How Can Healthcare Organizations Start Using AI Without Taking Unnecessary Risks?

For most healthcare leaders the question isn’t whether to use AI. Staff are already using it. A December 2025 survey of 518 hospital and health system workers, run by Wolters Kluwer Health (a company that sells clinical AI tools), found that 17% admitted to using AI tools their organization had not approved.

So the useful question is how to start on purpose. The short answer find out what’s already in use, set a few clear rules, begin with a small project where a person checks the output and look hard at where patient data goes before anything goes live. None of that needs a big budget. It does need someone who owns it.

Where the Risk Actually Comes From

Three things cause most of the trouble.

Tools nobody approved. Among workers who had used unapproved AI, 45% said they did it for a faster workflow. Another 24% said the tool simply did more than the approved options. People go around the rules when the approved path is slow or doesn’t exist.

Patient data in places nobody mapped. HIPAA doesn’t carve out an exception for AI. It follows the data. And AI shows up inside software you approved years ago, as a new copilot, summary tool or chatbot. A law firm’s October 2026 analysis notes that in July 2026 HHS updated its business associate guidance and that it names a third party AI chatbot on a provider’s patient portal as a clear example of a business associate.

Tools that are sometimes wrong. The Joint Commission and the Coalition for Health AI (CHAI) list overreliance, where dependence on AI erodes clinical judgment, as a core risk. They also flag bias and errors that come from inaccurate or unrepresentative data.

Find Out What Is Already in Use

Start with a plain list. Include tools you bought as AI, AI features inside software you already own and anything staff use on their own. Ask without blame. People often don’t know where the lines are-: in the Wolters Kluwer survey, only 29% of providers and 17% of administrators said they knew their organization’s main AI policies. If people reach for outside tools because nothing approved exists, offering a sanctioned option for lowrisk tasks takes much of the pressure off.

Set Simple Rules and Name Who Owns Them

The Joint Commission and CHAI guidance recommends a multidisciplinary governance body with clinical, technical, legal and patient perspectives. At a small organization that can be three to five people-: a clinical lead, someone from IT, your privacy or compliance lead and an operations leader.

Give that group a one page policy that answers five questions-:

• Which AI tools are approved?

• What kinds of data may go into them?

• Who approves a new tool?

• What output must a person review before it is used?

• Who hears about it when something goes wrong?

The guidance also asks for regular updates to senior leadership and the governing board on how AI is used and what happens. Becker’s summarizes its seven elements as governance, privacy, data security, ongoing monitoring, voluntary reporting of safety events, risk and bias assessment and training. You can use that list as a checklist even at small scale.

Pick a First Project That Is Hard to Get Badly Wrong

A good first project usually has these traits-:

• Low stakes. Administrative or internal work comes before anything that influences a diagnosis or treatment.

• A person in the loop. Someone reviews the output before it reaches a patient, a chart or a payer.

• Limited data. HIPAA’s minimum necessary rule already asks you to limit the patient information you use, disclose and request to what the job needs.

• One clear measure. Minutes saved, error rate or turnaround time, taken before and after.

• Easy to switch off.

The contrast is easy to see. A tool that drafts internal meeting summaries from notes with no patient information carries a very different risk from one that drafts replies to patient messages. Start with the first kind. Let the people who will use the tool help choose it, so it fits their work and they don’t drift back to their own.

Check the Data and the Contract Before Go Live

When a vendor handles patient information for you, you generally need a business associate agreement (BAA). But the same legal analysis warns that a BAA doesn’t settle questions about training, retention, secondary use or which model providers are involved. Before go live, get written answers to four questions-:

1. What patient data can the tool reach?

2. Where does that data go once it leaves your systems?

3. Which vendors, subcontractors or human reviewers can see it?

4. What logs, outputs or copies remain afterward?

A promise that the vendor doesn’t train on your data isn’t enough by itself. Ask what else it is allowed to do with the data. Reread the terms whenever an existing vendor adds an AI feature. HHS guidance treats HIPAA risk analysis as ongoing and says to reassess when new technology arrives. State privacy and AI laws add another layer, so run your plan past counsel.

Until your privacy officer has confirmed the contract and settings, treat free consumer chatbots as off limits for anything containing patient information.

Start Small, Watch Closely and Decide When to Stop

Run the first project with a small group. Track errors, time saved and complaints and give people an easy way to report problems. The Joint Commission guidance says AI tools should be treated as dynamic systems that need continuous oversight, not one time approval and that organizations should review each vendor’s testing, validation and bias assessments before deployment. It also encourages reporting AI related safety events through the same confidential channels used for other patient safety incidents. Decide in advance what would make you pause-: a safety event, a privacy incident or accuracy that falls below a line you set. Ask vendors to tell you when they change the model behind your tool, because a silent update can undo the testing you did. Train staff on what each tool can and can’t do. The guidance calls for role specific training on functionality, limitations and safe use.

When Outside Help Makes Sense

You can do the first steps yourself the inventory and the one page policy don’t require a consultant. Outside help pays off when nobody has the time to own the work, when vendor pitches pile up and you can’t compare them, when the board wants a plan or when a project has stalled. That’s the kind of situation TransformativeHLTH works on. Paul McRae and his team help clinics, community hospitals and health systems sort out what to fix first, what to buy and what to leave alone. Their healthcare advisory services include vendor and solution evaluation, roadmaps and review of technology risks and dependencies. Paul’s focus areas include AI strategy and implementation. For a lighter first step, The Transformation Table is a halfday session that maps your digital maturity across people, process and technology and helps leadership agree on what to decide next.

You can book 30 minutes with Paul, call +19178215225 or email info@TransformativeHLTH.io.

Innovation

Empowering health systems through strategic digital transformation solutions.

Support

info@TransformativeHLTH.io

+1-917-821-5225

© 2026. All rights reserved.