Guide

The attestation line: your signature owns every drafted word

Summary

Read every word before you sign, edit anything that isn't accurate or isn't yours, and sign only once the note reflects your own clinical judgment — not the scribe's transcript or the AI's draft. Your signature or attestation certifies the content as authenticated, regardless of who or what produced the first draft. Medicare's signature guidance treats attestation as curing a missing signature, not as blessing unreviewed text — an unread draft with your name on it is your liability, not the tool's.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What attestation actually certifies

Attestation certifies that you reviewed the note and that it accurately reflects what happened and what you decided — not that a scribe was present, not that an AI transcribed accurately, and not that the software is reputable. Medicare's own signature guidance treats an attestation statement as the mechanism that authenticates a service, and it exists specifically to confirm the content, not to rubber-stamp the process that produced it 1Ref 1Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.Establishes that attestation authenticates content regardless of who drafted it, supporting that attestation certifies review, not the drafting process..

That means the standard is the same whether the first draft came from a human scribe sitting in the room or an AI model processing a recording afterward: you read it, you fix it, you sign it. The source of the draft changes your workflow. It does not change what your signature means once it's there.

Reading before signing isn't optional

A note you sign without reading carries your name and your license the same as one you wrote yourself, so skimming an AI draft for obvious errors and signing the rest unread is a bigger risk than most clinicians treat it as — attestation integrity depends entirely on the review actually happening, not on the review being fast. Build in the time for it the same way you'd build in time to write the note yourself; a scribe or AI tool is meant to change who drafts the first version, not to remove the step where you make it yours.

This matters even more in a therapy context than a general medical one: ai scribes in the therapy room are drafting from language that's often emotionally loaded, ambiguous, or deliberately vague on the patient's part, and an AI model summarizing that conversation can smooth over exactly the nuance your clinical judgment is supposed to capture.

Where scribes and AI differ from templates

A template is a structure you fill in yourself; a scribe or AI draft is content someone or something else generated on your behalf, which is a meaningfully bigger trust step even when the output looks polished. Treat a first draft from either source the way you'd treat a trainee's note: presumptively useful, never presumptively correct, and always subject to your own edit before it becomes part of the record.

The editing step is also where errors specific to AI drafting tend to surface — a plausible-sounding detail the model filled in that nobody actually said, a symptom summarized in clinical language the patient never used, a plan item that drifted from what you actually decided. None of these look like errors on a quick read; they look like normal clinical prose, which is exactly why the review has to be a real read, not a glance.

The vendor is a business associate, not just a convenience

A scribe service or AI documentation tool that creates, receives, maintains, or transmits PHI on your practice's behalf is a business associate under HIPAA, which means it needs a business associate agreement before you use it on real patient encounters, not after 2Ref 2HHS Office for Civil Rights (2026).Business Associates.Establishes that a vendor creating or transmitting PHI on the practice's behalf is a business associate requiring a BAA, supporting the scribe/AI-vendor contracting claim.. This applies equally to a human scribe service and to an AI vendor processing your audio or transcript — the technology doesn't change the legal category, and "the company seemed careful with data" isn't a substitute for the contract.

Before adopting either, confirm the BAA is actually in place and read what it says about data retention, deletion, and whether your recordings or transcripts train the vendor's models — a detail worth negotiating explicitly rather than assuming, since default terms vary widely and aren't always in your favor.

Coverage still tracks who actually did the clinical work

Medicare's Benefit Policy Manual sets documentation conditions for psychiatric services and incident-to billing specifically because coverage depends on which clinician's judgment the service actually reflects, not just whose name appears at the bottom 3Ref 3Centers for Medicare & Medicaid Services (2026).Medicare Benefit Policy Manual (Pub. 100-02).Supports that psychiatric-service and incident-to coverage depend on whose clinical judgment the service reflects, reinforcing why attestation must track the actual clinician.. A scribe or AI tool drafting the note doesn't change who furnished the service — it changes who typed the first version of the description of it — and your attestation is what tells a reviewer the two are the same.

Keep that distinction explicit in your own head even when it feels like a formality: the AI or scribe assisted with documentation, not with the clinical decision, and the note should never blur that line by reading as though the tool made a judgment call it isn't licensed to make.

The clinical judgment in the note has to be yours

Since 2021, an office visit's code level is set by medical decision making, not a history-and-exam checklist, and MDM is specifically your own assessment of the problems addressed, the data reviewed, and the risk of the plan 4Ref 4American Medical Association (2023).CPT evaluation and management (E/M) revisions.Establishes that MDM is the clinician's own assessment, supporting why an AI-drafted assessment must be checked against the clinician's actual judgment before signing.. CMS's E/M guide is clear that documentation has to support the level billed with content that reflects that judgment 5Ref 5Centers for Medicare & Medicaid Services (2023).Evaluation and Management Services Guide.Supports that documentation must support the billed level with content reflecting real clinical judgment, reinforcing the review-before-signing requirement. — an AI-drafted assessment that reads confidently but wasn't actually checked against your own clinical reasoning is a coding risk as much as a documentation one.

Read the assessment and plan sections with particular care before signing; that's where an AI draft is most likely to sound authoritative while actually paraphrasing the transcript rather than reflecting a decision you made.

Sign and lock, on your own timeline

APA's record-keeping guidance describes the content a behavioral health note is expected to carry without prescribing who drafts it first, which leaves you responsible for the final product regardless of the drafting tool 6Ref 6American Psychological Association (2007).Record Keeping Guidelines.Describes required BH record content without prescribing who drafts it, supporting that the clinician remains responsible for the final product regardless of drafting tool.. Build your own sign and lock habit around a scribe or AI workflow the same way you would around a fully self-written note — review promptly, correct what needs correcting, and don't let drafts pile up unsigned because reviewing an AI's output feels like it can wait.

Before signing off on any scribe or AI vendor, read what its contract says about your ability to export your own notes and terminate the relationship cleanly — the kind of data-access and termination terms any EHR contract should carry apply just as much to a scribe or documentation add-on, and a vendor that makes your own notes hard to extract is a liability on its own 7Ref 7Office of the National Coordinator (2016).EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print.Supports data-access and termination terms worth negotiating in any EHR-adjacent contract, applied here to scribe and AI-documentation vendor agreements.. Whatever you pay for the service belongs in the startup budget alongside your other recurring software costs, reviewed the same way you'd review any subscription that touches PHI.

Common questions

Best practice is yes, and for an AI tool recording or transcribing the session, disclosure and consent should happen before the recording starts, not after. Ai scribes in the therapy room raise consent questions a human scribe in the room doesn't always trigger the same way, so check what your state and your own ethics code require before adopting one.

Add a dated late entry or addendum correcting the error — don't edit the original signed text. The same correction discipline that applies to any signed note applies here regardless of who drafted the first version; a scribe or AI origin doesn't change how you fix a mistake once your signature is already on it.

No — attestation has to be your own act, tied to your credential, confirming you reviewed and stand behind the content. No vendor's automated sign-off or default acceptance substitutes for you actually reading the note and applying your own signature to it.

Not for attestation purposes — both produce a draft you're responsible for reviewing before it becomes part of the record. The practical difference is usually speed and the specific error patterns each tends to produce, but your review obligation and what your signature certifies stay the same either way.

Confirm the agreement actually names PHI handling, states how long data is retained and how it's deleted, and says explicitly whether your recordings or transcripts are used to train the vendor's models. Treat a vague or missing answer on model training as a reason to ask directly before your first real patient encounter, not after.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Centers for Medicare & Medicaid Services (2023). Complying with Medicare Signature Requirements. CMS Medicare Learning Network (MLN905364). link ✓Establishes that attestation authenticates content regardless of who drafted it, supporting that attestation certifies review, not the drafting process.
2.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkEstablishes that a vendor creating or transmitting PHI on the practice's behalf is a business associate requiring a BAA, supporting the scribe/AI-vendor contracting claim.
3.Centers for Medicare & Medicaid Services (2026). Medicare Benefit Policy Manual (Pub. 100-02). Centers for Medicare & Medicaid Services (CMS). linkSupports that psychiatric-service and incident-to coverage depend on whose clinical judgment the service reflects, reinforcing why attestation must track the actual clinician.
4.American Medical Association (2023). CPT evaluation and management (E/M) revisions. American Medical Association (AMA). link ✓Establishes that MDM is the clinician's own assessment, supporting why an AI-drafted assessment must be checked against the clinician's actual judgment before signing.
5.Centers for Medicare & Medicaid Services (2023). Evaluation and Management Services Guide. CMS Medicare Learning Network (MLN006764). link ✓Supports that documentation must support the billed level with content reflecting real clinical judgment, reinforcing the review-before-signing requirement.
6.American Psychological Association (2007). Record Keeping Guidelines. American Psychological Association. link ✓Describes required BH record content without prescribing who drafts it, supporting that the clinician remains responsible for the final product regardless of drafting tool.
7.Office of the National Coordinator (2016). EHR Contracts Untangled: Selecting Wisely, Negotiating Terms, and Understanding the Fine Print. HealthIT.gov (ONC). link ✓Supports data-access and termination terms worth negotiating in any EHR-adjacent contract, applied here to scribe and AI-documentation vendor agreements.

https://www.gale.care/for-providers/cdn-scribe-attestation · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers