How the Designated Record Set Definition Treats AI-Drafted Content
45 CFR 164.524 grants individuals the right to inspect and obtain copies of protected health information held in a designated record set, subject to limited exceptions such as psychotherapy notes and information compiled for legal proceedings. The designated record set itself is defined at 45 CFR 164.501 in functional terms: records used, in whole or in part, by or for a covered entity to make decisions about individuals, including medical and billing records.
That definition does not reference authorship method. Inclusion in the designated record set depends on whether the record functions in decision-making about the patient, not on whether a clinician typed it, dictated it, or an AI system drafted it. This means AI-generated clinical note content is not automatically excluded from right of access obligations simply because it originated from an ambient scribe or LLM-based documentation agent rather than a human author.
HHS OCR has not published guidance that directly interprets 164.524 as applied to AI-drafted or pre-finalization clinical note content. Compliance teams are currently working from the general rule text rather than AI-specific regulatory interpretation, which creates an inferential gap that policy and process must close in the absence of direct guidance.
Key Compliance Anchors
Several provisions form the practical backbone of how covered entities should reason about AI-generated notes under existing HIPAA and health IT rules:
| Citation | Relevance to AI clinical notes |
|---|---|
| 45 CFR 164.524 | Right of Access: 30-day response requirement, with one permissible 30-day extension with written notice. |
| 45 CFR 164.501 | Designated record set defined by function in decision-making, not by whether content is human- or AI-authored. |
| 45 CFR 164.312(b) | Security Rule audit controls required for any system, including AI documentation tools, that touches ePHI. |
| ONC HTI-1 | Transparency requirements for predictive decision support embedded in certified health IT. |
Draft Versus Finalized Content: Where the Compliance Question Sits
The practical compliance question is not whether AI-generated notes can ever be part of the designated record set, but at what point AI-drafted content transitions into it. A note generated by an ambient scribe and awaiting clinician review is functionally different from the same note after clinician co-signature, yet both may exist in the same chart at different times.
Covered entities should document a clear policy defining the point at which AI-drafted content becomes part of the designated record set, commonly upon clinician review and co-signature. This policy determines what must be produced in response to an access request and when. It also determines how draft content that is edited or discarded before finalization should be treated for retention and disclosure purposes.
The accounting-of-disclosures provision at 45 CFR 164.528 exempts disclosures for treatment, payment, and healthcare operations, which limits standalone accounting obligations for internal AI-drafting activity. However, this exemption does not remove the underlying access and audit control obligations that apply once AI-drafted content is incorporated into the record.
Provenance and Audit Trail Requirements for AI-Generated Notes
Once AI systems contribute language to clinical documentation, provenance and auditability become central to fulfilling access requests and defending the integrity of the chart. In practice, teams need to answer three related questions for every note that involves AI assistance:
- What portion of the note was machine-drafted versus clinician-authored or clinician-edited?
- At what lifecycle stage did the content sit when an access request arrived (draft, under review, or finalized)?
- Can audit logs demonstrate who (or what system) created, modified, approved, or discarded that content?
These questions map directly to Security Rule audit control expectations under 45 CFR 164.312(b) and to the operational work of producing a complete, timely response under 45 CFR 164.524. Without reliable distinction between AI draft content and finalized clinician content, staff may over-disclose, under-disclose, or miss content that belongs in the designated record set.
Governance Controls to Meet Access and Disclosure Timelines
Covered entities must act on access requests within 30 calendar days, with one permissible 30-day extension if the individual is notified in writing of the reason for delay. When AI-generated content is part of the chart, meeting this timeline depends on whether staff and systems can reliably identify what AI-originated content exists, where it sits in the draft-to-final lifecycle, and whether it falls within the designated record set at the time of the request.
This requires assigning clear accountability for AI documentation tool oversight within existing HIPAA privacy and compliance program structures, rather than treating AI tool governance as a separate workstream. Access permissions and tool-call logging for AI documentation agents should be sufficient to withstand OCR audit scrutiny, particularly given OCR's Right of Access Initiative, active since 2019, which has produced numerous enforcement resolutions against covered entities for failing to provide timely record access.
ONC's HTI-1 Final Rule adds transparency requirements for certified health IT that incorporates predictive decision support, including source attribute disclosures relevant to AI-enabled documentation tools embedded in certified EHR technology. Whether these transparency expectations extend to standalone ambient scribe products outside certified EHR modules is not clearly established and depends on the specific deployment architecture. Runtime governance controls that enforce access permissions and produce tool-call level audit logs for AI agents can support these obligations, but they supplement policy and process rather than replace the underlying compliance determinations a covered entity must make.
Vendor Evaluation Criteria for AI Clinical Documentation Tools
When assessing ambient scribes or AI documentation agents, compliance and privacy teams can use the following criteria to test whether a product can support right-of-access and audit obligations in production:
- Can the vendor produce an auditable log distinguishing AI-generated draft content from clinician-edited or finalized content for each note?
- How does the system support fulfillment of a 30-day, or extended, HIPAA access request when AI-generated content is part of the chart?
- What data retention and deletion policies apply to AI-generated drafts, and how do they align with designated record set obligations?
- Does the tool operate within certified EHR technology subject to ONC transparency requirements, or as a standalone system?
- What audit control capabilities does the tool provide under 45 CFR 164.312(b), and can logs be exported for OCR audit or patient dispute resolution?
Common Questions
Does AI authorship change whether a note is in the designated record set?
No. 45 CFR 164.501 defines the designated record set by function in decision-making about the individual, not by authorship method. AI-drafted content used to make decisions about a patient is not excluded merely because a machine produced the first draft.
When should AI-drafted content enter the designated record set?
Covered entities should document a clear policy. A common approach is to treat content as part of the designated record set upon clinician review and co-signature, while separately defining retention and disclosure treatment for drafts that are edited or discarded before finalization.
Do accounting-of-disclosures rules create extra burden for internal AI drafting?
45 CFR 164.528 exempts disclosures for treatment, payment, and healthcare operations, which limits standalone accounting obligations for internal AI-drafting activity. That exemption does not remove access or audit control obligations once AI-drafted content is incorporated into the record.
What timeline applies to access requests that include AI-generated chart content?
The same 30-calendar-day response requirement under 45 CFR 164.524 applies, with one permissible 30-day extension if the individual is notified in writing of the reason for delay. AI involvement does not create a separate statutory clock.