The 'Authorship' Audit: Proving Physicians Verified AI Notes — A Clinical Operations Playbook for 2026

Author: Lead Clinical Consultant, Scribing.io · Last Updated: June 2026 · Word Count: ~3,200

TL;DR: CMS's 2025 signature guidance (MLN905364) tells providers to "sign the entry" when using AI scribes—but says nothing about proving the physician actually reviewed the AI-generated draft before signing. In 2026, "signed by" is no longer sufficient for audit defense. This playbook explains how Clinician Dwell Time—captured as review_start, review_end, edit count, and diff hash—closes the authorship verification gap that CMS auditors, TPE contractors, and RACs are now actively probing. We detail the exportable Authorship Packet, map it to FHIR Provenance/AuditEvent standards, and show Chief Compliance Officers exactly how to operationalize pre-signature review proof across every AI-assisted note.

Table of Contents

• 1. Why CMS 2026 Audits Demand More Than a Signature

• 2. The Pre-Signature Review Gap — What Competitors Missed

• 3. Clinical Logic Masterclass — The TPE Authorship Audit

• 4. Anatomy of the Authorship Packet — Technical Architecture

• 5. Technical Reference: ICD-10 Documentation Standards

• 6. Operationalizing Pre-Signature Review Across Your Organization

• 7. Next Step: Book a 15-Minute Workflow Audit

1. Why CMS 2026 Audits Demand More Than a Signature

CMS's July 2025 revision of MLN905364 added its first-ever mention of artificial intelligence under the scribe documentation rules. The operative sentence is deceptively simple:

"If you use a scribe, including artificial intelligence technology, sign the entry to authenticate the documents and the care you provided or ordered."

For decades, a physician's signature was the terminal compliance event. The logic was straightforward: if the physician signs, the physician attests. But that logic assumed a human scribe whose output was generated in real time, in the presence of the attesting clinician, during the encounter itself.

AI-assisted documentation—the kind generated by platforms like Scribing.io and its competitors—breaks every one of those assumptions:

• Temporal dislocation: The AI draft may be generated seconds or hours after the encounter concludes. The AMA's principles on augmented intelligence emphasize that physician oversight must be contemporaneous with the documentation workflow, not merely appended after the fact.

• Cognitive opacity: The physician may not have reviewed every line of a multi-section note before signing. A 2024 JAMA Health Forum study on clinician interaction with AI-generated text found that auto-acceptance rates for AI drafts exceeded 60% when review interfaces did not enforce deliberate engagement.

• Batch-signing risk: EHR workflows allow physicians to sign dozens of notes in rapid succession—a pattern CMS TPE auditors now explicitly flag. The CERT program's 2025 annual report identified batch-signed AI-assisted notes as a contributing factor in the improper payment rate increase for E/M services.

The 2025 MLN905364 document acknowledges AI exists. What it does not address is the evidentiary standard for proving that the signature reflects genuine review rather than reflexive approval. This is the gap that 2026 audit enforcement is filling operationally—through Targeted Probe and Educate (TPE) reviews, CERT sampling, and RAC audits that increasingly request documentation of the review process itself, not just the signature artifact.

Compliance officers at organizations using AI scribes report a 35–50% increase in supplemental documentation requests from MACs specifically related to AI-generated note authorship since Q3 2025. The HIPAA 2026 consent requirements further compound this challenge by adding patient-facing transparency obligations to AI-assisted documentation workflows.

For Chief Compliance Officers, the strategic question is no longer "Did the physician sign?" It is: "Can you prove the physician read the draft before the signature was applied?"

2. The Pre-Signature Review Gap — What Competitors Missed

Every major AI scribe vendor on the market today can produce metadata showing two things: "edited by [Clinician Name]" and "signed by [Clinician Name]." These are table-stakes EHR integration outputs. They are also categorically insufficient for 2026 human-in-the-loop audit defense. Here is why.

The Missing Evidentiary Layer

CMS auditors conducting TPE and RAC reviews are trained to evaluate whether documentation reflects the personal involvement of the billing provider—a standard reinforced by the HHS Office of Inspector General's expanded focus on AI-facilitated upcoding. When an AI generates the initial draft, the auditor's question shifts from "Who wrote this?" to "Who verified this, and how do you know?"

The "edited by / signed by" metadata answers neither question with specificity:

• "Edited by" confirms that some modification occurred but does not prove the clinician reviewed the full note. A single character change—or an auto-correction—can trigger an "edited by" stamp.

• "Signed by" confirms the terminal authentication event but contains zero information about what happened between draft generation and signature application.

The missing proof is the pre-signature review itself—a temporally bounded, auditable record showing that a specific clinician opened a specific draft version, spent measurable time reviewing it, made (or consciously declined to make) edits, and then—and only then—applied their signature to the version they actually reviewed.

Organizations operating under California's AI scribe laws face additional state-level requirements that make this evidentiary gap even more legally consequential.

Why EHR APIs Don't Solve This

Epic, athenahealth, Oracle Health (Cerner), and other major EHR platforms expose robust audit logs. But their APIs are designed around document lifecycle events (created, modified, signed, amended)—not per-draft review sessions. The gap is structural:

This gap cannot be closed by EHR configuration alone. It requires the AI scribe layer—the system that generates and presents the draft—to capture what the EHR cannot: the clinician's review behavior between draft presentation and signature commitment.

Scribing.io was engineered to fill exactly this gap. Every draft presented to a clinician triggers the capture of Clinician Dwell Time—a composite metric comprising review_start, review_end, edit count, and a cryptographic diff hash linking the reviewed version to the signed version. This data is written as a FHIR Provenance resource and an associated AuditEvent, creating an exportable, standards-compliant record that exists independent of the EHR's native audit trail.

3. Clinical Logic Masterclass — The TPE Authorship Audit, Step by Step

Abstract compliance claims are worthless without a concrete scenario. This section documents a granular, step-by-step audit defense breakdown that illustrates the operational difference between legacy "signed by" metadata and Scribing.io's Authorship Packet.

Before: The $61,400 Freeze

A 12-provider cardiology group enters a Targeted Probe and Educate (TPE) audit conducted by their MAC. The MAC holds 38 E/M claims for "insufficient documentation / uncertain authorship." The group uses an AI scribe from a competing vendor.

Their compliance team can produce:

• ✅ Signed notes with physician signatures and dates

• ✅ EHR audit logs showing "edited by [Physician]" and "signed by [Physician]"

• ❌ No evidence the physician reviewed the AI draft before signing

• ❌ No version-locked link between the draft the physician saw and the version submitted for billing

• ❌ No measurable review duration for any individual note

The MAC's TPE reviewer flags all 38 claims. The auditor's written rationale cites the inability to distinguish physician-authored content from AI-generated content and the absence of evidence that the signing physician engaged with the draft beyond applying a signature. $61,400 is frozen. Compliance staff spend 42 hours assembling screenshots, exporting EHR logs, writing attestation letters, and attempting to reconstruct review timelines from fragmented metadata. Despite this effort, only 5 of 38 claims are resolved on first review.

After: The Authorship Packet — Step-by-Step Logic

The same cardiology group, now using Scribing.io, encounters a subsequent TPE cycle. Here is exactly how each flagged note is defended:

1. Audit notification received. The MAC identifies 38 E/M claims for review. The compliance officer logs into Scribing.io's compliance dashboard and queries the 38 encounter dates.

2. Authorship Packets exported in bulk. Each note's Authorship Packet is exported as a single structured document (PDF + machine-readable FHIR bundle). Total export time: under 4 minutes for all 38 notes.

3. Per-note proof assembled automatically. Each Authorship Packet contains:

   • Clinician Dwell Time: review_start and review_end timestamps (UTC, to the second) proving the physician had the draft open for a measurable review period. Example: Dr. Patel opened draft at 14:32:07 UTC, committed signature at 14:34:51 UTC. Dwell time: 164 seconds.

   • Edit Activity: Total edit count (e.g., 7 discrete modifications) and a human-readable redline showing every change the clinician made to the AI draft. The redline is color-coded: red strikethrough for deletions, green underline for additions.

   • Version Integrity: A SHA-256 diff hash binding the exact draft version the clinician reviewed to the exact version that received the signature. The hash is verifiable: if any character differs between the reviewed and signed versions without a corresponding edit record, the hash breaks.

   • FHIR Provenance Resource: A standards-compliant provenance record linking the clinician's NPI, the review session timestamps, the edit diff, and the signed document version into a single, machine-readable chain of custody—conformant with HL7 FHIR R4 Provenance specifications.

4. Packet submitted to MAC. The compliance officer attaches the 38 Authorship Packets to the TPE response. No attestation letters required. No screenshot assembly. No timeline reconstruction.

5. MAC review completed. The TPE reviewer can verify, per note: (a) the physician opened the draft, (b) the physician spent a clinically reasonable duration reviewing, (c) the physician made specific edits, and (d) the signed version is cryptographically linked to the reviewed version. 33 of 38 denials are overturned on first appeal.

The Authorship Packet transforms audit response from a retrospective reconstruction exercise into a prospective, automated compliance artifact—generated at the moment of every note review, not assembled under audit pressure. The 5 claims that remained denied involved clinical documentation insufficiency unrelated to authorship (missing medical necessity language), not authorship verification failures.

The anchor truth: 2026 CMS audits demand proof of human-in-the-loop. Scribing.io records Clinician Dwell Time on every draft to prove the note was reviewed before the signature was applied.

4. Anatomy of the Authorship Packet — Technical Architecture

Understanding what the Authorship Packet contains—and how it is generated—is essential for compliance officers evaluating whether their current AI scribe vendor can withstand 2026 audit scrutiny.

Data Capture Layer

When a Scribing.io-generated draft is presented to the clinician for review, the following telemetry is captured automatically, with no additional clinician action required:

FHIR Standards Mapping

The captured data is written into two interlinked FHIR R4 resources:

1. Provenance Resource

• Provenance.target → Reference to the signed DocumentReference

• Provenance.agent.who → Practitioner (NPI-identified clinician)

• Provenance.agent.role → "reviewer" (coded per Provenance Participant Role value set)

• Provenance.signature → Electronic signature with timestamp

• Provenance.entity → Reference to the original AI-generated draft (draft_version_id), with entity.role = "source"

2. AuditEvent Resource

• AuditEvent.type → "Document Review" (custom coded)

• AuditEvent.period.start → review_start

• AuditEvent.period.end → review_end

• AuditEvent.agent → Practitioner (NPI-identified clinician)

• AuditEvent.entity → References to both draft_version_id and signed_version_id, plus the diff_hash as an extension

Together, these resources create a version-locked chain of custody: the AI generated draft X → clinician Y opened draft X at time T1 → clinician Y made N edits → clinician Y signed version Z at time T2 → version Z is cryptographically linked to draft X via diff hash H. An auditor can verify every link in this chain independently.

Export Formats

Authorship Packets are exportable in three formats to accommodate different MAC submission requirements:

• PDF: Human-readable summary with redline, timestamps, and hash verification instructions. Suitable for fax-based MAC submissions.

• FHIR JSON Bundle: Machine-readable bundle containing Provenance + AuditEvent resources. Suitable for electronic submission and automated verification.

• C-CDA Supplement: An addendum section embeddable in existing CDA documents for organizations using legacy health information exchange workflows.

5. Technical Reference: ICD-10 Documentation Standards

Authorship verification and coding accuracy are inseparable in audit defense. A note that proves physician review but contains nonspecific ICD-10 codes still generates denials. Scribing.io addresses both vectors simultaneously.

The Specificity Problem in AI-Generated Documentation

AI scribe systems that lack clinical coding logic frequently default to unspecified ICD-10 codes—the coding equivalent of leaving the physician's diagnostic reasoning undocumented. For the cardiology group in our TPE scenario, common specificity failures include:

• Documenting "atrial fibrillation" without specifying paroxysmal vs. persistent vs. long-standing persistent vs. permanent (ICD-10 codes I48.0–I48.91)

• Documenting "heart failure" without specifying systolic vs. diastolic, acuity, and stage (I50.1–I50.9)

• Documenting "chest pain" without laterality, character, or provocation context (R07.1–R07.9)

Each nonspecific code increases denial risk and audit exposure. The CMS Standard Clinical Classifications page maintains the authoritative ICD-10-CM code sets, including annual updates and coding guidelines that define when specificity is required for claim acceptance.

How Scribing.io Ensures Maximum Specificity

Scribing.io's ambient capture layer extracts clinical context that drives code specificity—duration qualifiers, laterality, acuity markers, and causal relationships—and maps them to the most specific ICD-10-CM code available in the current fiscal year's code set. The process operates as follows:

1. Encounter context extraction: During the ambient capture phase, Scribing.io identifies clinical descriptors that map to ICD-10-CM specificity axes (type, laterality, episode, sequela).

2. Code suggestion with specificity scoring: The draft presents suggested ICD-10 codes alongside a specificity score (1–5). Codes scoring below 4 are flagged with an inline prompt: "Additional specificity available—review descriptor."

3. Physician review within the Dwell Time window: The clinician reviews suggested codes during the same pre-signature review session captured by the Authorship Packet. Code modifications are included in the edit_count and diff_payload.

4. Cross-reference against Standard Clinical Classifications: Prior to signature commit, Scribing.io validates that each code in the note exists in the current CMS code set and meets the minimum specificity threshold for the documented condition category.

This process ensures that coding specificity is addressed within the physician's review workflow—not as a downstream coding department function that occurs after the note is signed and the authorship verification window has closed. The AMA's CPT guidelines on E/M documentation further reinforce that the level of service billed must be supported by the specificity of the documented assessment.

6. Operationalizing Pre-Signature Review Across Your Organization

Knowing that the Authorship Packet exists is insufficient. Chief Compliance Officers need a deployment framework that ensures every provider, in every specialty, generates auditor-ready proof of human review on every AI-assisted note. Below is the operational sequence Scribing.io recommends for organizations transitioning from legacy AI scribe workflows.

Phase 1: Baseline Audit Readiness Assessment (Week 1–2)

• Export 20 recently signed AI-assisted notes from your current vendor.

• For each note, attempt to produce: (a) pre-signature review start time, (b) review duration, (c) edit diff, (d) version-locked link between reviewed draft and signed version.

• Score each note: Can you produce all four elements in under 60 seconds? If not, you have an authorship verification gap.

• Document the gap in a one-page report formatted for your MAC's supplemental documentation requirements.

Phase 2: Scribing.io Integration and Clinician Onboarding (Week 2–4)

• Deploy Scribing.io's ambient capture and review interface. Integration with Epic, athenahealth, and Oracle Health is supported via certified SMART on FHIR connections.

• Configure Dwell Time thresholds. Scribing.io allows compliance officers to set minimum review duration alerts—e.g., flag any note where dwell_time_seconds < 30 for a standard E/M note—enabling real-time identification of potential batch-signing behavior.

• Train clinicians on the review interface. Critical teaching point: the review workflow adds no clicks. Dwell Time capture is passive. The clinician's only obligation is to do what they should already be doing—read the note before signing it.

Phase 3: Ongoing Monitoring and Audit Readiness (Continuous)

• Monitor Dwell Time dashboards weekly. Identify providers whose average dwell time falls below clinically reasonable thresholds.

• Run quarterly mock audits: select 10 notes at random, export Authorship Packets, and verify that each packet is complete and exportable in under 60 seconds.

• Maintain a standing Authorship Packet archive. Scribing.io retains all packet data for a minimum of 7 years, aligned with CMS's medical record retention requirements per the Medicare Fee-for-Service Compliance Programs retention guidelines.

Addressing the 5 Remaining Denials

In the cardiology group scenario, 5 of 38 denials survived the Authorship Packet defense. In every case, the denial was sustained on clinical documentation insufficiency—the note lacked medical necessity language for the level of E/M billed, independent of the authorship question. This is a documentation quality issue, not an authorship verification issue, and it reinforces the principle that pre-signature review proof is necessary but not solely sufficient. Clinicians must still ensure that the content of the note—not just the proof of review—supports the billed service. Scribing.io's specificity scoring (described in the ICD-10 section above) addresses this complementary vector.

7. Next Step: Book a 15-Minute Workflow Audit

Can your current AI scribe stack produce auditor-ready proof of human review in under 60 seconds per note?

Book a 15-minute Workflow Audit with Scribing.io to get a free 5-note Authorship Readiness test. We'll run your existing notes through our audit simulation and deliver:

• A pass/fail score for each note across the four Authorship Packet elements (dwell time, edit diff, version lock, FHIR Provenance)

• A one-page gap report you can hand directly to your MAC showing your current state and remediation path

• A projected audit exposure estimate based on your note volume, payer mix, and specialty denial benchmarks

No contract required. No integration necessary for the assessment. We use exported note metadata you already have access to.

→ Book your 15-minute Workflow Audit at Scribing.io

Disclaimer: This playbook is provided for informational purposes and does not constitute legal or compliance advice. Organizations should consult qualified healthcare compliance counsel for guidance specific to their circumstances. All CMS, AMA, and HL7 references are current as of the publication date.

© 2026 Scribing.io. All rights reserved.