Health systems rework clinical documentation as data rules tighten

Federal and state restrictions on health data, plus the lingering clinician burden of AI-generated notes, are pushing hospitals and practices to rethink where documentation work happens. ZyDoc says providers now need to evaluate both compliance risk and workflow impact when choosing vendors.

Why it matters: - Health systems that once sent clinical documentation offshore are now facing new legal and operational risk. - The shift affects where patient data is stored, processed, and reviewed. - Providers also need to reduce physician time spent correcting notes, not just automate note creation.

What happened: - A federal national security rule and a growing set of state data localization laws are changing how U.S. clinical documentation can be handled. - The Department of Justice’s Data Security Program, issued under Executive Order 14117 and codified at 28 C.F.R. Part 202, took effect April 8, 2025. - Florida Senate Bill 264 has required certain providers since July 1, 2023, to keep patient information physically within the continental United States, its territories, or Canada. - Texas Senate Bill 1188 imposed a broader localization rule that took effect January 1, 2026, requiring covered electronic health records to be physically maintained in the United States or a U.S. territory.

The details: - The DOJ rule restricts transactions that give countries of concern or covered persons access to bulk U.S. sensitive personal data, including personal health data. - Data de-identified under HIPAA can still fall within the DOJ rule if it meets bulk thresholds. - The DOJ has phased in due diligence, audit, and reporting obligations and has urged organizations to know their data and vendors. - Florida’s law applies to providers using certified electronic health record technology. - Florida’s law reaches third-party and subcontracted facilities and cloud providers. - Florida licensees must attest to compliance at initial licensure and each renewal. - Texas’s law applies regardless of when the record was created. - Texas’s law reaches third-party vendors and cloud providers and carries civil penalties. - Analysts note that Texas’s broad definition of covered entity reaches well beyond traditional clinical settings. - State restrictions fall into multiple tiers, including statutes, Medicaid program rules, and offshore subcontracting limits. - Florida and Texas are the two states with statutes broadly restricting offshore storage of health records. - Alaska, Arizona, Ohio, and Wisconsin have state Medicaid rules that expressly prohibit offshore storage or processing of Medicaid data. - Arizona, Florida, Georgia, Mississippi, Missouri, New Jersey, Ohio, Tennessee, and Texas impose restrictions, conditions, or attestation requirements on offshore subcontracting involving patient data. - Alaska, Arizona, Missouri, New Jersey, Ohio, and Wisconsin also broadly prohibit offshore performance in state contracting. - Commercial payer contracts vary and can require offshore subcontracting attestations and annual audits of offshore vendors. - An organization treating patients from a restricting state may still face scrutiny from that state even if the organization operates elsewhere. - James M. Maisel, MD, said health systems need to treat federal and state rules as separate obligations with separate triggers. - Maisel said a vendor can be HIPAA compliant and still create exposure under a state residency statute or the federal national security rule. - Maisel said many older contracts were not written with these obligations in mind.

Between the lines: - AI-only and ambient scribing tools may reduce initial note creation time, but they often shift work back to the clinician for review, correction, and sign-off. - Industry estimates put physician time spent correcting AI-generated documentation at more than 80 minutes a day. - Undercoding and insurance clawbacks tied to incomplete documentation exceed $1 billion annually. - Many health systems are now judging documentation vendors on two questions at once: where the work is performed and how much work returns to the physician. - Matt Koerner, ZyDoc’s chief marketing officer and strategic adviser, said compliance and workforce pressure now live in the same contract conversation. - Koerner also said the industry has not clearly answered who is responsible for data security at signoff after a note passes through AI systems, vendors, subcontractors, and cloud environments.

What’s next: - Documentation and compliance teams are being urged to verify where work is performed, where data is stored, and whether vendors can support state residency attestations. - Providers should also ask whether a vendor has assessed exposure under 28 C.F.R. Part 202 and how much clinician time is needed after a note is returned. - Organizations should confirm whether the output is EHR-ready and who is responsible for record security at signoff. - Healthcare organizations are advised to consult qualified counsel because requirements vary by state, licensure type, and data involved. - ZyDoc says it offers U.S.-based clinical documentation with AI and U.S.-based human oversight, and it points readers to more information.

The bottom line: - Clinical documentation is no longer just a workflow choice. For many health systems, it is now a data residency, national security, and physician-burden decision at the same time.