AI policy template for medical practices, ready to adopt

1. Purpose

This policy sets the rules for how [PRACTICE NAME] ("the practice") and its workforce choose and use artificial intelligence (AI) tools. Its goal is to let AI save time for staff and patients while protecting patient information, patient safety and the practice's legal and professional duties.

2. Scope

This policy applies to everyone who works for or with the practice: owners, clinicians, employees, contractors, temporary staff, volunteers, trainees and students ("workforce members").

It covers any AI tool used for practice work, on practice or personal devices, whether paid or free, and whether it is a separate product or a feature inside software the practice already uses. Examples:

• General-purpose chatbots and writing assistants.
• AI receptionists, AI answering services and automated patient texting.
• Ambient scribes, dictation and AI note-writing tools.
• AI features in the practice's [EHR / PRACTICE MANAGEMENT SYSTEM / PHONE SYSTEM / EMAIL], including features a vendor turns on in an update.
• AI used for coding and billing, imaging, transcription, translation or patient education.
• Browser extensions, plug-ins and meeting recorders that send text, audio or screens to an AI service.

3. Definitions

• AI tool: software that generates or summarizes text, audio or images, or makes predictions or recommendations, from the information it is given.
• Protected health information (PHI): information that identifies a patient (or could reasonably be used to) and relates to their health, care or payment for care, in any form, including spoken, written, typed, recorded, photographed or scanned.
• Veterinary practices: "client and patient information" means any information about a client or their animals, including names, contact details, payment details and medical records. Treat it with the same care this policy requires for PHI.
• Business Associate Agreement (BAA): the written contract HIPAA requires before a vendor creates, receives, maintains or transmits PHI on the practice's behalf.
• Approved tool: an AI tool listed in the practice's AI Tool Register (Appendix A) for a stated purpose.
• Human reviewer: a qualified workforce member who checks AI output before it is used, sent or saved.

4. Roles

• AI policy owner: [NAME, TITLE]. Keeps this policy and the AI Tool Register current, runs vendor approval, and arranges training.
• Privacy officer: [NAME, TITLE]. Receives incident reports and decides whether an incident is a reportable breach.
• Security officer: [NAME, TITLE]. Reviews access, logins and security settings for AI tools.
• Clinical lead: [NAME, TITLE]. Decides which clinical uses are allowed and how clinical output is reviewed.
• Every workforce member: uses only approved tools for approved purposes, follows the patient information rules, and reports problems.

In a small practice one person may hold several of these roles. Write the same name more than once rather than leave a role blank.

5. Approved uses

Workforce members may use AI for the following, and only with a tool listed in the AI Tool Register for that purpose:

• Drafting text that contains no patient information: job postings, internal procedures, website copy, general patient education handouts (reviewed by a clinician before use).
• Summarizing or explaining public material, such as published guidelines or payer policies, with the reader checking the original before relying on it.
• Answering phones, scheduling, appointment reminders and routine patient messages, through a vendor with a signed BAA, following the practice's scripts and escalation rules.
• Drafting clinical notes through an approved scribe or dictation tool with a signed BAA. The clinician reviews, corrects and signs every note.
• Suggesting billing codes or claim edits, with a trained staff member making the final choice.
• [OTHER APPROVED USE]

6. Prohibited uses

Workforce members must not:

• Enter, paste, upload, dictate or photograph patient information into any AI tool that is not approved for that use, including free or personal chatbot accounts.
• Use a personal account for practice work in any AI tool, even an approved product.
• Act on AI output as a diagnosis, treatment plan, prescription or dose without review and decision by a licensed clinician.
• Let an AI tool give medical advice to patients, or decide on its own whether a patient's problem is an emergency. Patient-facing AI must direct emergencies to 911 [VETERINARY: to the practice's emergency line or nearest emergency animal hospital] and hand clinical questions to staff.
• Connect an AI tool, extension or plug-in to the EHR, email, phone system or shared drives without approval by the AI policy owner.
• Record patients, clients or calls for an AI tool without the notice and consent that [STATE] law and this policy require.
• Use AI to write patient reviews or testimonials, or to pose as a specific clinician or staff member.
• Turn off or work around safety settings, logging or human review steps in an approved tool.

7. Patient information rules

• No BAA, no PHI. PHI may go into an AI tool only if the vendor is approved in the AI Tool Register and a signed BAA is on file (45 CFR 164.502(e) and 164.308(b)).
• Minimum necessary. Give an approved tool only the patient information needed for the task (45 CFR 164.502(b)).
• De-identify when you can. Deleting the patient's name is not enough. HIPAA's safe harbor method removes 18 kinds of identifiers, including dates, phone numbers, record numbers and full-face photos (45 CFR 164.514(b)). If in doubt, treat the text as PHI.
• One person, one login. Every user has their own account in each AI tool; no shared logins (45 CFR 164.312(a)(2)(i)). Turn on multi-factor sign-in where the tool offers it.
• Keep the record in the record system. Save final, reviewed output in the [EHR / PRACTICE MANAGEMENT SYSTEM], not only in the AI tool. Follow the retention settings recorded in the AI Tool Register.
• Veterinary practices: client and patient information is confidential under the AVMA Principles of Veterinary Medical Ethics and [STATE] veterinary practice law. Apply these same rules to it, and ask vendors for a written confidentiality and data processing agreement in place of a BAA.

8. Vendor and tool approval

Before any new AI tool or AI feature is used for practice work, the AI policy owner will:

• Complete the AI Vendor Safety Checklist (Appendix B) and keep the vendor's written answers.
• Sign a BAA with the vendor before any PHI is shared [VETERINARY: a confidentiality and data processing agreement].
• Update the practice's security risk analysis to include the tool (45 CFR 164.308(a)(1)(ii)(A)).
• Add the tool to the AI Tool Register with its approved purposes, what data it may receive, who may use it, and its review date.
• For tools that support clinical decisions: identify whether the tool uses race, color, national origin, sex, age or disability as inputs and record how the practice limits the risk of discrimination. This is required of practices covered by Section 1557 of the Affordable Care Act (45 CFR 92.210).

Recheck an approved vendor when it changes its terms, data use, AI model or subprocessors, and at every policy review.

9. Human review of AI output

• A named person is accountable for every AI output that reaches a patient, a patient record or a clinical or billing decision. The clinician who signs a note owns its content.
• Check names, dates, medications, doses, allergies, laterality and numbers against the source. AI tools can state wrong information confidently.
• Requests and messages written up by AI phone or text tools are reviewed by staff every [BUSINESS DAY / TIME OF DAY], and each is marked handled.
• Patient-facing AI tools must always offer a way to reach a person.
• [NAME, TITLE] reviews a sample of AI interactions every [WEEK / MONTH], including calls or messages the tool failed to complete, and records what was found and fixed.

10. Patient transparency

• An AI tool that talks or texts with patients identifies itself as automated, and patients can ask for a person.
• Before an ambient scribe or other recording tool is used in a visit, the clinician tells the patient [VETERINARY: client] and asks permission as [STATE] law requires. Patients may decline without any effect on their care.
• The practice describes how it uses AI in [WEBSITE / NOTICE OF PRIVACY PRACTICES / NEW PATIENT PAPERWORK], in plain language.
• Staff answer patient questions about AI honestly, and refer questions they cannot answer to the AI policy owner.

11. Training

• Every workforce member is trained on this policy before first using any AI tool for practice work, and again every [12 MONTHS], and when the policy changes materially.
• Training covers approved and prohibited uses, the patient information rules, how to check AI output, and how to report an incident.
• The AI policy owner records who was trained and when (45 CFR 164.530(b) and (j)).

12. Incident reporting

Report right away to the privacy officer at [PHONE / EMAIL] if you see or cause any of these:

• Patient information entered into an AI tool that is not approved for it.
• AI output that harmed, or nearly harmed, a patient, or that was wrong in a patient record or message.
• An AI tool giving patients wrong information, failing to answer, failing to escalate an urgent call, or acting outside its approved purpose.
• A notice from a vendor about a security incident or breach.

The privacy officer documents each incident, decides whether it is a breach of unsecured PHI, and if so makes the required notifications without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404). Reporting in good faith will not be held against anyone. Breaking this policy may lead to discipline under the practice's sanction policy (45 CFR 164.530(e) and 164.308(a)(1)(ii)(C)).

13. Policy review

The AI policy owner reviews this policy at least every [12 MONTHS], and sooner when the practice adds an AI tool, a vendor makes a major change, an incident occurs, or the law changes. Past versions are kept for at least six years from the date they were last in effect (45 CFR 164.316(b)(2)(i) and 164.530(j)(2)).

14. Approval and acknowledgment

Approved by: [NAME, TITLE]. Signature: ____________________. Date: ____________.

Workforce acknowledgment: I have read this AI Use Policy, I understand it, and I agree to follow it.

Appendix A. AI Tool Register

Appendix B. AI Vendor Safety Checklist

Attach the completed AI Vendor Safety Checklist for each tool in the register.

1. Contract and BAA

• Will you sign a Business Associate Agreement before we share any patient information? Ours or yours? [VETERINARY: a confidentiality and data processing agreement]
• Does the BAA cover every product and feature we plan to use, including add-ons?
• Do you have BAAs with every subcontractor that handles our data?

2. Data use and model training

• Do you or any subprocessor use our data (prompts, audio, transcripts, outputs, files) to train or improve AI models? Is that off by default, and is it in the contract?
• Will you tell us in advance, and get our agreement, before changing how you use our data?
• Can your employees see our data? Who, when and why, and is that access logged?

3. Retention and deletion

• How long do you keep each type of data: audio, transcripts, prompts, outputs, logs, backups?
• Can we set or shorten retention? Can we delete individual records?
• Where is our data stored and processed (country and provider)?

4. Subprocessors

• Which companies process our data on your behalf: AI model provider, speech-to-text, telephony, hosting, analytics?
• Is the list published, and will you notify us when it changes?

5. Access controls and security

• Is our data encrypted in transit and at rest?
• Does every user get their own login? Do you support multi-factor sign-in and role-based permissions?
• Is our data kept separate from other customers' data?
• What independent security audits do you have (for example SOC 2 or HITRUST), and will you share the report? Note: there is no official "HIPAA certified" status.

6. Audit logs

• Can we see who viewed, changed, exported or deleted our records, and when?
• Can we review every AI interaction (each call, message or note) after the fact?
• How long are audit logs kept?

7. Human escalation and safety

• What does the tool do when it is unsure, or when a request is outside what it is set up for?
• How does it handle an emergency? Does it direct callers to 911 [VETERINARY: an emergency animal hospital] and never give medical advice?
• How does a patient reach a person, and how fast does staff get the hand-off?
• How are errors and failed interactions flagged to us?
• For clinical decision support: what inputs does the tool use, and does it use race, color, national origin, sex, age or disability?

8. Uptime and failure behavior

• What uptime do you commit to in the contract, and what happens if you miss it?
• When the tool fails or a usage limit is reached, what happens to the patient: does the call ring through to us, go to voicemail, or get dropped?
• Do you have a status page, and will you alert us to outages?
• What support hours do you offer, and how do we reach a person?

9. Security incidents and breaches

• How quickly will you tell us about a security incident or a breach? HIPAA sets an outer limit of 60 days for a business associate to report a breach; ask for a shorter window in the contract.
• Have you had a reportable breach in the last [3] years? What changed afterward?

10. Exit and data deletion

• If we leave, can we export our data, and in what format?
• Will you return or destroy our data at the end of the contract, including at subcontractors and in backups, and confirm it in writing?
• Is there a minimum term, cancellation fee or notice period?

Decision

Approved: [YES / NO / YES WITH CONDITIONS]. Conditions: [CONDITIONS]. Data allowed: [NO PHI / LIMITED PHI / PHI]. Approved by: [NAME, TITLE]. Date: [DATE]. Next review: [DATE].