Healthcare AI Policy Template for Practices, Clinics, and Hospitals

1. Purpose

[Organization name] (the Organization) uses artificial intelligence (AI) to support patient care, documentation, patient access, and operations. AI use also creates risks to patient safety, privacy, fairness, accuracy, and compliance. This policy sets the rules for using AI in the Organization’s work. Procedures and clinical protocols issued under this policy set the details.

2. Scope

This policy applies to all workforce members, [Local decision: including members of the medical staff, contractors, students and trainees, and volunteers], when they use AI for the Organization’s work, on its devices or networks, or with its information. It covers stand-alone AI tools, AI features inside the electronic health record and other software the Organization uses, AI-enabled medical devices, and AI agents.

3. Definitions

1. Artificial intelligence. [Local decision: Use the definition in Mississippi law, shown here, or adopt your own.] “Artificial intelligence” means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine- and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for information or action. (House Bill 1723, 2026 Regular Session, codified in Chapter 3, Title 1, Mississippi Code of 1972.)
2. AI tool means any software, service, device, or product feature that uses artificial intelligence to generate content, analyze information, make predictions or recommendations, or take actions.
3. AI agent means an AI tool that can take actions in other systems on its own, such as sending messages, scheduling, changing records, placing orders, or running code.
4. Approved AI tool means an AI tool the Organization has approved under Section 7 for a stated purpose, group of users, and category of information.
5. Protected health information has the meaning given in the HIPAA Rules, 45 C.F.R. § 160.103. Confidential information means protected health information and [Local decision: the other categories in the Organization’s data classification policy].
6. Patient care decision support tool means a tool used to support clinical decision-making, as the term is used in the Section 1557 rule, 45 C.F.R. Part 92.
7. Higher-risk use means any AI use that (1) informs diagnosis, treatment, triage, or another clinical decision; (2) creates or changes content in the medical record; (3) communicates with patients without a qualified person reviewing each message first; (4) processes protected health information; (5) informs coverage, utilization review, coding, or billing; (6) informs an employment decision; or (7) allows an AI agent to act for the Organization.

4. Principles

The Organization’s use of AI will:

• put patient safety first;
• keep licensed clinicians responsible for clinical decisions;
• protect the privacy and security of health information;
• avoid discrimination and watch for unequal effects on patient groups;
• be explained to patients and staff in plain language;
• rest on evidence that a tool works for its purpose and for the Organization’s patients; and
• use controls that match the level of risk.

5. Responsibilities

1. [Local decision: The chief executive or practice owner] will designate [Local decision: an AI lead or an AI governance committee] to maintain procedures under this policy, keep the inventory of approved AI tools, approve higher-risk uses, coordinate training, and coordinate the response to AI-related incidents.
2. [Local decision: Clinical leadership or the medical staff] will approve clinical uses of AI and the clinical protocols for them.
3. The privacy officer and security officer will review AI tools that use protected health information.
4. Managers will make sure their teams follow this policy and its procedures.
5. Each workforce member is responsible for any work they produce, send, sign, or approve with AI assistance.

6. Permitted, approved, and prohibited uses

1. Permitted. Workforce members may use approved AI tools for drafting, summarizing information that is not confidential, education, research, and routine administrative tasks, subject to Sections 8 through 15.
2. Permitted with approval. Any clinical use, any use of protected health information, any other higher-risk use, and any AI tool that is not yet approved require approval under Section 7 before use begins.
3. Prohibited. No one may use AI for the Organization’s work to:
   1. enter protected health information or other confidential information into an AI tool that is not approved for that category of information;
   2. make a diagnosis, treatment, or coverage decision based solely on AI output;
   3. place AI-generated content in the medical record without review by the responsible clinician;
   4. use an AI-enabled medical device outside its authorized intended use without [Local decision: review and approval by clinical leadership];
   5. create false or misleading content, including fake reviews or images, audio, or video that falsely depict a real person;
   6. get around the Organization’s security controls or technology use policies; or
   7. [Local decision: add any other prohibited uses the Organization chooses].

7. Review and approval of AI tools

1. Before an AI tool is approved, [the AI lead or committee] will review at least:
   1. the clinical or business purpose and the evidence that the tool serves it;
   2. whether the tool is an FDA-regulated medical device and, if so, its authorized intended use;
   3. how the tool performs for the Organization’s patient population and settings, and the plan to test it before and after go-live;
   4. what information the tool uses, whether a business associate agreement is required, and whether the vendor may use the Organization’s data to train or improve its products;
   5. security, including access controls, multifactor authentication, logging, and how the vendor reports incidents;
   6. for a patient care decision support tool, whether it uses input variables or factors that measure race, color, national origin, sex, age, or disability, and how any risk of discrimination will be mitigated;
   7. the vendor’s documentation of how the tool was developed, tested, and is meant to be used;
   8. accessibility for patients and workforce members with disabilities; and
   9. for an AI agent, the actions it may take, its limits, how its actions are logged, and who can stop it.
2. This review also applies when the electronic health record or other software the Organization uses adds AI features.
3. The Organization will keep an inventory of approved AI tools showing each tool’s purpose, users, categories of information, regulatory status, owner, and next review date.
4. Approval may be limited, paused, or withdrawn when a tool does not perform as expected, harms patients, or no longer meets these requirements.

8. Privacy and security of health information

1. Protected health information may be entered only into AI tools approved for it. When a vendor creates, receives, maintains, or transmits protected health information for the Organization, a business associate agreement is required before use.
2. Workforce members will use the minimum necessary protected health information for the task.
3. Information treated as de-identified must meet the HIPAA de-identification standard in 45 C.F.R. § 164.514.
4. AI tools that use electronic protected health information will be included in the Organization’s HIPAA security risk analysis and risk management.
5. Because AI can imitate voices, video, and writing, workforce members must confirm unusual requests for payments, credentials, or patient information through a separate, known contact method before acting on them.

9. Clinical use and patient safety

1. AI may support, but not replace, the judgment of licensed clinicians acting within their scope of practice. The treating clinician remains responsible for clinical decisions.
2. AI-generated clinical documentation, including notes drafted from recorded visits, must be reviewed and corrected by the responsible clinician before it is signed. [Local decision: State whether and how the record notes that AI assisted.]
3. Clinical AI tools will be tested for the Organization’s patients and settings before use and monitored after go-live for accuracy, safety, and changes in performance. A tool that does not perform as expected will be suspended until it is reviewed.
4. AI-enabled medical devices will be used consistent with their FDA authorization and intended use, and updates will be managed consistent with the manufacturer’s instructions.
5. [Local decision: State whether and when patients are told that AI supported their care, and how they may ask questions.]

10. Nondiscrimination

1. The Organization will not discriminate on the basis of race, color, national origin, sex, age, or disability through its use of patient care decision support tools, including AI.
2. The Organization will make reasonable efforts, on an ongoing basis, to identify patient care decision support tools that use input variables or factors that measure race, color, national origin, sex, age, or disability.
3. For each tool identified, the Organization will make reasonable efforts to mitigate the risk of discrimination and will document those efforts.
4. [The Section 1557 coordinator or compliance officer] will coordinate this work.

11. Patient communication

1. AI tools that communicate with patients, such as chat or messaging tools, will [Local decision: tell patients they are interacting with AI], give patients a way to reach a qualified person, and be monitored for accuracy and safety.
2. AI may draft individual clinical advice only within an approved clinical workflow. A qualified clinician must review and approve each proposed message before it is sent. Approval of the tool or workflow does not replace that review.
3. Patient-facing content created with AI will be reviewed for accuracy, readability, and accessibility before it is published.

12. Coverage, coding, and billing

1. AI may assist with utilization review, coding, and billing, but a qualified person must review AI output before a claim is submitted or a decision is made to deny, delay, or change care.
2. Coverage and medical necessity decisions will be based on the individual patient’s circumstances.
3. [Local decision: For Medicare Advantage organizations only.] Coverage determinations will follow 42 C.F.R. § 422.101(c), and an algorithm or AI tool will not be the sole basis to deny admission, downgrade to an observation stay, or end post-acute care.

13. Employment and human resources

1. AI may assist with employment decisions, including credentialing support, but may not be the sole basis for them.
2. AI tools used in recruiting, hiring, scheduling, evaluation, discipline, or termination are higher-risk uses and will be reviewed for job-relatedness, effects on groups protected by law, and accessibility before use.
3. Applicants and employees may ask for a reasonable accommodation or [Local decision: an alternative process] when an AI tool is part of an employment process.

14. Software, automations, and AI agents

1. Scripts, applications, integrations, low-code workflows, and agents created with AI must meet the Organization’s software, data, and change-control requirements before they use confidential information, receive privileged access, are shared, or are relied on for operations.
2. An AI agent may act for the Organization only within the systems, information, actions, and limits approved under Section 7, and each agent will have a named person who is responsible for it and can stop it.
3. A qualified person must review and approve each proposed order, medication change, individual clinical message, claim submission, or other consequential action before execution. Approval of the agent, its access, or its workflow does not replace that review.
4. Agent actions will be logged and reviewed [Local decision: at a set frequency].

15. Incidents and reporting

1. Workforce members must report AI-related incidents promptly to [office or person]. Incidents include patient harm or near misses, exposure of protected health information, inaccurate records, discriminatory output, unauthorized AI use, and fraud attempts that use AI.
2. Incidents will be handled through the Organization’s patient safety, privacy, and security incident processes, including breach notification under the HIPAA Breach Notification Rule and Mississippi law where they apply.
3. Where a medical device may have caused or contributed to a death or serious injury, the Organization will follow FDA’s medical device reporting requirements for user facilities where they apply.

16. Training, compliance, and review

1. The Organization will provide training on this policy before workforce members use AI for its work. Training covers approved tools, rules for protected health information, checking AI output, recognizing AI-enabled fraud, and reporting incidents. Workforce members must complete [Local decision: the required training] before any higher-risk use.
2. Violations of this policy may result in [Local decision: discipline under the Organization’s usual procedures and, for medical staff, under the medical staff bylaws].
3. [The AI lead or committee] will review this policy at least [Local decision: once a year] and when relevant law, tools, or services change, and will report to [governing body, owner, or chief executive] on approved tools, incidents, and recommended changes.

Legal references

Legal references. [Local decision: Confirm with counsel and keep only those that apply.]

• HIPAA Privacy, Security, and Breach Notification Rules, 45 C.F.R. Parts 160 and 164
• Section 1557 of the Affordable Care Act, 42 U.S.C. § 18116; 45 C.F.R. § 92.210
• Federal Food, Drug, and Cosmetic Act, Section 520(o), 21 U.S.C. § 360j(o); Medical Device Reporting, 21 C.F.R. Part 803
• Medicare Advantage coverage determinations, 42 C.F.R. § 422.101 (Medicare Advantage organizations only)
• Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e et seq.; Americans with Disabilities Act, Title I, 42 U.S.C. § 12111 et seq.
• Section 75-24-29, Mississippi Code of 1972 (notice of breach of security)
• House Bill 1723, 2026 Regular Session (definition of artificial intelligence)

Cross-references: [HIPAA privacy and security policies; data classification; business associate management; medical staff bylaws; clinical documentation; patient safety event reporting; compliance and billing; technology acceptable use; procurement]