AI Documentation for Alma Providers: Telehealth MDM Compliance, 42 CFR Part 2 Segregation, and the End of "Brief Note" Audit Exposure

Operations Playbook — Lead Clinical Consultant, Scribing.io | Updated June 2026

TL;DR

Alma-contracted PMHNPs billing telehealth encounters with the platform's "Brief Note" template face a compounding audit risk: insufficient MDM specificity for E/M levels, missing telehealth-required elements (consent, modality, locations), and—most critically—commingled psychotherapy process notes and billable progress notes that trigger 42 CFR Part 2 violations. Beginning February 16, 2026, updated Part 2 rules expect DS4P-style data segmentation with consent traceability. Most AI scribes, including general-purpose psychiatric documentation tools, capture session content without distinguishing protected SUD psychotherapy material from billable records. Scribing.io auto-separates Part 2 content using HL7 FHIR DS4P security labels, validates telehealth E/M logic including POS 10 + modifier 95, and outputs audit-ready progress notes with claim attachments—closing the gap that costs Alma providers thousands in postpay clawbacks.

• Why Alma's "Brief Note" Creates a Three-Layer Audit Exposure

• The 2026 42 CFR Part 2 Update: DS4P Data Segmentation and Consent Traceability

• Scribing.io Clinical Logic: Resolving the Alma PMHNP Telehealth Audit Scenario

• Telehealth MDM Documentation Architecture for PMHNP-BC Encounters

• Technical Reference: ICD-10 Documentation Standards for OUD + Recurrent MDD

• What General Psychiatric AI Scribes Miss: An Information Gain Analysis

• Implementation Workflow: Alma Practice → Scribing.io Integration

• Compliance Checklist and Decision Matrix for Alma Telehealth Encounters

Why Alma's "Brief Note" Creates a Three-Layer Audit Exposure

Alma's practice management platform provides contracted providers with a streamlined "Brief Note" documentation template designed for speed. For the solo PMHNP-BC running a full telepsychiatry panel, this efficiency is seductive—and dangerous. The Brief Note's structural simplicity creates three distinct but overlapping audit vulnerabilities that compound when they appear in a single encounter. This is the core problem that Scribing.io was engineered to solve, and understanding the failure mode is prerequisite to understanding the fix.

Layer 1: MDM Specificity Deficiency

Insurance postpay audits for E/M services (99211–99215) evaluate Medical Decision Making across three components defined by the 2021 AMA E/M guidelines: number and complexity of problems addressed, amount and/or complexity of data reviewed and analyzed, and risk of complications and/or morbidity or mortality of patient management. Alma's Brief Note does not structurally prompt providers to articulate each MDM element explicitly.

A PMHNP documenting a follow-up for a patient with co-occurring opioid use disorder and recurrent major depressive disorder may write something functionally accurate but auditably insufficient—such as "Reviewed medications, patient reports improved mood, continue current regimen." This fails to specify:

• Which problems were addressed at the encounter (not the problem list—the encounter-specific clinical reasoning)

• What data was reviewed (PDMP check, lab results, external records, prior notes)

• What risk category the management decisions fall into (prescribing controlled substances = high risk under CMS MDM table)

For practices already using AI-assisted documentation in other EHR ecosystems, the contrast is stark. Providers leveraging Epic Integration workflows or athenahealth API connections with Scribing.io already benefit from structured MDM prompting that eliminates this gap at the point of documentation—not retroactively during audit response.

Layer 2: Telehealth Element Omissions

CMS telehealth billing requirements for dates of service in 2025–2026 mandate documentation of:

• Interactive audio-video modality (or audio-only with appropriate modifier)

• Patient informed consent for the telehealth encounter

• Patient location at the time of service (including state, and whether the originating site is the patient's home)

• Provider location

• Place of Service code: POS 10 (Telehealth Provided in Patient's Home) vs. POS 02 (Telehealth Provided Other than in Patient's Home)

• Modifier 95 for synchronous real-time audio/video, or modifier FQ for audio-only

Alma's Brief Note does not enforce structured capture of these elements. When they are missing, the claim survives initial adjudication—but fails postpay review. The CMS telehealth policy page details these requirements, but the translation from policy text to documentation architecture is where providers lose money.

Layer 3: 42 CFR Part 2 Commingling

This is the layer that transforms a billing dispute into a federal compliance finding. When a PMHNP documents a therapy session with a patient receiving SUD treatment, the clinical record may contain psychotherapy process notes—the therapist's observations about the therapeutic relationship, transference dynamics, countertransference, and session-by-session psychological content. Under 42 CFR Part 2, SUD treatment records carry heightened confidentiality protections. These process notes, when commingled with the billable progress note, create a record that:

1. Cannot be disclosed to the insurer without patient-specific Part 2 consent

2. If disclosed, triggers redisclosure prohibition violations

3. Exposes the provider to both HIPAA and Part 2 enforcement actions simultaneously

Research published in JAMA Psychiatry has repeatedly documented the clinical integration of SUD and mood disorder treatment in psychiatric practice. The documentation challenge is that good clinical care—treating the whole patient—produces high-risk documentation when process and progress notes are not structurally separated. Template-based systems like Alma's Brief Note do not address this.

For a PMHNP seeing 20+ patients per week with a mixed OUD/MDD panel, a single postpay audit sampling 20 encounters can generate clawback demands exceeding $8,000—before Part 2 penalties are assessed.

The 2026 42 CFR Part 2 Update: DS4P Data Segmentation and Consent Traceability

On February 16, 2026, updated 42 CFR Part 2 regulations took effect with provisions that fundamentally change how SUD treatment documentation must be managed within electronic health records and AI-assisted documentation systems. These updates, finalized as part of SAMHSA and HHS's multi-year effort to align Part 2 with HIPAA while preserving heightened SUD confidentiality, introduce expectations that most AI medical scribes—including those marketed to psychiatric practices—are architecturally unprepared to meet.

What Changed: The DS4P Expectation

The updated rules do not mandate a specific technical standard by name, but they create regulatory expectations that map directly to the HL7 FHIR Data Segmentation for Privacy (DS4P) framework. Specifically:

Consent Traceability: Every disclosure of Part 2–protected SUD information must be traceable to a specific, time-bound patient consent. This is not the general HIPAA treatment/payment/operations consent. It is a Part 2–specific authorization that identifies the patient, the entity permitted to receive the information, the specific purpose of the disclosure, the expiration date or condition, and a unique consent identifier.

Data Segmentation: Part 2–protected content must be distinguishable from non-Part 2 content in the electronic record. When a progress note is transmitted to a payer for claims adjudication, Part 2 material must either be excluded or accompanied by proper consent documentation. The ONC's health IT privacy guidance anticipates that systems will implement segmentation at the data element level—not merely the document level.

Redisclosure Restrictions with Machine-Readable Flags: Recipients of Part 2 information must be notified that redisclosure is prohibited. The updated rules anticipate that electronic transmissions will carry redisclosure prohibition metadata—a direct parallel to HL7 FHIR security labels.

How This Maps to HL7 FHIR DS4P

Why Most AI Scribes Fail This Test

General-purpose psychiatric AI scribes—including tools that advertise "psychotherapy note generation"—typically produce a single, monolithic note per encounter. They may separate medication management documentation from psychotherapy documentation at the template level, but they do not:

1. Tag SUD-related content with machine-readable security labels

2. Generate or reference a Part 2 Consent ID within the note metadata

3. Apply redisclosure flags to content that will be transmitted to payers

4. Segregate psychotherapy process notes (therapist's private clinical observations) from progress notes (the billable record of the encounter)

5. Validate that Part 2 content is excluded from claim attachments submitted via 837P transactions

This is not a theoretical gap. When a postpay auditor requests documentation supporting a 99214 + 90833 claim for a patient with opioid dependence, and the provider submits a note containing psychotherapy process material discussing the patient's substance use patterns, cravings, and relapse triggers, the auditor has received Part 2–protected information—potentially without valid Part 2 consent. The audit itself becomes a compliance event.

Scribing.io Clinical Logic: Resolving the Alma PMHNP Telehealth Audit Scenario

This section walks through the exact clinical scenario that generates the most common—and most expensive—audit failure pattern for Alma-contracted PMHNPs, then provides a granular, step-by-step logic breakdown of how Scribing.io's documentation engine resolves each vulnerability in real time.

The Scenario

An Alma-contracted PMHNP-BC conducts a home-based video follow-up for a patient diagnosed with opioid use disorder (F11.20) and recurrent major depressive disorder, moderate (F33.1). The encounter involves medication management review (buprenorphine/naloxone dosing, SSRI optimization), 20 minutes of psychotherapy addressing relapse prevention and cognitive-behavioral strategies for depressive rumination, PDMP review, urine drug screen interpretation, and PHQ-9 reassessment. The PMHNP bills 99214 (established patient, moderate complexity MDM) + 90833 (psychotherapy add-on, 16–37 minutes) using Alma's Brief Note template.

The Audit Finding: $8,540 Postpay Demand

Six months later, a commercial payer postpay audit samples 20 encounters. The audit letter identifies three findings:

Finding 1 – MDM Elements Not Explicit: The notes describe clinical activity but do not separately articulate the three MDM components. "Reviewed PDMP and UDS, adjusted medications" does not establish the data complexity category or link the management decision to a risk level. The auditor downcodes 12 encounters from 99214 to 99213.

Finding 2 – Telehealth Documentation Incomplete: No encounters document patient informed consent for telehealth. Patient location is stated as "home" without a state. Provider location is absent. POS and modifier are on the claim but unsupported by the note. Eight encounters are denied entirely.

Finding 3 – 42 CFR Part 2 Violation: The progress notes submitted as audit documentation contain psychotherapy process content discussing the patient's opioid cravings, relapse triggers, and substance use behavioral patterns. This Part 2–protected content was transmitted to the payer's audit contractor without patient-specific Part 2 consent. The payer flags a compliance finding and initiates a record recall.

How Scribing.io Prevents Every Finding: Step-by-Step Logic

Step 1: Encounter Initialization and Telehealth Element Capture

When the PMHNP launches Scribing.io for the encounter, the system detects the modality (video) and prompts structured capture of telehealth-required elements before documentation begins:

• Modality confirmation: Synchronous audio-video (real-time interactive)

• Patient verbal consent for telehealth: captured with timestamp

• Patient location: Patient's home, [State] — system confirms originating site = home

• Provider location: [Provider city, state]

• System auto-selects POS 10 (patient at home) and modifier 95 (synchronous audio-video). If the provider indicates audio-only, the system switches to modifier FQ and validates that the service is on the CMS audio-only eligible list.

These elements are written into the note header as structured data. They are also mapped to the 837P claim attachment so the note and claim are internally consistent—the exact alignment auditors verify.

Step 2: MDM-Structured Documentation Prompts During Session

As the PMHNP speaks during the encounter, Scribing.io's ambient capture engine processes the clinical conversation and maps content to the three MDM components in real time:

Problems Addressed: The system identifies from the audio stream that two active problems are being addressed at this encounter—opioid use disorder (chronic, on buprenorphine maintenance) and recurrent MDD (moderate, on SSRI). It codes these as two chronic illnesses with mild exacerbation or progression, satisfying the "moderate" number/complexity threshold per the AMA MDM table.

Data Reviewed and Analyzed: The system detects references to PDMP review (external data source), urine drug screen results (independent interpretation of a test), and PHQ-9 score comparison to prior visit. It categorizes these as moderate data complexity: review of external data from an independent source (PDMP) plus independent interpretation of a test (UDS) plus assessment using a validated instrument (PHQ-9). Each data element is named and dated in the note.

Risk of Management: The system identifies that the provider is prescribing buprenorphine/naloxone (a DEA Schedule III controlled substance) and adjusting an SSRI. Prescribing a controlled substance with potential for significant drug interactions and physiological dependence = high risk under the CMS MDM risk table. The system flags this as the controlling MDM element and confirms 99214 is the appropriate E/M level (moderate complexity requires two of three elements at moderate or higher; risk alone at high satisfies the level).

Step 3: Psychotherapy Content Detection and Note Bifurcation

This is the critical differentiator—the Anchor Truth of this playbook. During the 20-minute psychotherapy portion, the PMHNP discusses relapse prevention strategies, explores the patient's cognitive distortions related to depressive rumination, and addresses the patient's emotional response to a recent relapse trigger. Scribing.io's NLP engine classifies this content into two streams:

Stream A — Billable Progress Note (90833 documentation): Clinical summary appropriate for payer review. Includes: type of psychotherapy delivered (CBT-based relapse prevention + cognitive restructuring), duration (20 minutes), presenting focus (depressive rumination and relapse risk management), patient's response to interventions, and clinical progress toward treatment goals. No protected process content. No SUD-specific behavioral details that constitute Part 2 material.

Stream B — Psychotherapy Process Notes (sequestered, not billable): The therapist's session-specific observations: patient's emotional state during discussion of opioid cravings, transference dynamics observed, specific relapse trigger details (person, place, circumstance), and countertransference notes. This content is tagged with DS4P security labels:

• Resource.meta.security = 42CFRPart2

• Resource.meta.security = NOREDISCLOSURE

• Linked to a Consent.identifier (the patient's active Part 2 consent ID, or flagged as "consent required before disclosure")

Stream B is stored in a separate document container. It is never included in claim attachments, audit response packages, or 837P transmissions. It is accessible only to the treating provider and authorized clinical staff under the Part 2 consent parameters.

Step 4: 90833 Time and Intervention Validation

Scribing.io tracks psychotherapy time from the audio stream. The system confirms that psychotherapy occupied 20 minutes of the encounter—within the 16–37 minute range required for 90833 billing. It documents the start and stop times, the specific evidence-based interventions used (CBT techniques for relapse prevention, cognitive restructuring for depressive rumination), and the patient's in-session response. This satisfies the CPT requirement that 90833 documentation demonstrate what was done, for how long, and with what clinical effect—not merely that psychotherapy occurred.

Step 5: Output Generation — Compliant Progress Note and Claim Attachment

Scribing.io generates two distinct outputs:

1. Audit-Ready Progress Note: Contains MDM-structured E/M documentation (problem/data/risk explicitly articulated), 90833 psychotherapy summary (intervention type, duration, response), telehealth elements (consent, modality, locations, POS 10 + modifier 95), and ICD-10 codes at maximum specificity. No Part 2 process content.

2. Claim Attachment (837P-aligned): A stripped, payer-appropriate version of the progress note that includes the clinical elements supporting the billed codes. Part 2 content is excluded by architecture, not by provider memory. The attachment carries the correct POS and modifier, matching the electronic claim.

The sequestered process note (Stream B) exists in the clinical record for the provider's use, labeled and consent-tracked per DS4P/Part 2 standards. If an auditor requests documentation, the system delivers only the progress note and claim attachment. The process note is not included unless the provider affirmatively initiates a Part 2 consent-validated disclosure—and the system logs that decision with the consent ID.

Result: Denial averted. All three audit findings—MDM specificity, telehealth elements, Part 2 commingling—are structurally impossible when Scribing.io generates the documentation.

Telehealth MDM Documentation Architecture for PMHNP-BC Encounters

The 2021 AMA E/M framework allows MDM-based or time-based code selection for office/outpatient visits. For PMHNP telehealth encounters involving both medication management and psychotherapy, MDM-based selection is almost always the correct approach because the psychotherapy time is separately reported with the add-on code (90833/90836/90838). Using total time would create a double-counting problem. This section establishes the documentation architecture that supports MDM-based E/M selection for the telepsychiatry use case.

MDM Component Documentation Requirements

The POS 10 vs. POS 02 Decision Logic

CMS instruction is unambiguous: if the patient is at home, use POS 10. If the patient is at another telehealth-eligible originating site (clinic, hospital, SNF), use POS 02. The payment differential matters—some payers apply facility-rate reductions for POS 02 that do not apply to POS 10. Scribing.io's logic tree:

1. Patient location = home → POS 10

2. Patient location = non-home clinical site → POS 02

3. Modality = synchronous audio-video → modifier 95

4. Modality = audio-only → modifier FQ + validation against CMS audio-only eligible service list

5. If audio-only AND service not on eligible list → hard stop with provider alert

Technical Reference: ICD-10 Documentation Standards for OUD + Recurrent MDD

ICD-10 specificity is a front-line defense against claim denials and downcoding. For the co-occurring OUD + recurrent MDD patient population that defines the Alma PMHNP audit risk profile, two code families require precise documentation to reach maximum specificity.

Opioid Use Disorder Coding

F11.20 Opioid dependence is the base code for opioid use disorder without specification of remission status or complications. Scribing.io's documentation engine prompts the provider to specify:

• Remission status: Is the patient in early remission, sustained remission, or not in remission? This changes the code (F11.21 for in remission) and affects medical necessity justification for continued treatment intensity.

• Complication specificity: If the patient has opioid-induced mood disorder, sleep disorder, or other complications, Scribing.io prompts for the additional code and links the documentation to the specific complication addressed at the encounter.

• Treatment context: The note must support that the encounter addressed OUD management—not merely that OUD appears on the problem list. Scribing.io extracts encounter-specific OUD management actions (buprenorphine dose review, PDMP check, UDS interpretation) and links them to the diagnosis code in the note body.

Recurrent MDD Coding

F33.1 Major depressive disorder, recurrent, moderate requires documentation that establishes three axes of specificity:

• Recurrent vs. single episode: The note must reference prior depressive episodes or carry forward the history of recurrence. Scribing.io pulls this from the problem list history and prompts confirmation at each encounter.

• Severity specification (moderate): The note must include a validated severity measure. A PHQ-9 score of 10–14 supports "moderate" classification per validated thresholds (Kroenke et al., JGIM 2001). Scribing.io flags encounters where the billed code includes a severity qualifier but no validated instrument score appears in the note—a common cause of medical necessity denials.

• With or without psychotic features: F33.1 specifies "without psychotic features" by exclusion. If psychotic features are present, the code shifts to F33.3. Scribing.io's diagnostic validation checks the note for any mention of psychotic symptoms and alerts the provider if a code mismatch exists.

The critical point: ICD-10 denials for this population are almost never about picking the wrong code. They are about the note failing to contain the clinical evidence that supports the code's specificity. When an auditor sees F33.1 on the claim and "depression, stable" in the note, the code is unsupported. When the note says "PHQ-9 score 12 (moderate), consistent with recurrent MDD pattern; third documented episode; no psychotic features"—the code is bulletproof.

What General Psychiatric AI Scribes Miss: An Information Gain Analysis

The psychiatric AI scribe market in 2026 includes multiple products that claim to handle psychotherapy documentation. The differentiator is not whether a tool can generate a therapy note—it is whether the tool understands the regulatory topology of that note. Here is what general-purpose tools miss:

The information gain is not incremental. It is categorical. A tool that produces a single undifferentiated note for an OUD + MDD patient on a telehealth encounter is not partially compliant—it is structurally incompatible with 2026 Part 2 expectations. The provider using that tool is one audit away from a compliance event that no amount of after-the-fact documentation correction can resolve, because the unauthorized disclosure has already occurred.

Implementation Workflow: Alma Practice → Scribing.io Integration

Alma-contracted providers operate within Alma's practice management ecosystem, which handles scheduling, insurance verification, and claims submission. Scribing.io integrates at the documentation layer—after scheduling and before claim submission—without replacing Alma's platform functions.

Integration Steps

1. Account Configuration (15 minutes): Provider creates Scribing.io account, inputs NPI, taxonomy code (363LP0808X for PMHNP), state licensure jurisdictions, and Alma payer panel information. System configures telehealth compliance rules for each state's consent requirements.

2. Template Selection: Provider selects the "PMHNP Telehealth — E/M + Psychotherapy Add-On" documentation template. This template activates MDM component prompting, psychotherapy time tracking, telehealth element capture, and the Part 2 content segregation engine.

3. EHR/Practice Management Mapping: Provider configures the output destination. For Alma practices, Scribing.io generates a downloadable or API-pushed note in the format Alma accepts for claims attachment. The note is also available as a standalone PDF for the provider's clinical record.

4. Part 2 Consent Registry Setup: Provider inputs active Part 2 consent parameters for SUD patients: which payers have valid Part 2 consent, consent expiration dates, and scope of permitted disclosures. Scribing.io's system checks these parameters before allowing any Part 2 content to be included in outbound documentation.

5. First Encounter Calibration: During the first 2–3 encounters, the provider reviews Scribing.io's output for clinical accuracy and adjusts verbosity preferences, preferred terminology, and intervention cataloging. The system's adaptive learning refines output to match the provider's clinical voice.

Ongoing Workflow

For each encounter, the provider's workflow changes minimally:

• Launch Scribing.io at encounter start (ambient capture begins)

• Confirm telehealth elements when prompted (5-second interaction)

• Conduct the encounter normally

• Review the generated note within 2 minutes of encounter end

• Approve and push to Alma for claims attachment

Total added time per encounter: under 3 minutes. Documentation accuracy gain: structural elimination of all three audit exposure layers.

Compliance Checklist and Decision Matrix for Alma Telehealth Encounters

Use this checklist for every Alma telehealth encounter involving E/M + psychotherapy add-on billing for patients with SUD diagnoses. If any element is missing, the encounter is audit-vulnerable.

Every "No" in the "Present Without Scribing.io?" column represents a documentation gap that exists in the Alma Brief Note workflow by default. Every "Yes" in the "Auto-Generated by Scribing.io?" column represents a gap closed by architecture, not by provider vigilance. The distinction matters because provider vigilance is the first thing that erodes at encounter 18 on a Tuesday afternoon.

Book a 12‑minute demo to see our 2026 Part 2 DS4P note‑segregation plus Telehealth E/M MDM auto‑validator with POS 10/modifier 95 and audio‑only FQ checks mapped to Alma claim workflows. Schedule at Scribing.io.