Home / Healthcare AI governance
Guide · Updated September 2026
Most groups need a 5-page policy, a tool inventory, one accountable owner, and a review cadence. Not a 40-page framework. The numbers say most don't have even that: MGMA's January 2026 poll (n=328) found 56% of practices with no AI governance and 22% still developing it — better than 2024's 73% with none, but far behind actual AI use. Black Book's 507-leader poll puts only 18.1% at its governance threshold, with 18.3% providing AI literacy training.
Acceptable-use policy
What staff may and may not do with AI, in plain language, with a sanctioned alternative to consumer tools.
Tool inventory
Every AI tool in actual use — sanctioned or shadow — and what data each one touches.
An owner
One person with authority to approve, restrict, or kill a tool. Not a committee.
Review cadence
Quarterly for PHI-touching tools, and after major vendor model updates.
Training
Short, recurring, role-specific — not an annual slideshow.
HAIRA (Healthcare AI Governance Readiness Assessment, npj Digital Medicine 9:236, 2026) is the anchor worth knowing: five maturity levels across seven domains, distilled from 35 frameworks — and its Level 1 was explicitly designed for small practices. That design choice is the whole point: governance maturity is a ladder, and a group's job is to stand on the right rung, not to cosplay a hospital system.
NIST AI RMF gives you the vocabulary your larger partners speak (Govern / Map / Measure / Manage). Joint Commission RUAIH (voluntary, launched June 1, 2026, open to non-accredited organizations) is the direction of travel if you're growing toward system scale. Start at HAIRA Level 1, borrow NIST's language, keep RUAIH on the horizon.
Days 1–30
Acceptable-use policy out, and the inventory started: what's actually in use, official or not. The assessment produces both as deliverables.
Days 31–60
Close the PHI leaks first — consumer tools touching patient information get a sanctioned replacement or a shutoff. Name the owner.
Days 61–90
Review cadence running, training delivered, and the first quarterly vendor review on the calendar. Governance is now a routine, not a project.
Yes, they exist — healthai.com sells a 50-state AI policy generator for $29, dental version included. If a document is all you need, buy the document; it's a fine starting text. What a template cannot do is tell you which tools your staff actually use, which workflows are worth governing tightly versus loosely, or what to do when the policy meets your real scheduling system. The judgment is the product. That's what an engineer walking your workflows gets you, and it's why our readiness assessment scores governance as one dimension among many — sized to your organization, not to a framework's table of contents.
Budget reality, so you can plan honestly: Black Book found 34.7% of organizations funding AI ad-hoc versus 42.0% with committed budgets, and MGMA's October 2025 poll (n=213) has 2026 budget priorities at 37% workforce and 30% health IT. In dental, a 300-dentist survey across Canada, the US, and the UK found 32% using AI with 38% considering it. Governance spending competes with everything else — which is exactly why right-sizing beats gold-plating.
At group scale, usually no — you need an owner with authority and a review cadence. Committees are how hospital systems solve this; a 20-provider group solves it with one accountable person and a calendar.
Whoever already owns operational risk — often the administrator or COO, with IT and one clinical voice consulted. The title matters less than the authority to approve or kill a tool.
No. A policy nobody operationalizes is shelf-ware. The policy plus a live inventory, an owner, and a review cadence is the minimum that actually changes behavior.
Quarterly for anything touching PHI, annually for the rest — and immediately after a vendor's major model update, because behavior changes with the model.
It's voluntary, launched June 1, 2026, and open to non-accredited organizations. Worth adopting as a north star if you're growing toward system scale; overkill as a starting point for most groups.
That's the normal starting condition, not a failure. Inventory what's actually in use, give staff a sanctioned alternative, and govern forward. Banning without an alternative just drives it further underground.
Governance is one dimension. The assessment scores them all.
Policy, inventory, owner, cadence — plus where AI actually pays off in your operation.