TL;DR — The 2026 Algorithmic Provenance Audit Trail

• The problem is structural: Under ONC HTI-2, payers and auditors now demand machine-readable proof of who (or what) generated a clinical note. Free-text "AI-generated" disclaimers no longer satisfy audit requests.

• Scribing.io's answer is dual-write: We dual-write a FHIR R4 Provenance resource (targeting the note's DocumentReference, LOINC 11506-3) plus an AuditEvent that logs model_id, model_sha256, prompt template, and decoding params.

• The differentiator is cryptographic: A JWS-signed Provenance (Signature.type 1.2.840.10065.1.12.1.5) makes the entire bundle machine-verifiable and exportable — proving both AI provenance and human attestation.

• The payoff is recoupment reversal: When a Medicare Advantage plan downcodes and demands 10-day provenance, you export a signed FHIR Bundle per encounter and reverse the recoupment. See the Clinical Logic scenario below.

• What Algorithmic Provenance Means

• Clinical Logic: Reversing a $92k Downcode

• Binding HTI-2 Provenance Via Dual-Write

• Technical Reference: ICD-10 Standards

• The Operations Director Checklist

What "Algorithmic Provenance" Means Under the 2026 HTI-2 Rule

CLINICAL UPDATE 2026: Revised for new CMS CPT G2211 standards, SB 1120 compliance, and FHIR interoperability.

For a Clinical Operations Director, the shift in 2026 is not conceptual — it is structural. ONC's HTI-2 rule elevates algorithmic provenance from a nice-to-have transparency gesture into a hard interoperability requirement. The regulation asks a deceptively simple question about every AI-influenced note.

That question has four clauses: what model produced this, on what version, trained to what date, and did a human attest to it? The critical word is provenance. HTI-2 does not accept a narrative statement buried in the note body.

Provenance under HTI-2 must be discrete, structured, and exportable through the same certified data-portability channels your EHR already supports. That is the difference between a compliance posture and a compliance liability.

Scribing.io generates a machine-readable audit trail that embeds the AI model ID, version, and training-date information directly into the EHR metadata — not as prose, but as bound FHIR resources. For the regulatory framing of this data-portability obligation, see our Scribing.io Onc Hti 2 Compliance Ai Scribes Data Portability Rule Reference.

Reversing a $92k Medicare Advantage Downcode With Machine-Readable Provenance

This is the scenario that most sharply illustrates why structured provenance is now an operational necessity rather than a documentation afterthought. The 10-day clock is unforgiving.

The Trigger Event

A Medicare Advantage plan runs a payer-side algorithm across a multi-specialty clinic's claims. It flags 38 established-patient E/M encounters as "possible AI-generated notes" and downcodes them from 99214 to 99213.

On appeal, the plan demands machine-readable provenance within 10 days: model identity and version, training cutoff, and human attestation captured at the time of documentation. A clinic without structured provenance cannot meet the window and faces a $92,000 recoupment.

The Decision Logic Scribing.io Executes

With Scribing.io enabled, the clinic exports a FHIR Bundle per encounter containing the DocumentReference (LOINC 11506-3 Progress note), the Provenance referencing Device/<AI-model> with Device.version=v3.2.1 and training-data-asof=2025-10-01, plus an AuditEvent logging model_sha256 and decoding temperature.

The JWS-signed Provenance proves both integrity and the human signer. The payer reverses the downcoding and closes the audit with no recoupment. The provenance was never reconstructed — it existed the moment the physician signed.

The operational takeaway is timing: the 10-day clock is only survivable if the provenance was captured at documentation time — you cannot reconstruct it retroactively. To quantify what averting these recoupments is worth across your book of business, run the numbers in our AI Medical Scribe ROI Calculator.

Binding HTI-2 Provenance to the Clinical Record Via Dual-Write

Most vendors — and even the regulatory guidance many teams rely on — stop at flagging output as "AI-generated" in free text. That approach fails the exportability test. It also fails to link provenance to the specific note it describes.

Scribing.io's original contribution is a dual-write architecture that binds algorithmic provenance to the clinical record in two coordinated FHIR resources. Each resource carries a distinct evidentiary role.

Write #1 — The FHIR R4 Provenance Resource

• Target of the resource: the note's DocumentReference (type LOINC 11506-3, Progress note).

• Agent designation: agent.type = dev, agent.who = Device/<model>.

• Version binding: Device.version carries the model release (e.g., v3.2.1).

• Training cutoff encoding: a Device property extension encodes training-data-asof in ISO 8601 (e.g., 2025-10-01).

• Signature for verification: Provenance.signature is a JWS with Signature.type 1.2.840.10065.1.12.1.5, making the bundle machine-verifiable.

Write #2 — The AuditEvent Resource

• Action code recorded: C (create).

• entity.detail payload contents: model_id, model_sha256, the prompt template, and decoding parameters (temperature, top-p).

Why This Exceeds the Baseline

This is the information gain: the competitor guidance addresses whether AI was involved; Scribing.io addresses the far harder question of proving it in a structured, signed, exportable form that survives a payer or ONC audit.

Current clinical benchmarks indicate that structured, machine-verifiable provenance is the only approach that reliably satisfies short-window provenance demands. For multi-site audit trail governance, review our Scribing.io Hipaa 2026 Update Multi Site Audit Trails Ai Documentation Reference.

Technical Reference: ICD-10 Documentation Standards

Provenance is only half the compliance equation — the underlying diagnostic documentation must also withstand coding scrutiny. Two high-frequency codes in E/M-heavy multi-specialty settings deserve specific attention.

These two codes anchor many of the 99214 encounters that payer algorithms scrutinize. A well-specified diagnosis paired with signed provenance is the combination that defeats a downcode. For specialty-specific documentation patterns, browse our clinical specialties library.

The Operations Director Checklist for HTI-2 Readiness

Operational readiness in 2026 comes down to five verifiable states. Confirm each one before your next payer audit cycle rather than during it.

1. Provenance captured at signing: confirm the Provenance resource is written at attestation time, not batch-generated afterward.

2. Model metadata is discrete: verify Device.version and training-data-asof populate as structured fields, not note text.

3. Integrity hash is present: ensure every AuditEvent carries a valid model_sha256 and decoding parameters.

4. JWS signature validates: test that the signed Provenance verifies against your key material end-to-end.

5. Bundle export is one-click: rehearse a per-encounter FHIR Bundle export under a simulated 10-day deadline.

Integration configuration determines whether these states hold across your EHR footprint. Review deployment paths in our integration reference and confirm your certified data-portability channel is active.

To align licensing with your multi-site audit obligations, see Scribing.io Pricing & Plans. The cost of structured provenance is measured against a single averted recoupment.