Every night in the emergency department, the electronic health record hums with small demands for attention. A nudge about sepsis. A best-practice advisory. A documentation suggestion that arrives between patients and asks for one more click.
Most of us treat those prompts as background noise. Almost none of us stop to ask whether a given nudge is, in fact, a query, or whether it was built to the same standard a clinical documentation specialist has to meet.
In August, that question got an official answer. And it is not the answer many health IT vendors have been selling.
The American Health Information Management Association and the Association of Clinical Documentation Integrity Specialists released the 2026 update to their Guidelines for Achieving a Compliant Query Practice, shaped by feedback from nearly 200 individuals and groups. The principle is plain: “Whether a query comes from a person or technology, the standard for compliance should remain the same.”
Then comes the sentence that should end a familiar sales claim: “Organizations should not assume that a vendor-supplied or EHR-integrated tool produces compliant queries by default.”
For years, “compliant by default” functioned as an unspoken promise around AI-enabled clinical documentation and utilization review tools. If a system could draft a query, the thinking went, it could draft a legal one. The 2026 guidelines close that gap. Compliance is no longer something the software is presumed to get right. It is something the health system that buys it has to prove.
I am an emergency physician. I co-founded EvidenceCare in 2016 because I watched clinicians drown in prompts long before generative AI arrived. What the new guidelines make clear is that the prompt problem was never only about alert fatigue. It was also about who is accountable when a machine asks a doctor to document something that may change how a case is coded, scored, or paid.
Also Read: AI Bots Mimicking Human Users: The New Face of Advertising Fraud
A query is what it does
Section XI of the guidelines, titled “Query Technology,” brings four categories of tools into scope: computer-assisted physician documentation, computer-assisted coding, large language model and generative AI platforms that draft or deliver query language, and EHR-integrated advisories and alerts.
The guidelines define a query by function, not by label. A communication is a query when it “presents a provider with a specific diagnosis or documentation option for consideration in connection with a specific patient encounter,” and that definition applies “regardless of how the communication is labeled or where it appears within the technology platform.” Prompts, nudges, advisories, and alerts are named explicitly. A tool marketed as passive decision support does not receive an exemption because of what the vendor calls it.
The definition is narrower than it first sounds. Passive clinical decision support that surfaces reference information without steering a provider toward a specific response for a specific patient is not a query. The practical test is this: does the tool point a clinician toward a particular answer for a particular patient? When that is unclear, the guidelines say the communication should be treated as a query and held to every applicable compliance standard.
On a busy shift, that distinction is not academic. “Here are the sepsis criteria” is reference material. “Consider documenting severe sepsis for this encounter” is a query. Calling the second one a nudge does not change what it is.
The same rules as a handwritten note
An AI-generated query is held to the same standard as one written by hand. It must include relevant clinical indicators sourced from the health record. It must avoid subjective interpretation. Its title, tracking identifier, and subject line must not reference a desired diagnosis, a reimbursement impact, or a quality measure. Answer options must be clinically supported, must include an “other” option or room for an alternate explanation, and must not use formatting, emphasis, or ordering that steers the provider toward a preferred response.
Two provisions are easy to overlook, and they are where a lot of product design quietly fails.
Automated templates “should not auto-populate the answer field or suggest diagnoses without provider validation.” And if a technology-generated query does not produce the response an organization wanted, sending a follow-up manual query solely to override the provider’s earlier answer is noncompliant unless new clinical indicators exist.
The guidelines are candid about where the risk originates: tool configuration, training data, and system design, especially when those choices introduce directional bias or put reimbursement ahead of clinical accuracy.
What “compliant by design” would require
The guidelines set the outcome and leave the architecture to the vendor. Meeting that outcome is unlikely to mean running a large language model over a chart and shipping fluent text. It usually means choices made before the first query is generated.
Templates have to constrain the model, and the model has to be tested against those constraints. If the formatting logic cannot bold, highlight, or reorder answer options, the output is shaped before delivery instead of cleaned up afterward. Answer fields cannot pre-select a response. Clinical indicators need to be traceable, so an organization can show how each indicator was sourced and why each answer option was included. And human review has to live somewhere in the workflow. The guidelines allow review before delivery or “ongoing structured auditing of query output,” and they expect regular structured auditing when there is no pre-delivery review.
From the product side, that is the difference between an AI that writes well and an AI that can survive an audit.
The buyer owns the risk
On accountability, the guidelines leave little room for interpretation: “Organizational process owners retain accountability for every query delivered to a provider, including those generated through automated or AI-assisted processes.” Vendor vetting and compliance review of technology query tools sit alongside human review, audit frequency, staff training, and the process for reporting and correcting noncompliant queries. The burden of proof sits with the health system that adopts the tool, not the company that sold it.
Regulators are moving in the same direction. As summarized by Arnold & Porter, the HHS Office of Inspector General listed “AI-generated prompts encouraging unsupported coding” among “potentially abusive risk adjustment practices” in its March 2026 compliance guidance for Medicare Advantage.
Query practice drew enforcement before AI entered the picture. In December 2024, Independent Health agreed to pay up to $98 million to resolve False Claims Act allegations that a subsidiary retrospectively searched medical records and queried physicians for information that would support additional diagnoses and higher risk scores. The allegations were resolved without a determination of liability, and no AI was involved. What the case shows is how closely regulators already examine the query process.
Put that settlement beside the OIG language and the 2026 guidelines, and the pattern is hard to miss. Query practice was already an enforcement target. Artificial intelligence did not invent the risk. It scaled it, then packaged it as a feature.
For leaders evaluating an AI-enabled CDI or utilization review tool, four questions now belong next to the familiar ones about accuracy, integration, and speed:
- How does the tool prevent a leading query, in specific terms, instead of stating that it does?
- Which tools in our environment, including EHR alerts, meet the definition of a query?
- Who reviews queries before delivery, or how often do we audit them afterward?
- What is our process for correcting a noncompliant query once we find one?
Before the next audit cycle
The central point of the 2026 update is that “compliant by default” was always a marketing claim, and it is now a claim the adopting organization has to test for itself. Query volume, provider burden, and the scale of documentation review make some automation inevitable. Done well, it remains one of the better answers to the pressure CDI teams are under.
But “done well” now has a written definition, and it is more specific than many products on the market were designed to satisfy. Organizations that treat the update as a design requirement, and that review every alert, prompt, and AI-drafted query against Section XI, will be in a stronger position when the next audit cycle arrives. More importantly, they will still deserve the trust that the query process depends on.
Brian Fengler, MD, is the Chief Medical Officer and co-founder of EvidenceCare, a clinical performance improvement company he co-founded in 2016.
