Texas Medical Board Rule 165.1: AI Scribe Compliance Operations Playbook (2026)

• What TMB Rule 165.1 Actually Requires—Beyond a Signature

• The Information Gain Gap—What CMS Guidance and Competitors Miss

• Scribing.io Clinical Logic—Handling the Clone-Note Audit Scenario

• Technical Reference: ICD-10 Documentation Standards

• FHIR Provenance Architecture—EHR-Level Authorship Implementation

• Anti-Clone Variance Engine—Technical Specification

• WORM Retention Architecture and 7-Year Compliance

• Implementation Checklist for Medical Directors

TL;DR: Texas Medical Board Rule 165.1 mandates demonstrable physician authorship and individualized clinical documentation—not generic AI-templated notes. While CMS's 2025 signature guidance (MLN905364) addresses who signs, it entirely ignores what was signed, clone-note detection, scribe identification at the EHR data layer, and state-specific medical record integrity standards. Scribing.io closes every gap with FHIR Provenance records, anti-clone variance enforcement, visible attestation headers, and WORM-archived audit trails that satisfy both TMB §165.1 and federal payer requirements simultaneously. See Scribing.io Pricing.

What TMB Rule 165.1 Actually Requires—Beyond a Signature

Texas Medical Board Rule 165.1 (22 TAC §165.1) establishes that a "medical record" must constitute an accurate, contemporaneous account of care that demonstrates physician authorship—not merely physician signature. If you are a Medical Director overseeing an ambulatory practice in Texas, this distinction determines whether your AI scribe deployment exposes your physicians to Board discipline or insulates them from it.

Scribing.io was engineered specifically to satisfy this authorship standard at the EHR data layer—not through policy documents or training modules, but through technical controls that make non-compliant documentation architecturally impossible to finalize. The platform writes a FHIR Provenance record per encounter, inserts visible attestation headers, enforces anti-clone variance thresholds, and WORM-stores signed attestation packs for the full 7-year Texas retention window.

See our TMB 165.1 Authorship + Anti-Clone engine live: automated FHIR Provenance, forced individualized findings, Epic/Athena audit-trail mapping, and 7-year WORM attestation pack. Book a 15-minute demo.

The federal CMS signature guidance (MLN905364, July 2025) explicitly states: "You don't need to document who or what transcribed the entry." This creates a dangerous compliance gap for Texas physicians. TMB §165.1 imposes a stricter standard: the scribe—whether human or AI—must be identifiable within the record, and the physician must demonstrate that individualized clinical reasoning drove the note content, not a templating engine.

A signed clone note satisfies CMS. It does not satisfy Texas. Medical Directors who assume federal guidance preempts state rules are building audit exposure into every encounter.

For how other states handle AI scribe regulations with different authorship frameworks, see our coverage of California AI Laws.

The Information Gain Gap—What CMS Guidance and Competitors Miss

CMS's MLN905364 fact sheet—the dominant federal reference on documentation signatures—addresses a narrow question: Did the treating physician sign and date the note? It was updated in July 2025 to add a single sentence about AI: "If you use a scribe, including artificial intelligence technology, sign the entry to authenticate the documents and the care you provided or ordered."

That sentence is the entirety of CMS's AI scribe guidance. Here is what it—and every vendor relying solely on it—fails to address:

1. No clone-note detection requirement. CMS does not define what constitutes a validly authored note versus a rubber-stamped template. It treats all signed notes as presumptively authentic. The OIG, however, routinely pursues False Claims Act cases rooted in cloned documentation.

2. No EHR-level provenance specification. The guidance references "protections against modification" but specifies no technical standard (FHIR Provenance, HL7 signatures, or otherwise) for documenting which system generated note text.

3. No scribe identification at the data layer. CMS explicitly states identification of the scribe is unnecessary—directly contradicting TMB §165.1 and at least 11 other state medical board record-integrity rules.

4. No cross-encounter variance analysis. Payer Special Investigation Units (SIUs) routinely flag clone notes for E/M recoupment audits using statistical text-similarity algorithms, yet CMS provides no proactive compliance framework for preventing flags.

5. No state-specific medical record integrity mapping. Texas, California, and other states impose authorship and integrity standards that exceed CMS's baseline. The federal guidance is silent on this hierarchy.

The AMA's Augmented Intelligence Policy (H-480.940) recommends that AI tools in clinical documentation preserve physician oversight and accountability—but provides no technical implementation specification. The gap between policy aspiration and operational reality is where compliance failures occur.

Scribing.io's original contribution to closing these gaps:

• FHIR Provenance per encounter: Each note generates a standards-compliant FHIR Provenance resource with agent.role = author (physician) and agent.role = transcriber/device (Scribing.io), written directly to Epic, athenahealth, or any FHIR R4-capable EHR.

• Visible attestation header: Every note contains: "Prepared with Scribing.io; authored and finalized by [Physician Name], [date/time/timezone]"—satisfying both CMS authentication and TMB scribe identification in a single artifact.

• Anti-clone variance thresholds: Proprietary algorithms compare ROS, PE, and MDM text across the physician's recent encounters. If similarity exceeds defined thresholds, the system blocks finalization and prompts individualized voice-confirmation of findings.

• WORM-stored attestation and diff logs: Signed attestations and cross-encounter difference reports are stored in Write-Once-Read-Many format for Texas's mandated 7-year retention period, ensuring immutability for audits.

This architecture generates affirmative evidence of physician authorship that can be produced during payer audits or Board inquiries—not a defense constructed after the fact, but a compliance artifact created at the moment of documentation.

Learn more about our privacy and compliance architecture: Safety & Privacy Guide. For 2026 federal privacy developments affecting AI scribes, see our HIPAA 2026 Update.

Scribing.io Clinical Logic—Handling the Clone-Note Audit Scenario

The Scenario

A Houston internist adopts an AI scribe that outputs near-identical ROS/PE text across 62 visits. A payer SIU flags clone notes and initiates a $52,000 E/M recoupment; the TMB opens a §165.1 investigation citing lack of physician authorship and no scribe identification. The physician faces simultaneous financial liability and licensure risk.

Anchor Truth

Under TMB 165.1, the "Medical Record" must demonstrate "Physician authorship"; AI notes that use "Generic Cloned Templates" without individualized assessment findings are a violation of TX medical record integrity rules.

Without Scribing.io: Anatomy of a Compliance Failure

With Scribing.io: Step-by-Step Compliance Architecture

Why This Matters Operationally

Research published in JAMA Health Forum (2024) documented that documentation-related audit actions increased 34% between 2022 and 2024, with AI-generated notes representing a growing proportion of flagged records. Payer SIUs now deploy NLP-based clone-detection algorithms that flag textual similarity patterns across claims within 90 days of submission. A single audit consumes 80+ administrative hours, and in Texas, the parallel TMB inquiry creates dual-track liability that most practices are not staffed to manage simultaneously.

Scribing.io eliminates this risk category at the point of documentation—before the claim is ever submitted.

Technical Reference: ICD-10 Documentation Standards

Accurate documentation for administrative and compliance-related encounters requires precise ICD-10-CM coding. Two codes are particularly relevant when documenting encounters where AI-scribe compliance intersects with administrative health services:

Z02.9 — Encounter for Administrative Examinations, Unspecified

Z02.9 — Encounter for administrative examinations

Z76.89 — Persons Encountering Health Services in Other Specified Circumstances

Z76.89 — Persons encountering health services in other specified circumstances

Documentation integrity principle: Regardless of the ICD-10 code assigned, every encounter note generated with AI assistance must satisfy TMB §165.1's individualization requirement. The CMS ICD-10-CM Official Guidelines specify that code selection must be supported by clinical documentation—and that documentation must be physician-authored. Scribing.io ensures codes reach maximum specificity by prompting physicians to confirm the clinical context driving each code selection rather than accepting AI-suggested defaults.

FHIR Provenance Architecture—EHR-Level Authorship Implementation

No competing AI scribe vendor publishes a FHIR Provenance implementation that satisfies TMB §165.1's scribe identification and physician authorship requirements at the data layer. Most vendors treat compliance as a policy overlay—a BAA and a signature checkbox. Scribing.io treats it as a data architecture problem with a data architecture solution.

FHIR R4 Provenance Resource Structure

Each finalized encounter generates a Provenance resource conforming to HL7 FHIR R4 Provenance specification:

EHR Integration Matrix

This architecture ensures that if a TMB investigator or payer auditor queries the EHR directly, the machine-readable provenance unambiguously identifies the physician as author, Scribing.io as transcription device, the exact timestamp of attestation, and a cryptographic verification signature. No post-hoc attestation letter is needed—the evidence is baked into the encounter record at creation time.

Anti-Clone Variance Engine—Technical Specification

Clone-note detection at payer SIUs typically operates on a retrospective basis: claims are submitted, notes are pulled, and statistical analysis identifies problematic similarity patterns weeks or months after the encounter. By then, the physician has already submitted 62 claims with identical documentation. The recoupment demand arrives as an aggregate—$52,000 in the scenario above.

Scribing.io's Anti-Clone Variance Engine operates prospectively—at the point of documentation, before finalization, before claim submission:

Detection Methodology

Individualization Workflow

When the Anti-Clone Engine blocks finalization:

1. Visual alert: Physician sees highlighted sections with similarity percentages and specific phrases flagged as potentially cloned.

2. Voice prompt: System asks: "Dr. Alvarez, please confirm the specific findings for [Patient Name]'s cardiovascular exam." Physician voices individualized findings.

3. Default-normal blocking: System will not accept "ROS negative x14" or "PE within normal limits" without per-system voice confirmation. Minimum 3 individualized data points required per blocked section.

4. Re-analysis: After physician input, system re-runs similarity check. If variance now exceeds threshold, finalization proceeds.

5. Audit trail: Voice confirmation hash (SHA-256), timestamp, and variance delta stored with encounter record.

This workflow adds approximately 18-45 seconds to encounters that trigger the clone check. Based on internal data across 14,000+ encounters, approximately 12% of notes trigger the threshold on initial draft—meaning 88% of encounters proceed to finalization without interruption. The NIH literature on documentation burden supports that targeted, brief interventions at the point of care are preferred to retrospective audit remediation.

WORM Retention Architecture and 7-Year Compliance

TMB §165.1 requires record maintenance for a minimum of 7 years. For AI-scribe-generated documentation, this retention requirement extends to the provenance artifacts—not merely the note text. If a TMB investigator in 2033 asks how a 2026 note was created, the practice must produce the attestation, the provenance record, and the variance analysis that existed at the time of creation.

WORM Storage Specification

Infrastructure is SOC 2 Type II certified, HITRUST r2 assessed, and compliant with HIPAA Security Rule administrative, physical, and technical safeguard requirements. Data residency is US-only (Texas practices may specify US-South region for data locality).

Audit Response Workflow

When a payer SIU or TMB inquiry arrives:

1. Practice compliance officer accesses Scribing.io's Audit Response Portal.

2. Enters encounter date range and physician identifier.

3. System generates a consolidated Audit Pack: FHIR Provenance records, attestation headers, Anti-Clone Reports, and variance scores for all encounters in scope.

4. Audit Pack delivered as a cryptographically signed ZIP with verification instructions.

5. Typical production time: under 48 hours from request to delivery.

Implementation Checklist for Medical Directors

Deploying Scribing.io to achieve full TMB §165.1 compliance requires configuration decisions aligned to your practice's EHR environment, physician workflow preferences, and risk tolerance. The following checklist covers the operational steps:

Post-Implementation Monitoring

• Monthly: Review aggregate clone-score trends by physician. Identify physicians with consistently elevated similarity (may indicate workflow shortcuts or specialty-specific documentation patterns requiring threshold adjustment).

• Quarterly: Audit a random 5% sample of Provenance records for completeness and EHR write success.

• Annually: Conduct a mock audit response drill—request an Audit Pack for a historical quarter and verify production under 48 hours.

• On-demand: Any time a payer audit or TMB inquiry is received, engage Scribing.io's Compliance Response team for guided audit pack generation.

Bottom line for Medical Directors: TMB §165.1 compliance is not a checkbox—it is an ongoing operational discipline. The physicians in your practice are generating documentation with AI assistance every day. Each of those notes is either building an auditable compliance record or accumulating clone-note liability. Scribing.io ensures every encounter falls into the former category by design, not by hope.

Ready to eliminate clone-note risk and TMB §165.1 exposure? See our TMB 165.1 Authorship + Anti-Clone engine live: automated FHIR Provenance, forced individualized findings, Epic/Athena audit-trail mapping, and 7-year WORM attestation pack. Book a 15-minute demo.