Staff trained on the AI policy
A policy nobody has read changes nothing. Completion by role shows real coverage.
Medical and specialty clinics · AI usage policy and governance
Clear AI rules for your clinic, before staff write their own
Providers are trialing ambient documentation tools, the EHR vendor is switching on AI features, and front-desk staff have found that a chatbot writes a decent appeal letter. Some of this is useful. Some of it means protected health information is being pasted into tools with no business associate agreement and unknown retention. Most practices have no written position yet.
How it often works today
- Staff use free consumer chatbots to draft patient letters, appeal language and job descriptions, sometimes including names or clinical details.
- Individual providers sign up for ambient scribe trials on their own, without a review of the vendor agreement or data retention terms.
- EHR vendors are adding AI features that may be enabled by default, and nobody has decided whether the practice wants them on.
- There is no process for staff to ask whether a tool is allowed, so the honest ones stop using it and the rest stop asking.
We would help you write a short, practical AI use policy: which tools are approved and for what, what data may go into them, who reviews AI output, and how new requests get evaluated. The medical director and compliance lead approve it, and we help train staff so the rules are followed rather than filed.
The improved workflow
Take inventory of current AI use
Run a short, no-blame survey and review software subscriptions and browser extensions to find which AI tools providers and staff already use and for what.
Sort uses by risk
Separate low-risk uses with no patient data, such as drafting a job post, from uses involving protected health information or clinical content, which need a BAA and closer review.
Write a short policy and approved tool list
Draft a two- or three-page policy covering approved tools, prohibited data, required human review of output, and how to request a new tool, written for staff rather than lawyers.
Set up a vendor review checklist
Create a standard checklist for AI vendors covering BAA, data retention, training use, access controls, audit logs and how output is documented in the chart.
Train staff and review quarterly
Run a short session for each role with real examples, then review the approved list and any incidents every quarter as tools and regulations change.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
AI tools in use with a BAA and review on file
The gap between tools in use and tools reviewed is the practice's actual exposure.
Turnaround on new tool requests
If reviews take months, staff will route around the policy. A short, predictable answer keeps people asking.
Where people stay in control
- The medical director and compliance or privacy officer approve the policy and the approved tool list; counsel reviews where legal questions arise.
- Any AI output that becomes part of the medical record, such as a scribe-drafted note, is reviewed and signed by the treating clinician.
- Colorado's AI Act and federal guidance may affect some uses; the practice's counsel decides how they apply, and the policy is updated when rules change.
Example
A family medicine practice after a scribe trial
For example, in an illustrative six-provider family medicine practice, two physicians start using different ambient scribe apps they found online, and a medical assistant has been drafting prior authorization letters in a free chatbot. The practice pauses both, inventories use and runs a vendor review. One scribe product with a BAA is approved for a structured pilot, the free chatbot is barred for patient data, and an enterprise AI assistant is approved for non-clinical drafting.
Tools typically involved
What the first 30 days look like
In the first 30 days we would run the AI use survey, review subscriptions and EHR settings, and meet the medical director and privacy officer to agree risk categories. By day 30 the practice would have a draft policy, an initial approved tool list and a vendor checklist.
Common questions
Should we just ban AI tools until things settle?
A ban is easy to write and hard to enforce, and it tends to push use out of sight. A short policy that approves a few safe tools and clearly prohibits patient data in everything else usually works better. It gives staff a legitimate option and gives leadership visibility into what is actually being used.
Who in the practice should own AI decisions?
Usually a small group: the medical director or a physician lead for clinical uses, the practice administrator for operations, and the privacy or compliance officer for data handling. We would act as the technology lead who prepares vendor reviews and recommendations, but the decisions sit with practice leadership.
Does the Colorado AI Act apply to us?
It may apply to some uses, particularly where AI informs significant decisions about patients or employees, and details continue to evolve. We do not give legal advice. We would flag uses that look likely to fall in scope and document them so your counsel can make the call with full information.
The business case
Does it pay for itself?
Illustrative defaults for a medical practice. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
AI usage policy and governance in other industries
Accounting and CPA firmsArchitecture firmsFinancial advisory firmsLaw firmsNonprofit organizationsTax preparation offices
AI usage policy and governance: full guide
Related guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small business
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.