An AI use policy for healthcare practices should give staff practical answers before they enter information into a tool or rely on its output. A brief, usable policy can define which tools are approved, what information staff may use, who checks the results, and what to do when something goes wrong.
For a small practice, the goal is not to ban every AI feature or approve tools without scrutiny. It is to make decisions consistently, protect patient information, and keep people responsible for work that affects care. Treat the policy as a working part of your practice’s technology and compliance process, not just a document to file away.
Start with specific tasks, not the word “AI”
AI can appear in different products and workflows, from drafting general administrative material to creating a patient message or summarizing clinical information. The risk depends partly on what the tool does, what information it receives, and how people use its output.
Begin by asking staff and practice leaders where AI is already being considered or used. Review routine workflows such as drafting nonclinical text, summarizing internal material, preparing patient communications, documenting visits, or supporting clinical decisions. Do not assume that a feature is safe just because it is built into software the practice already uses. Identify the specific product, feature, data flow, and intended task.
For each proposed use, record the tool, the task it may support, the information it may receive, the person responsible for review, and who approved it. This creates an understandable approval list and helps staff distinguish permitted uses from unreviewed experiments.
Make the approved-tool list useful
A policy that says only “use approved AI” leaves staff guessing. Give each approved tool an explicit scope. For example, a tool might be approved to help draft general office procedures using non-patient information, but not to summarize a patient record or send a clinical message.
Before approving a tool, determine how it handles submitted information, whether inputs or outputs may be retained or used in other ways, what access controls are available, and how the tool connects with practice systems. Review the vendor’s terms and security information, and document the practice’s decision. If a service may handle protected health information, assess the vendor’s role and whether a business associate agreement is needed for that arrangement. A product label or vendor assurance by itself should not replace the practice’s review.
Keep the list easy to find and clear about boundaries. Include tools or features that are not approved, along with a brief explanation of the safe alternative. For example, staff can use an approved workflow or a properly de-identified example rather than entering identifiable patient details into an unapproved tool. For more on this specific concern, see what to consider before staff paste patient information into ChatGPT.
Define prohibited information with examples
Staff should not have to interpret “patient information” on their own. State plainly that identifiable patient details must not be entered into tools that the practice has not approved for that information and use.
Give practical examples, such as a patient’s name alongside appointment or care details, a date of birth, contact information, a record number, an image, or a distinctive narrative that could identify someone. A prompt can expose information even when a name is removed, if enough context remains to recognize the patient.
Also address information beyond patient records. Internal credentials, security details, private business information, and staff information may need their own restrictions. Tell staff where they can find an approved tool and whom to ask if a task does not fit the policy. Clear alternatives make the rules easier to follow than a warning alone.
Set stronger review for higher-risk uses
Separate administrative assistance from uses that may influence clinical decisions or patient care. AI-generated wording for a general office announcement is different from a patient-specific recommendation, clinical note, or message about care. The closer an output gets to clinical judgment or a patient interaction, the more explicit the review and approval process should be.
Specify who is responsible for checking each type of output. A staff member who uses AI to prepare a draft should verify its accuracy, completeness, tone, and appropriateness before it is used. A qualified clinician should review clinical content within their responsibilities before it becomes part of care or is communicated as clinical guidance. AI output should not silently become a diagnosis, treatment decision, or patient instruction.
For workflows involving clinical decision support, practices should assess the intended use and relevant product characteristics rather than assume every tool is the same. The FDA guidance on clinical decision support software can help inform that review. The policy should make clear that human review remains part of the practice’s workflow.
Assign owners for the policy and the work around it
Even a small practice benefits from naming who is accountable. One person may hold more than one role, but the responsibilities should still be clear:
- Tool approval: A designated owner coordinates vendor and security review, documents the approved purpose, and records any restrictions.
- Workflow review: A clinical or operational lead decides who checks outputs and what review is required before use.
- Staff training: A manager or compliance lead explains approved tools, prohibited information, review expectations, and where to ask questions.
- Incident response: A named contact receives reports of accidental disclosures, incorrect outputs, or other AI-related concerns and routes them through the practice’s existing response process.
- Policy maintenance: An owner revisits approvals when a tool, feature, vendor term, or practice workflow changes.
For staff instruction, connect AI rules to the practice’s broader privacy and security education. Zevonix also offers information on HIPAA training for healthcare staff.
Make reporting simple and non-punitive
Staff should know what to do if they enter patient information into an unapproved tool, notice an inaccurate or unsafe output, or discover that a tool is behaving differently than expected. Tell them to stop using the affected workflow, avoid trying to conceal or independently investigate the issue, and promptly notify the named contact.
The practice should then follow its established privacy, security, and patient-safety processes to assess the event and determine appropriate next steps. The AI policy should point staff to those procedures rather than create a separate, confusing reporting path. Record what happened and use the review to decide whether training, tool settings, or approval boundaries need to change.
Review the policy as tools and workflows change
A policy can become outdated when a vendor adds a feature, changes how information is handled, or a staff member finds a new use for an approved product. Revisit the approved-tool list and the policy periodically, and whenever a meaningful change or incident calls for review. Ask whether the original approval still matches the current task, data, and review process.
The NIST Generative AI Risk Management Profile offers a framework for thinking about risks across the use of generative AI. A small practice can use that kind of structured review without turning its policy into a technical manual. The key is to keep decisions documented and responsibilities assigned.
Frequently asked questions
Can staff use ChatGPT or another public AI tool for practice work?
Only for uses the practice has reviewed and approved. Staff should not enter identifiable patient information into a tool unless the practice has specifically approved that service and use for the information involved. The policy should tell employees what safe alternative to use.
Does every AI vendor need a business associate agreement?
That depends on the vendor’s role and the specific service and information involved. Assess whether the vendor handles protected health information on the practice’s behalf and determine whether an agreement is needed for that arrangement. Get qualified compliance or legal input when the answer is unclear.
Who should approve AI-generated clinical content?
The practice should assign review to an appropriately qualified clinician for clinical content within their responsibilities. Staff should not treat generated text as a clinical decision or patient instruction without the required human review.
How often should the policy be reviewed?
Set a recurring review process and revisit the policy sooner when a tool, feature, vendor arrangement, workflow, or incident changes the original assumptions. The practice should document important approval and policy updates.
Build rules staff can follow
A practical healthcare AI policy connects each approved tool to a defined task, permitted information, and accountable reviewer. It also gives staff a clear route to ask questions and report problems. Zevonix supports healthcare practices with compliance support, cybersecurity, and managed AI services. To discuss how your practice can approach AI use and IT safeguards, call (904) 658-0777.