotherapy, individual therapy, medication management, and nursing assessment, each by a different discipline. Every one of those notes needs its own author, organization, and timestamp.
Group notes create the highest provenance risk. When AI drafts individualized group progress notes, each patient's note must reference the group facilitator as author and contain patient-specific content. Cloned language across group members invites medical necessity denials.
Cross-site patients need consistent identifiers. When a patient steps down from PHP at one site to IOP at another, the receiving site must preserve the original Provenance resources. Never re-stamp an inbound note with the receiving site as Author Organization.
One discipline, one author, one timestamp, one organization per note.
42 CFR Part 2 SUD notes require segmented provenance by February 2026
The 2024 Part 2 final rule set a compliance date of February 16, 2026. IOP programs treating substance use disorder must align Part 2 records with HIPAA-style consent, redisclosure, and breach notification standards.
Provenance enables data segmentation. Tag Part 2 records with the appropriate confidentiality security label so downstream systems can enforce consent. An AI scribe must never merge Part 2 content into a general psychiatric note without that label.
Provenance-defended MDM thresholds for PHP/IOP psychiatric encounters
Use the table below to align documentation with 2021 AMA E/M MDM rules, NCCI Policy Manual Chapter 11 guidance, and the provenance evidence that defends each level. Diagnoses reference F33.1 (ICD-10-CM) (major depressive disorder, recurrent, moderate) and F41.1 (ICD-10-CM) (generalized anxiety disorder).
| Clinical indicator | ICD-10-CM | MDM threshold and code | Required provenance evidence | Audit defense |
|---|---|---|---|---|
| Two stable chronic illnesses on SSRI maintenance | F33.1 + F41.1 | Moderate MDM: 99214 (2+ stable chronic illnesses; prescription drug management) | Prescriber as author; attestation timestamp after draft timestamp | Medication decision documented in clinician's own attested assessment |
| Depressive episode worsening, PHQ-9 rising across visits | F33.1 | Moderate MDM: 99214 (chronic illness with exacerbation) | Serial PHQ-9 scores linked to Observation resources with source site | Trended scores prove progression rather than templated language |
| Severe exacerbation with suicidal ideation, level-of-care decision | F33.1 | High MDM: 99215 (decision regarding hospitalization) | Author, site, and exact time of risk assessment; C-SSRS linked | Time-stamped safety plan and disposition signed by the deciding clinician |
| Medication management plus psychotherapy same day | F41.1 | 99213 or 99214 + 90833, 90836, or 90838 | Separate time stamps for E/M and psychotherapy segments | Psychotherapy time excludes E/M time, per CPT add-on rules |
| Longitudinal continuing care for complex condition | F33.1 + F41.1 | Office/outpatient E/M + G2211 | Consistent practitioner or team author across serial encounters | Provenance chain demonstrates the ongoing longitudinal relationship |
G2211 complexity capture depends on provenance-stamped continuity documentation
CPT G2211 pays for the longitudinal relationship behind an office or outpatient E/M visit. CMS describes it as care serving as the continuing focal point for all needed services, or ongoing care for a single serious or complex condition. PHP/IOP psychiatric follow-up for recurrent depression fits that intent.
Provenance is the evidence of continuity. When every serial note carries the same accountable practitioner or care team, the longitudinal relationship becomes verifiable rather than asserted. Since CY 2025, G2211 may be billed alongside modifier 25 only when the separate service is an annual wellness visit, vaccine administration, or Medicare Part B preventive service.
Merry AI benchmarks show $15,600+ in annual recovered revenue per practitioner from consistent G2211 capture. The mechanics are covered in the CPT G2211 Complexity Capture Architecture.
Continuity you cannot prove through provenance is continuity you cannot bill.
State AI laws add human-attestation duties beyond ONC provenance
California SB 1120 requires licensed physicians, not algorithms, to make medical necessity determinations in utilization review. PHP/IOP programs defending level-of-care appeals should show that clinician-authored provenance, not AI output, supports the medical necessity rationale.
California AB 3030 requires disclosure when generative AI drafts patient communications about clinical information, unless a licensed provider reviews the message. Texas SB 1188 requires practitioners who use AI for diagnosis or treatment recommendations to disclose that use and review AI-generated records.
Multi-state networks need a single compliance map. Track jurisdiction-specific obligations in the State AI Scribe Rules & Statutory Compliance Hub.
Browser overlay architecture preserves provenance without a custom EHR build
Most PHP/IOP programs run several EHRs across acquired sites. API-only scribes require separate integration for each, which delays deployment. A browser overlay writes the attested note into the EHR's native fields so the EHR records the signing clinician as author.
The overlay must not bypass EHR signature workflows. Merry AI drafts, the clinician edits and signs inside the EHR, and the EHR's audit log captures the attestation timestamp. Details appear in the EHR Browser Overlay Architecture guide.
Merry AI Pro costs 1.3% of a $48,000 medical assistant
A fully loaded medical assistant costs about $48,000 per year in wages, benefits, and payroll taxes. Merry AI Pro costs $54 per month on annual billing, or $648 per year, which equals 1.3% of that labor denominator.
The return compounds at scale. A 12-prescriber PHP/IOP network spends $7,776 per year on Merry AI Pro. At $15,600 recovered G2211 revenue per prescriber, modeled annual recovery reaches $187,200 before counting clinician time saved.
A 90-day provenance rollout fits multi-site PHP/IOP operations
Days 1 to 30: inventory. List every EHR, site NPI, and CCN. Confirm each vendor's USCDI v3 certification and SVAP plans. Identify Part 2 programs and their consent workflows.
Days 31 to 60: configure. Map FHIR participant roles, enable dual timestamps, and apply AI and Part 2 security labels. Pilot group-note individualization at one PHP site.
Days 61 to 90: audit. Pull 30 charts per site. Verify author, organization, and timestamp on each note, confirm G2211 continuity, and test level-of-care appeals against SB 1120 standards.
Audit 30 charts per site before scaling AI documentation network-wide.
Frequently asked questions about USCDI v5 data provenance for AI documentation
Does HTI-2 require USCDI version 5 for AI scribes?
No. HTI-2 proposed USCDI v4, and those certification proposals were not finalized in December 2024. HTI-1 makes USCDI v3 the required baseline on January 1, 2026. USCDI v5 remains a voluntary advancement target, though building to it now reduces later remapping work for PHP/IOP programs.
Who is the author when an AI scribe drafts a note?
The attesting clinician is the author of record. The AI scribe is a contributing device or software agent. FHIR Provenance should list the clinician as author, the organization as custodian, and the scribe as an assembler or transmitter agent, with timestamps for draft creation and signature.
Do HTI-1 DSI source attributes apply to ambient AI scribes?
Only indirectly. The §170.315(b)(11) source attribute requirements bind certified health IT developers whose modules enable predictive decision support interventions. A standalone ambient scribe is usually not certified, but if its output feeds a predictive DSI the EHR developer supplies, that developer must disclose source attributes.
How does provenance protect G2211 claims in PHP/IOP?
G2211 requires a longitudinal relationship serving as the continuing focal point for a serious or complex condition. Provenance-stamped notes prove that the same practitioner or team authored serial assessments across sites and dates, which is the evidence auditors request when challenging the add-on code.
What does Merry AI Pro cost compared with a medical assistant?
Merry AI Pro costs $54 per month on annual billing, or $648 per year. Against a $48,000 fully loaded medical assistant, that equals 1.3% of labor cost. Merry AI benchmarks model $15,600 or more in annual recovered revenue through structured CPT G2211 complexity capture.