Nobody at most small hospitals held a meeting and decided to adopt artificial intelligence. It showed up anyway. The EHR vendor turned on an ambient documentation pilot. The revenue cycle company started using AI to scrub claims and draft appeal letters. Someone on the leadership team connected a meeting note-taker to their calendar, and now it joins every call, including the ones where patient issues come up. Meanwhile, a nurse manager pastes a policy draft into a personal chatbot to clean up the wording, and a biller asks one to explain a denial code.
Ask who is responsible for governing all of that, and the answer at a Critical Access Hospital or rural clinic is usually the same person who manages the firewall, resets passwords, keeps the EHR interfaces running, and fields the printer tickets. There is rarely a governance committee, a data science team, or a privacy office with spare hours. There is an IT manager, maybe one or two technicians, and a compliance officer wearing several other hats.
Many of these sites do not have a written AI policy yet. Fewer still have a repeatable way to look at a specific tool and decide whether it is acceptable, acceptable with conditions, or off limits.
Why Borrowing Another Hospital's Policy Falls Short
The tempting shortcut is to ask a neighboring facility or a health system for their AI policy and change the name at the top. It is a reasonable instinct, and reading other policies is useful. The problem is what those documents actually describe.
A borrowed policy is written around someone else's EHR build, someone else's vendor contracts, and someone else's list of enabled features. It may reference an approval committee you do not have, a tool you do not license, or a business associate agreement that has nothing to do with your vendors. It will not mention the ambient documentation feature your EHR vendor added in the last upgrade, because their system may not have it. A policy that does not match the tools in your building gives a false sense of coverage, which can be worse than knowing you have a gap.
What a Working AI Policy Needs to Cover
A small hospital AI policy does not need to be long. It does need to answer the questions your staff and your auditors will actually ask. At a minimum, that means:
- An approved tools register. A running list of every AI tool or feature in use, who owns it, what data it touches, and when it was last reviewed. If it is not on the list, it is not approved.
- A clear PHI line. Plain language stating that protected health information never goes into a tool that has not been approved and covered by a business associate agreement. Staff often underestimate what counts, so it helps to point them to a practical explanation of what is considered protected health information.
- Risk tiers. A simple way to separate low-risk uses (drafting a generic community newsletter) from high-risk ones (anything that touches clinical documentation, patient communication, or care decisions), with heavier review for the higher tiers.
- Vendor questions. A standard set of written questions for any vendor offering AI features: where data is processed, whether it is used for model training, what is logged, and what the BAA covers.
- Re-review triggers. Events that force a second look, such as a vendor adding new AI capabilities, a contract renewal, a change in data flows, or a security incident.
- Staff acknowledgment. A signed or attested statement that employees have read the policy and understand what they can and cannot use.
An AI tool that touches ePHI is part of the environment your HIPAA risk analysis already has to address under 45 CFR 164.308(a)(1)(ii)(A). The policy gives that process a consistent way to handle AI tools specifically, instead of letting them slip in under a general software category.
A Concrete Starting Point
Writing all of this from a blank page is usually where a small IT team stalls. Health Tech Authority has published a free sample AI use policy and risk assessment worksheet written for Critical Access Hospitals, small community hospitals, and rural clinics. The article walks through the federal requirements that apply, including the relevant 45 CFR sections, along with the questions to put to your EHR vendor before turning on AI features.
The downloadable template is built to be edited rather than adopted as written. It includes risk tiers, an AI use register, a vendor questionnaire, a patient disclosure script, a staff acknowledgment form, and a worksheet for assessing an individual AI capability. That last piece matters most for small teams, because it turns "should we allow this?" into a structured set of questions you can answer and document.
Treat it as a framework to fill in. The value comes from adding your own tools, contracts, and EHR configuration, which is exactly what a borrowed policy cannot do.
Three Things You Can Do This Month
You do not need a finished policy to start reducing risk. These steps fit a small IT team's schedule and produce information the policy will need anyway.
1. Survey staff for shadow AI use. Send a short, non-punitive survey asking which AI tools people use for work, on any device, and what they use them for. Make it clear the goal is to learn what is helpful, not to get anyone in trouble. Honest answers will tell you more than blocking a few websites, and the results become the first draft of your approved tools register.
2. Send your EHR vendor written questions about AI features. Ask which AI capabilities are currently enabled in your build, which are available but turned off, what is on the roadmap, where AI processing happens, whether your data is used to train models, and how AI activity appears in audit logs. Ask for the answers in writing. Then repeat the exercise with your revenue cycle vendor and any other vendor that handles PHI.
3. Put an interim rule in place. Until the full policy is approved, publish one clear rule: no PHI goes into any AI tool that has not been approved by IT and compliance. Send it as a short memo, add it to the next staff meeting agenda, and have managers confirm their teams received it. One rule that everyone understands will do more right now than a detailed policy still sitting in draft.
The Bottom Line
AI governance at a small hospital is not a separate program. It is the same work IT and compliance already do: knowing what is in the environment, controlling where PHI goes, and documenting decisions. The tools arrived first. A short, honest policy built around your own environment is how you catch up.
This article is for informational purposes only and does not constitute legal or compliance advice. Covered entities and business associates should consult qualified legal counsel or compliance professionals before making decisions pertaining to HIPAA or IT infrastructure.
- Log in to post comments