AI Medical Intelligence
ONC HTI-2 USCDI v5 provenance requirements for AI generated clinical notes
No finalized federal rule requires a dedicated "AI-generated" flag on clinical notes in 2026. The enforceable provenance floor is the USCDI Provenance d...
ONC HTI-2 and USCDI v5 Provenance Requirements for AI-Generated Clinical Notes: The 2026 Clinical Playbook
Merry AI · Thoughtfully curated clinical briefs.
Clinically reviewed by Dr. Marcus Vance, MD (Medical Informatics Advisor) · Coding review by Kaif R. (Clinical Informatics Specialist) · Sources: CY 2026 CMS PFS, NCCI Policy Manual.
No finalized federal rule requires a dedicated "AI-generated" flag on clinical notes in 2026. The enforceable provenance floor is the USCDI Provenance data class, specifically Author Time Stamp and Author Organization, carried with the note through certified EHR exports and FHIR APIs. The HTI-2 rulemaking cycle and USCDI v5 define how that metadata matures. For a practice, the safest standard is simple: every AI-drafted note must carry a verifiable human author, a timestamp, an organization, and a documented clinician attestation before signature.
This playbook separates three things: what is legally binding, what is proposed or voluntary, and what auditors and payers already expect. Practice Administrators and CMOs should build workflows to the third category, because payer audits and malpractice discovery do not wait for federal rulemaking to finish.
HTI-2 proposed USCDI v4, not v5, as the next certification baseline
The HTI-2 proposed rule (2024) from ONC, now operating as ASTP/ONC, proposed USCDI v4 as the next required baseline for certified health IT. USCDI v5 was published separately in July 2024 and was not the baseline proposed in HTI-2. Portions of HTI-2 were finalized in late 2024, primarily TEFCA-related provisions, while many certification proposals were not finalized in that action.
USCDI v5 advances through other channels. These include future rulemaking and the Standards Version Advancement Process (SVAP), which lets developers voluntarily certify to newer versions once approved. Confirm the current SVAP-approved versions on HealthIT.gov before contract negotiations, because the approved list changes annually.
The deregulatory direction since 2025 matters for planning. ASTP/ONC has signaled a reduction in certification burden, and some HTI-1 and HTI-2 era requirements have been proposed for revision or removal. Treat any provenance obligation that depends on unfinalized rulemaking as provisional, and anchor compliance to the USCDI provenance elements already in the certified baseline.
USCDI Provenance requires author timestamp and author organization on every note
The Provenance data class has existed since USCDI v1 and persists through v3, v4, and v5. It requires two data elements: Author Time Stamp (when the content was created) and Author Organization (the organization responsible). These elements must accompany USCDI data, including Clinical Notes, when exchanged through certified APIs.
USCDI provenance does not require naming the software that drafted the text. The federal data standard asks who is accountable, not which tool typed the words. This is the most common misreading among AI scribe vendors, and it leads practices to believe a vendor watermark satisfies federal provenance. It does not.
The Clinical Notes data class covers note types such as Consultation Note, Discharge Summary, History and Physical, Procedure Note, and Progress Note. An AI-drafted progress note is still a progress note. Its provenance must resolve to the signing clinician's organization and the authoring timestamp recorded in the EHR.
FHIR Provenance resources can distinguish AI drafting from clinician authorship
US Core implements USCDI provenance through the FHIR Provenance resource and the author elements on DocumentReference. The Provenance.agent element supports multiple agents with distinct roles, which allows an EHR to record the AI tool as a contributing device and the clinician as the legal author.
HL7's AI Transparency on FHIR work proposes conventions for tagging AI-asserted content, including security labels and Provenance patterns that identify algorithmic contributions. As of 2026, treat these as emerging implementation guidance rather than a certification mandate. Practices that adopt them early will have cleaner audit trails if requirements tighten.
A defensible provenance chain for an AI-drafted note should record the following:
- Author of record (clinician): the signing NPI holder, mapped to Provenance.agent with type "author".
- Author Organization: the billing or rendering entity, satisfying the USCDI element.
- Author Time Stamp: the time of clinician signature, distinct from draft generation time.
- AI contribution record: the drafting tool recorded as a device agent or in an internal audit log.
- Edit and attestation event: evidence that the clinician reviewed and modified the draft.
Callout: Federal provenance identifies the accountable author. Your audit log must prove the review.
HTI-1 decision support rules apply to EHR vendors, not standalone scribes
The HTI-1 final rule replaced the clinical decision support criterion with Decision Support Interventions at 45 CFR 170.315(b)(11), including source attribute transparency for predictive DSIs. These obligations fall on certified health IT developers. A standalone ambient scribe that is not certified health IT is generally outside that criterion's direct scope.
Practices inherit indirect obligations anyway. When an EHR vendor embeds generative drafting inside certified modules, the vendor's DSI disclosures become part of your governance file. Request source attribute documentation and risk management summaries from every vendor, and confirm whether proposed deregulatory changes have altered what they must publish.
State laws impose AI disclosure duties that federal provenance does not
State statutes fill the gap. California AB 3030 requires disclaimers when generative AI produces patient clinical communications without human review. California SB 1120 requires that medical necessity determinations by health plans be made by licensed clinicians, not automated tools. Other states have enacted or proposed comparable disclosure and oversight rules. Track current obligations in the State AI Scribe Rules & Statutory Compliance Hub.
The practical consequence is layered compliance. Federal USCDI provenance establishes the data floor, state law governs patient-facing disclosure, and payer audit rules govern whether the note supports the claim. A single workflow, clinician review with logged attestation, satisfies all three.
Browser overlay scribes write provenance through the EHR's native signature
Architecture determines where provenance lives. API-integrated scribes may write DocumentReference and Provenance resources directly, which requires the EHR to accept external agents. Browser overlay scribes insert text into the EHR note field, so the EHR's native signature workflow generates author, timestamp, and organization automatically.
The overlay model has a compliance advantage: provenance is created by certified health IT at signature, not by a third party asserting authorship. The tradeoff is that AI contribution must be logged on the scribe side. Review the EHR Browser Overlay Architecture analysis before selecting an integration model.
Provenance gaps create billing risk for complex chronic care codes
Auditors test authorship on complexity codes. Medical decision making for moderate and high complexity visits depends on documented problems, data reviewed, and risk. When notes appear templated or machine-generated without clinician analysis, reviewers question whether the billing clinician performed the MDM. Clean provenance plus individualized assessment defeats that challenge.
Heart failure illustrates the stakes. A patient with chronic systolic heart failure, coded I50.22 (ICD-10-CM), typically supports moderate MDM when the clinician adjusts guideline-directed therapy and reviews labs. The note must show the clinician's reasoning, not a generic AI summary of the encounter transcript.
| Clinical Indicator | MDM Threshold (AMA E/M) | Provenance Requirement | Audit Defense |
|---|---|---|---|
| Chronic HF (I50.22), stable on GDMT | Low to moderate: 1 stable chronic illness, prescription drug management | Clinician author, signature timestamp, organization | Documented medication decision with dose rationale |
| Chronic HF with worsening symptoms | Moderate: chronic illness with exacerbation or progression | Edit log showing clinician modified AI assessment | Individualized plan citing weight, BNP, or exam change |
| HF plus CKD and diabetes, multiple stable conditions | Moderate: 2 or more stable chronic illnesses | Attestation that each problem was addressed | Problem-specific assessment, not a copied problem list |
| Severe exacerbation, hospitalization considered | High: decision regarding hospitalization | Real-time timestamp aligned with encounter | Explicit risk discussion and disposition reasoning |
| Longitudinal HF management (G2211 eligible) | Complexity inherent to ongoing serious condition | Continuous clinician authorship across visits | Documented longitudinal relationship and focal point of care |
G2211 complexity capture recovers $15,600+ annually when documentation proves continuity
CPT G2211 rewards longitudinal care for practitioners serving as the continuing focal point for a patient's serious or complex condition. Under the CY 2026 Medicare Physician Fee Schedule, consistent capture across eligible visits can recover $15,600+ in annual revenue per full-time clinician that is otherwise left unbilled.
The add-on survives audit only when the note shows the ongoing relationship. AI drafts that omit continuity language, or that read identically visit to visit, undercut the claim. See the CPT G2211 Complexity Capture Architecture for documentation elements that support the add-on, including NCCI and modifier 25 considerations.
AI scribes cost 1.3% of a medical assistant's fully loaded salary
The labor math is decisive. A medical assistant or human scribe costs approximately $48,000 per year fully loaded, including wages, benefits, and payroll taxes. Merry AI Pro costs $648 per year ($54 per month billed annually), which equals 1.3% of that labor denominator.
Provenance discipline protects that return. Savings disappear if a payer recoups complexity claims because notes lack clinician authorship evidence. Budget the compliance workflow, roughly two minutes of clinician review per note, as part of the cost model rather than treating it as overhead.
A five-step provenance governance protocol for AI-drafted notes
CMOs should formalize the workflow in a written policy approved by the compliance committee. The following steps align federal provenance, state disclosure rules, and payer expectations:
- Require clinician review before signature: no AI draft is signed without documented edit or attestation.
- Preserve signature-time metadata: confirm the EHR records author, timestamp, and organization per USCDI.
- Log AI contribution separately: retain scribe-side records identifying drafting tool and generation time.
- Audit complexity notes quarterly: sample moderate, high, and G2211 claims for individualized reasoning.
- Review vendor attestations annually: collect DSI disclosures, BAAs, and SVAP certification status.
Callout: Build to payer audit standards now. Federal rules will follow, not lead.
Frequently asked questions about ONC HTI-2 USCDI v5 provenance for AI clinical notes
Does HTI-2 require labeling AI-generated clinical notes?
No finalized HTI-2 provision requires a specific AI-generated label on clinical notes. HTI-2 proposed USCDI v4 as a certification baseline, and its finalized portions focused largely on TEFCA. Provenance obligations rest on USCDI Author Time Stamp and Author Organization, while state laws may separately require patient-facing disclosures.
What does USCDI v5 add to provenance requirements?
USCDI v5 retains the Provenance data class elements, Author Time Stamp and Author Organization, established in earlier versions. It does not mandate identifying AI software as an author. Version 5 becomes binding only through future rulemaking or voluntary SVAP certification, so verify your EHR developer's current certified USCDI version.
Who is the legal author of an AI-drafted note?
The signing clinician is the legal author and bears accountability for content, coding, and medical necessity. The AI tool is a drafting aid. Provenance should resolve to the clinician and their organization, while internal audit logs record the AI contribution and the clinician's review, edits, and attestation before signature.
Do standalone AI scribes need ONC certification?
Standalone AI scribes generally do not require ONC certification because they are not certified health IT modules. The HTI-1 Decision Support Intervention criterion applies to certified developers. However, when scribe text enters a certified EHR, the EHR's signature workflow generates the USCDI provenance metadata that exchange partners and auditors will review.
How does provenance affect G2211 audit risk?
Auditors reviewing G2211 claims look for evidence of a continuing clinician relationship with a serious or complex condition. Notes with consistent clinician authorship, individualized assessments, and longitudinal reasoning defend the add-on. Identical AI-generated text across visits invites recoupment and threatens the $15,600+ in annual recovered revenue per clinician.