Artificial intelligence is rapidly changing healthcare. As Henry Overton, President of Turn Key Solutions, explained during our webinar, medical practices face the challenge of benefiting from AI without creating compliance, privacy, or cybersecurity risks.
The technology is evolving quickly, regulations are developing alongside it, and many healthcare organizations are already using AI tools without fully understanding the risks. The goal is to avoid becoming a compliance horror story while still taking advantage of the efficiencies AI can provide.
Why AI in Healthcare Requires Caution
According to Henry, one of the most common issues is organizations adopting AI before they have the governance, policies, and controls needed to use it safely.
Questions healthcare organizations are asking include:
- Can staff use AI without creating liability?
- What compliance requirements apply?
- Is patient consent required?
- Can AI be used for charting, billing, scheduling, or marketing?
- What happens if AI is already in use without a policy?
The concern is not simply whether an organization can use AI. In many cases, organizations are already using it and are only later asking whether it creates compliance risk.
The Importance of Governance
Henry pointed to guidance from the National Institute of Standards and Technology (NIST), which has published an Artificial Intelligence Risk Management Framework.
The Four Core NIST Steps
NIST recommends organizations:
- Govern AI
- Map AI usage, data, and users
- Measure effectiveness and risk
- Manage and improve controls
According to Henry, the framework mirrors many cybersecurity best practices and serves as a strong model for healthcare organizations evaluating AI use.
Regulatory Attention Is Increasing
Henry highlighted several examples showing that regulators are paying attention to AI.
Texas AI Case Example
A Texas case involved a vendor whose AI product was used by hospitals. The Attorney General alleged that the company could not substantiate claims about its low hallucination rate.
The outcome demonstrated that regulators are beginning to examine AI-related representations and performance claims.
HHS, OCR, and CMS Guidance
Henry noted several themes from federal agencies:
- Covered entities are responsible for HIPAA compliance when AI creates, receives, maintains, or transmits protected health information (PHI).
- AI should not replace individualized medical decision-making.
- Organizations must understand how AI reaches conclusions.
- Human oversight remains essential.
- If a human review is promised, a human must actually review the outcome before decisions are finalized.
OCR’s Focus on Risk Analysis
The Office for Civil Rights (OCR) launched a Risk Analysis Initiative in October 2024 focused on failures to perform and maintain documented risk analyses.
Henry cited multiple enforcement actions where organizations faced penalties because they failed to conduct adequate risk assessments.
His message was straightforward: OCR is taking risk analysis seriously, and organizations should too.
State Laws Are Beginning to Address AI
Louisiana
Henry discussed Louisiana Act 649, which requires healthcare professionals to verbally disclose when AI recording tools are used during patient visits for transcription purposes.
He emphasized that this is a disclosure requirement rather than a consent requirement.
Mississippi
Mississippi House Bill 1723 established a formal definition of AI, providing a foundation for future regulation.
Texas
Texas has moved further with AI-related legislation, including:
- Texas Responsible Artificial Intelligence Governance Act (TRAIGA)
- SB 1188, which focuses on human oversight and disclosure
According to Henry, these developments signal growing legislative attention to AI use in healthcare.
AI Should Be Treated Like an Intern
One of Henry’s most practical recommendations was to think of AI as an intern.
A skilled intern may be able to:
- Draft content
- Summarize information
- Make recommendations
However, an intern should not make final decisions without supervision.
The same principle applies to AI.
Appropriate Uses of AI in Healthcare
Henry suggested that AI can be used safely when proper supervision and controls exist.
Examples include:
- Scheduling assistance
- Reminder generation
- Marketing content drafting
- Policy drafting
- Internal communications
- Summarizing authorized content for review
- Drafting patient communications
- Coding or billing suggestions
- Workflow analytics
- Claims triage
- Prior authorization preparation
A common theme across all of these examples is human review before final action is taken.
Uses That Require Extreme Caution
Henry also identified activities that should not be automated or left uncontrolled.
Entering PHI into Public AI Tools
Healthcare organizations should be very cautious about staff using public AI tools such as:
- ChatGPT
- Copilot
- Siri
- Claude
- Perplexity
Without appropriate governance, monitoring, agreements, and controls, this can create HIPAA concerns.
Other High-Risk Activities
Henry advised caution around:
- Finalizing clinical recommendations
- Generating unsupported diagnosis codes
- Making medical necessity judgments
- Automatically denying care
- Sending patient communications without review
- Using protected characteristics in decision-making
- Allowing AI to act without authorization and logging
Healthcare Adoption Is Already Widespread
Henry shared research showing significant AI adoption within healthcare organizations.
Key findings included:
- 88% use cloud-based generative AI tools
- 98% use applications that include AI features
- 96% rely on tools that train on user data
- 43% are experimenting with in-house AI systems
- 71% of healthcare workers use personal AI accounts for work
He highlighted the final statistic as particularly concerning because personal accounts often lack appropriate governance and business associate agreements.
What Healthcare Leaders Should Do Next
Henry recommended a practical process for healthcare organizations.
Start With a Policy
Organizations should establish an AI policy that defines:
- What is allowed
- What is prohibited
- Which tools may be used
He stressed that the first version does not need to be perfect and should evolve over time.
Inventory Data and Usage
Organizations must understand:
- Where their data exists
- Which AI tools are being used
- How those tools interact with sensitive information
Monitor and Adjust
According to Henry, organizations should:
- Monitor usage
- Train employees
- Revise policies
- Provide safe, controlled tools
- Continue improving governance
This approach closely mirrors the NIST AI Risk Management Framework.
Cybersecurity Must Be a Leadership Priority
Henry concluded by referencing an industry letter supported by major technology companies, including OpenAI, Microsoft, IBM, Adobe, Cisco, Visa, and others.
The message was clear:
- Current security practices are not sufficient.
- Cybersecurity should be a leadership priority.
- Security standards must continue to improve.
- Organizations should approach cyber defense with urgency.
Final Thoughts
AI is already transforming healthcare. According to Henry, the question is no longer whether teams will use AI, but how organizations will guide that usage responsibly.
The path forward is not avoiding AI. It is governing it, monitoring it, training employees, implementing appropriate controls, and maintaining human oversight.
Organizations that take a proactive approach today will be better positioned to benefit from AI while avoiding compliance and security challenges tomorrow.
Schedule a HIPAA AI Readiness Assessment
If you want to better understand how AI is being used in your organization and identify potential compliance risks, Turn Key Solutions offers a HIPAA AI Readiness Assessment that includes:
- AI inventory review
- Usage auditing
- HIPAA readiness evaluation
- Vendor review
- AI policy review
- Cybersecurity risk assessment review
- Governance scorecard
- Executive summary with recommendations
To learn more, visit the HIPAA AI Readiness Assessment page or contact Turn Key Solutions at ask@turnkeysol.com.
