AI for healthcare practices: start with administration
Key Takeaways
- Where should a practice try AI first?
- What assurance is required before a vendor handles electronic PHI?
- Does the output replace a clinician?
Where should a practice try AI first?
Start with administration, not clinical decision-making. Intake forms, scheduling, reminders, documentation drafts a clinician reviews and signs, coding flags for staff to confirm, and sorting messages by type are the uses on this page. Diagnostic support and outcome prediction are outside the scope of this article.
Map where staff time goes, pilot one workflow, and keep a person reviewing every output before you add another.
What assurance is required before a vendor handles electronic PHI?
The 10-1-24 edition of 45 CFR part 164 says a covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information only if the covered entity obtains satisfactory assurances that the business associate will safeguard the information (45 CFR 164.308 and 164.314, 10-1-24 edition).
In section 164.312 of that edition, encryption and decryption are Addressable, not marked Required. Ask what the agreement actually covers, including retention of prompts, who can access the system, and whether the minimum information is used. A tool is not HIPAA compliant by itself. puna.one's own BAA sentence is on the AI consulting page.
Does the output replace a clinician?
No. A draft summary or letter is for a clinician to review and sign. The clinician stays the author of record. Clinical decisions stay with licensed clinicians.
References
- U.S. Government Publishing Office. 45 CFR Subtitle A, 10-1-24 Edition, part 164. Sections 164.308, 164.312, and 164.314. https://www.govinfo.gov/content/pkg/CFR-2024-title45-vol2/pdf/CFR-2024-title45-vol2-part164.pdf
- Related service: AI consulting.
Guide only. puna.one does not hold, and this page does not imply, any certification, attestation or audit report for this framework.