Log AI Model, Prompt, Source, Output, and Reviewer Provenance for ABA Documentation

Define Pavel's AI provenance and release log

Pavel distinguishes operational logs, security logs, clinical source records, generated drafts, final records, and validation datasets. Copying a full chart into every log increases risk without improving accountability. The unit identifies approved use, client and event, source records, model and version, vendor, user and accountable author, output state, reviewer, downstream use, exception, and evidence needed for release or closure.

Build Pavel's page-specific control record

Pavel records use-case identifier and approval version, client and encounter controls, user and role, model provider, model and deployment version, system prompt, prompt-template version, user instruction, source record identifiers and hashes or stable versions, retrieval results, configuration, tool calls, generation time, raw output retention decision, safety or policy block, author edits, reviewer and timestamps, accepted and rejected claims, release destination, downstream record, correction, incident, vendor region and subprocessors, retention, access, monitoring cohort, reproducibility result, and decommissioning. Secrets and unnecessary PHI are excluded or tokenized under approved rules.

Put Pavel's human-review boundary into practice

Pavel first defines which questions an investigation must answer: what use was approved, which source versions were available, what the system produced, who changed it, who released it, and where it went. The design stores stable references and change events instead of duplicating every source record. Prompt templates and retrieval logic use version control. Model aliases resolve to the actual deployed version when the vendor supplies it, and uncertainty is recorded when they do not. Access to raw prompts and outputs is restricted because they may contain sensitive content. The log survives user departure and vendor exit. A reviewer can replay a fictional or de-identified test under the same configuration while recognizing that probabilistic output may differ. Monitoring connects errors with model, prompt, source, reviewer, setting, and release versions. Corrections link the affected generation and downstream records. Retention follows the actual record class and governing sources rather than one unlimited debug-log rule.

Protect client communication and ordinary access for Pavel

Pavel preserves the client's direct communication, AAC, language and disability access, consent and assent when applicable, dissent, health, safety, privacy, priorities, and correction route. AI use never makes communication, food, water, bathroom access, mobility, prescribed care, rest, or emergency help conditional on tool participation or task performance.

Work through Pavel's fictional example

Pavel audits 35 released records. Twenty-nine have complete provenance. Two lack source versions, one model alias cannot resolve, one reviewer identity is missing, one prompt template changed without a version, and one downstream summary lacks the generation link. The cohort teaches AI governance and denominator discipline. It does not establish treatment effect, model safety, legal compliance, coding correctness, payer acceptance, accessibility, or product performance.

Keep Pavel's denominator tied to the locked population

Provenance completeness is 29 of 35 records, or 82.9%. Reproducibility is reported only for cases with a defined test and sufficient retained configuration. Missing vendor detail remains visible instead of being invented.

Assign Pavel's decisions to accountable people

Governance leaders approve use cases. Authors and reviewers own decisions. Technical teams record configurations. Privacy and security leaders govern sensitive logs. Vendors provide scoped technical evidence. The log does not make generated content clinically valid.

Address Pavel's main AI documentation risk

Unlimited raw logging creates another sensitive record system. Store the minimum evidence needed for accountability, secure it, and test retrieval.

Test Pavel's workflow with difficult cases

Pavel tests prompt version, source correction, model alias, retrieval change, user departure, vendor exit, raw-output deletion, downstream link, incident reconstruction, and access request handling.

Check Pavel's release evidence

Pavel confirms the exact source set and versions, client and encounter, model and configuration, approved data route, generated draft, material edits, author and reviewer decisions, accessible client communication, release destination, correction path, monitoring cohort, and known limitations. The AI provenance and release log retains unresolved work, owner, deadline, downstream trace, and the next revalidation trigger.

Use Pavel's ABA governance sources within their scope

Pavel uses the CASP public overview only for high-level organizational context. The BACB Ethics Code applies to BCBA and BCaBA certificants and applicants as defined by the Code; BACB has no separate jurisdiction over organizations or corporations. These sources support competence, documentation, confidentiality, client involvement, assessment, intervention, risk, supervision, and correction boundaries. They do not approve a tool or transfer clinical authority to software.

Keep Pavel's source record and medical-review boundary visible

Pavel uses current CMS Program Integrity Manual Chapter 3 as Medicare medical-review guidance. It currently says services are expected to be documented when rendered; delayed or corrected entries may occur; date and author should be identifiable; and changes or addenda clearly and permanently noted. AI output cannot supply facts that were not documented, and Medicare guidance does not become a universal payer, state, or AI rule.

Map Pavel's privacy, security, and vendor roles

Pavel uses the current HHS Security Rule overview, HHS cloud guidance, and HHS business-associate guidance to analyze actual covered-entity, business-associate, subcontractor, cloud, and security roles. A BAA or vendor certification does not complete purpose, permissible-use, minimum-data, configuration, risk analysis, access, incident, retention, and shared-responsibility work.

Use Pavel's AI frameworks as voluntary risk tools

Pavel treats the NIST AI Risk Management Framework and NIST Generative AI Profile as voluntary risk-management resources, not clinical, legal, coding, or payer authority. The profile helps teams examine generative-AI risks and actions. A framework, score, benchmark, or vendor evaluation does not prove safety, accuracy, fairness, accessibility, compliance, or fitness for this ABA use.

Protect Pavel's data-purpose and communication boundaries

Pavel uses HHS de-identification guidance for its two HIPAA methods and residual-risk boundary. Calling output synthetic or removing names is not itself a method. FTC staff guidance warns AI companies to honor privacy and confidentiality commitments. The OIG GCPG is voluntary and nonbinding. ASHA's AAC portal says AAC users should always have access to their tools or devices.

Choose Pavel's next review trigger

Pavel reopens the AI provenance and release log after a model, prompt, retrieval, source, template, vendor, subprocessor, setting, language, client communication method, access role, data term, payer rule, incident, complaint, correction, audit finding, or regulation changes. The review records affected people and records, immediate safeguard, owner, deadline, communication, correction, downstream propagation, and validation.

Close Pavel's workflow without hiding uncertainty

Review the AI provenance and release log with affected clients and authorized people, qualified clinicians, health-information, privacy, security, AI-governance, accessibility, language, payer, coding, and technical leaders, and the specialists named in the manifest. Confirm source support, authorship, authority, client access, model provenance, vendor terms, errors, downstream use, correction, and independent validation. Keep this page draft and noindex until every required external review is complete.

Related resources

• Control Vendor Model-Training and Secondary-Use Rights for ABA Clinical Data.
• Govern AI Coding and Billing Suggestions Derived From ABA Records.
• Respond to an AI Documentation Error or Hallucination in ABA Records.
• Use AI Translation and Accessibility Tools in ABA Documentation Safely.

Sources

• Council of Autism Service Providers, Organizational Guidelines public overview.
• Behavior Analyst Certification Board, Ethics Code for Behavior Analysts.
• Centers for Medicare & Medicaid Services, Medicare Program Integrity Manual, Chapter 3.
• U.S. Department of Health and Human Services, HIPAA Security Rule.
• U.S. Department of Health and Human Services, Guidance on HIPAA and Cloud Computing.
• U.S. Department of Health and Human Services, Business Associates.
• U.S. Department of Health and Human Services, Guidance Regarding Methods for De-identification of Protected Health Information.
• National Institute of Standards and Technology, AI Risk Management Framework.
• National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile.
• Federal Trade Commission staff, AI Companies: Uphold Your Privacy and Confidentiality Commitments.
• Office of Inspector General, General Compliance Program Guidance.
• American Speech-Language-Hearing Association, Augmentative and Alternative Communication.