HIPAA-Compliant AI for Skilled Nursing Facilities: The Complete Operator's Guide

The RAI Manual is the CMS Long-Term Care Facility Resident Assessment Instrument 3.0 User's Manual, the authoritative instruction set for completing and submitting the MDS. It defines every item, coding convention, look-back period, and assessment schedule. CMS updates it periodically, and facilities must code from the version in effect on the assessment reference date.

The RAI Manual is the single document that settles MDS coding disputes, and it is also the document most often cited by people who have not opened it recently. Coding practices get passed from one coordinator to the next as oral tradition, drift over years, and survive until an audit or a version change exposes them.

This guide is about using the manual rather than summarizing it — which chapter answers which question, and the structural rules that resolve most disagreements before anyone needs to look anything up.

Key takeaways

  • The RAI Manual is the authority for MDS coding; vendor software help text is not.
  • Chapter 3 is the item-by-item coding instruction and is where most questions are answered.
  • The assessment reference date sets the endpoint of every look-back period on the assessment.
  • OBRA assessments serve care planning; PPS assessments serve Medicare payment. A single assessment can be combined to serve both.
  • Code from the manual version in effect on the ARD, not the version current when you are coding.
  • An RN Assessment Coordinator signs and remains accountable for accuracy under 42 CFR 483.20.

What the manual is and where it comes from

The Resident Assessment Instrument is required by law. Facilities must conduct a comprehensive, accurate, standardized, reproducible assessment of each resident's functional capacity, and the obligation is codified at 42 CFR 483.20. The RAI Manual is how CMS specifies what that means in practice.

Three components make up the RAI: the MDS itself, the Care Area Assessment process, and the utilization guidelines contained in the manual.

Always work from the current version published on the CMS MDS 3.0 RAI Manual page. Vendor summaries, conference handouts, and cheat sheets circulating in the building are secondary sources, and they age badly.

Chapter map: where to look

ChapterContentsGo here when
1RAI overview and purposeOrienting new staff
2Assessment types, schedules, ARD rules, transmission timeframesDeciding which assessment is due and when
3Item-by-item coding instructions, section by sectionAlmost every coding question
4CAA process and care plan linkageTriggered care areas and documentation
5Submission, correction, and validationA transmitted assessment needs modifying or inactivating
6Medicare SNF PPS requirementsPPS scheduling and payment-relevant assessment rules
AppendicesGlossary, forms, state contacts, item matricesDefinitions and reference lookups

Chapter 3 is where the working day is spent. Each section opens with the item's intent, then definitions, then steps for assessment, then coding instructions, then coding tips and special situations, then examples. The examples are the most under-used part of the manual — they resolve the edge cases that generate the arguments.

Assessment types and schedules

Two parallel systems run at once, and conflating them is a common source of missed assessments.

OBRA assessments — care planning

  • Admission comprehensive assessment, completed by day 14 of admission
  • Annual comprehensive assessment
  • Significant change in status assessment, required when a resident experiences a decline or improvement meeting the manual's criteria — generally identified within 14 days of determining the change occurred
  • Quarterly review assessments between comprehensives
  • Significant correction assessments for prior full or quarterly assessments found to be materially in error
  • Discharge assessments, return anticipated or not anticipated

PPS assessments — Medicare payment

  • 5-day scheduled PPS assessment, which establishes the PDPM classification for the stay
  • Interim Payment Assessment, optional and completed when classification-relevant characteristics change materially
  • Part A PPS Discharge assessment

Under PDPM the PPS schedule is far lighter than it was under RUG-IV, which had scheduled assessments at multiple intervals. The 5-day assessment now carries the whole stay. That concentration of consequence is exactly why getting it right matters so much — see the PDPM guide.

Assessments may be combined where the manual permits, so a single assessment can satisfy an OBRA requirement and a PPS requirement at once.

The assessment reference date

The ARD is the most structurally important date in MDS coding and the one most often misunderstood.

The ARD is the endpoint of the observation period for every item on that assessment. Look-back periods count backward from it. A 7-day look-back item captures the ARD and the six days before it. Setting the ARD is therefore an active decision, not a clerical one — it determines what is inside the window.

Two rules that prevent most errors:

  • Look-back periods vary by item. Seven days, fourteen days, thirty days, and longer windows all appear on the same assessment. Never assume a single observation period.
  • Do not code an event outside its look-back window because it feels clinically relevant. The item asks a specific question about a specific period.

The CAA process

Completing the MDS is not the end of a comprehensive assessment. Responses trigger Care Area Triggers, which identify care areas requiring further investigation — twenty areas covering cognition, mood, behavior, falls, nutrition, pressure ulcers, psychotropic drug use, and others.

For each triggered area the facility conducts a Care Area Assessment, documents the analysis, and records a decision on whether the area proceeds to the care plan. The CAA documentation is what surveyors read to judge whether assessment drove care planning, and it is frequently the thinnest part of the record. A CAA summary that says the area was reviewed and addressed in the care plan documents nothing.

Corrections and modifications

Chapter 5 governs what to do when a transmitted assessment is wrong.

  • Modification corrects item-level errors on an accepted assessment.
  • Inactivation removes an assessment that should not have been submitted at all — wrong resident, wrong assessment type, event that did not occur.
  • Significant correction assessments are new assessments required when a prior comprehensive or quarterly assessment contained a material error affecting the clinical picture.

Corrections have a payment dimension. A modification that changes a PDPM-relevant item changes the HIPPS code, which means the claim must be adjusted to match. An assessment corrected without a corresponding claim adjustment produces exactly the mismatch that triggers a rejection.

Version control, which is a real operational risk

CMS updates the RAI Manual periodically, sometimes with substantive changes to item definitions and coding logic. The rule is simple and frequently broken: code from the version in effect on the ARD.

Practical controls:

  • Archive each manual version rather than replacing it. An audit two years out is assessed against the rules that applied then.
  • When a new version publishes, review the change tables and identify which items your facility actually uses that changed.
  • Re-verify any coding practice that exists as oral tradition. Practices passed between coordinators drift, and a version change is when the drift surfaces.

Who is accountable

Under 42 CFR 483.20(h) and (i), the assessment must be conducted or coordinated by a registered nurse who signs and certifies its accuracy and completeness, with each individual who completed a portion certifying their part. The RN Assessment Coordinator carries that accountability personally. It is not transferable to a consultant, a vendor, or software.

Where AI helps with RAI Manual work

The manual is long, the record is longer, and the work is matching one against the other. That is document comparison at scale.

  • Source document review against specific items. Read a transfer packet or a period of clinical documentation and surface what a named MDS item's look-back window would capture, with page citations for verification.
  • Look-back window checking. Identify events documented in the record that fall inside or outside the applicable window for a given ARD.
  • CAA narrative drafting. Produce analysis documentation for a triggered care area, grounded only in what the record contains.
  • Pre-transmission consistency review. Compare completed items against the clinical record and flag where documentation does not support the coding.
  • Version change impact analysis. Compare two manual versions and identify which changed items affect your facility's typical resident profile.

Hathr.AI runs Anthropic Claude models inside AWS GovCloud under a FedRAMP High authorization boundary, signs a Business Associate Agreement within 24 hours on every plan, and does not train on customer data. Because the RAI Manual runs to many hundreds of pages and a resident record can run longer, the ability to hold a full manual and a full record in one pass — rather than in chunks that lose the connection between them — is what makes this practical.

The boundary: AI does not code the MDS and does not decide whether a care area proceeds to the care plan. It finds and organizes what the record already contains so the coordinator can make that call faster and with better evidence.

Try it on one assessment

Upload the clinical documentation for one upcoming assessment and ask Hathr.AI which documented events fall inside the look-back window for your planned ARD.

Start a free trial — $47 a month, no seat minimum, BAA in 24 hours →

Frequently asked questions

What is the RAI Manual?
The CMS Long-Term Care Facility Resident Assessment Instrument 3.0 User's Manual, the authoritative instruction set for completing, coding, and submitting the MDS.

Which RAI Manual chapter has coding instructions?
Chapter 3 contains item-by-item coding instructions organized by MDS section, including definitions, coding tips, and worked examples.

What is the assessment reference date?
The ARD is the endpoint of the observation period for an assessment. All look-back periods count backward from it, and different items have different look-back lengths.

What is the difference between OBRA and PPS assessments?
OBRA assessments support care planning and are required for all residents. PPS assessments support Medicare Part A payment. A single assessment may be combined to satisfy both where the manual permits.

Which manual version applies to an assessment?
The version in effect on the assessment reference date, not the version current at the time of coding or review.

Who must sign the MDS?
A registered nurse must conduct or coordinate the assessment and certify its accuracy and completeness, with each person completing a portion certifying their own section.


Part of the HIPAA-Compliant AI for Skilled Nursing Facilities hub. Related: What Is PDPM? · SNF Billing Guide

This article is general regulatory information, not clinical or coding advice. The RAI Manual is updated periodically by CMS. Always verify against the current version published on the CMS MDS 3.0 RAI Manual page and the version in effect for the assessment in question.

Category
No items found.
Written by
Sam Hart headshot - Founder at Hathr.ai
Hathr.AI Clinical Compliance Team
Date Published:
2026-08-15

Our Youtube Videos

Hathr.AI is the fastest, safest way to handle sensitive medical records with HIPAA-compliant artificial intelligence. In this demo, watch how you can:✅ Summarize a patient’s medical record  ✅ Generate an AI-assisted treatment plan  ✅ Write a letter to the patient in plain English  ✅ Suggest CPT billing codes  ✅ Draft an insurance appeal for a denied claim  ✅ Evaluate the case for potential malpractice — all in under 5 minutes.The only AI tool hosted in AWS GovCloud and Powered by Claude 4.0 Sonnet, Hathr.AI is trusted by hundreds of practices that need speed, security, and compliance.Learn more: hathr.ai  For healthcare teams: hathr.ai/healthcare  Reach out to learn more: contact@hathr.ai

#HIPAACompliantAI#ArtificialIntelligenceInMedicine#HealthcareAI#MedicalBillingAI#AIForDoctors#HIPAAAI#MedicalRecords#AIInHealthcare

Description

As Hathr.AI, we are dedicated to providing a private, secure, and HIPAA-compliant AI solution that prioritizes your data privacy while delivering cutting-edge technology for enterprises and healthcare professionals alike.

In this video, we’ll dive deep into the growing concerns around data privacy with AI tools—especially in light of recent revelations about Microsoft’s Word and Excel AI features. These new features have raised alarm over data scraping practices, where user data could be used without clear consent, leaving individuals and organizations exposed to potential privacy breaches. What makes this especially concerning is the "opt-in by default" design, which could lead to unintended data sharing.

In contrast, Hathr.AI ensures that your data stays yours. With a firm commitment to HIPAA compliance, we take the protection of sensitive healthcare data to the highest level. Our platform is built with the understanding that privacy is not an afterthought but a fundamental pillar of our design. We don’t collect, store, or sell user data, and we employ state-of-the-art encryption, secure access protocols, and clear user consent processes to keep you in full control.

We’ll also touch on why Hathr.AI, powered by advanced LLM (Large Language Models) like Claude AI, offers a secure and private alternative for businesses looking to leverage AI technology without compromising sensitive information. While some AI tools may collect or expose data through ambiguous or hard-to-find opt-out settings, Hathr.AI puts transparency and security at the forefront, offering peace of mind in an era of increasing digital vulnerability.

If you’re concerned about your privacy or looking for a HIPAA-compliant AI solution that respects your data, Hathr.AI provides the robust security, transparency, and ethical design that you need.

Key Points:

  • HIPAA Compliant AI: Built for healthcare professionals, ensuring compliance with privacy regulations.
  • Privacy-first: No data scraping, no data selling, full user control over information.
  • Claude AI: Secure, powerful LLM tools for advanced capabilities without compromising security.
  • Data Transparency: Say goodbye to hidden opt-in/opt-out toggles—Hathr.AI gives you clear, easy-to-understand privacy settings.

Tune in to learn how Hathr.AI ensures your AI tools remain private, secure, and trustworthy, while still delivering the performance and accuracy you need to thrive in a fast-evolving digital landscape.

Don't forget to like, comment, and subscribe for more insights on secure AI solutions and how to protect your organization from emerging privacy risks!

Description

Discover how Hathr AI's advanced AI tools transform federal acquisition processes with unparalleled security and efficiency. Designed for government professionals, this video showcases Hathr AI’s capabilities, including secure AI data analysis, HIPAA-compliant tools, and AWS GovCloud integration, to help streamline decision-making and document management. Perfect for agencies seeking private, compliant, and powerful AI solutions, Hathr.AI delivers tools tailored for healthcare and government needs.

Key Topics Covered:

AI-driven data analysis for governmentHIPAA-compliant, secure AI tools for federal agencies

Private deployment options with AWS GovCloud

Learn more about Hathr AI’s secure, high-performance solutions at hathr.ai and transform your agency’s acquisition process with cutting-edge AI.

Description

Discover how Hathr.AI simplifies NSF grant evaluations with advanced AI-driven compliance and proposal review tools. This video showcases Hathr.AI’s capability to streamline grant compliance checks, enhance accuracy, and save time for evaluators and applicants alike. Ideal for research institutions, government agencies, and proposal writers, Hathr.AI offers secure, HIPAA-compliant AI solutions tailored to meet the complex requirements of NSF and other grant processes.Highlights:AI-powered compliance checks for NSF grant proposalsFast, accurate, and secure evaluations with Hathr.AITailored solutions for research, government, and healthcareOptimize your grant proposal process with Hathr.AI's private, secure AI tools. Learn more at hathr.ai and transform how you handle grant evaluations and compliance.

Description

Join Hathr.AI at the Defense Information Systems Agency (DISA) Technical Exchange Meeting to explore innovative AI solutions tailored for federal and defense applications. In this session, we highlight Hathr.AI's secure, private AI tools designed for efficient data handling, HIPAA compliance, and seamless integration within government systems, including AWS GovCloud. Perfect for agencies seeking reliable AI for data analysis, document summarization, and secure decision-making, Hathr.AI provides cutting-edge technology for defense and healthcare needs.Highlights:AI tools for federal and defense data managementSecure, HIPAA-compliant AI solutions with AWS GovCloudEnhancing operational efficiency with private AI deploymentsDiscover how Hathr.AI's solutions empower government and defense agencies to stay at the forefront of innovation. Visit https://hathr.ai to learn more about our services.

Blog and articles

Latest insights and trends

AI Healthcare solutions with Hathr.AI
HIPAA Compliant AI

AI Healthcare Solutions: How a HIPAA Compliant LLM can Revolutionize your practice

Learn how HIPAA compliant AI healthcare solutions can revolutionize your practice. Hathr AI offers secure, HIPAA & NIST-certified tools that automate billing, enhance diagnostics, and improve patient care while ensuring complete data privacy and compliance.
deepseek-ai-is-dangerous-for-healthcare
Security & Compliance

DeepSeek AI: Interesting Methods, Dangerous Product

Analysis of DeepSeek AI's computational efficiency innovations and why its security risks, censorship issues, and compliance concerns make it unsuitable for healthcare, government, and other regulated industries in the United States.
Challenges Finding Compliant AI
Security & Compliance

Challenges Finding Compliant AI: ChatGPT is Watching You

This blog post explores the recent discovery of AI-powered surveillance by Chinese intelligence using ChatGPT, highlighting the vulnerabilities of commercial AI tools in terms of security, privacy, and compliance. It discusses the implications for regulated industries and offers guidance on implementing secure, HIPAA-compliant AI solutions like Hathr.AI to safeguard operations without compromising functionality.
HIPAA Compliant AI

Low-Code HIPAA Compliant AI: Hathr.AI Integrates with Pipedream.com to Deliver HIPAA-Compliant AI Integration

Hathr.AI partners with Pipedream.com to offer HIPAA-compliant AI integrations, transforming healthcare automation with secure, low-code solutions. This collaboration empowers healthcare providers and developers to create compliant workflows, enhancing efficiency and patient outcomes while maintaining robust data security.