AI Governance Checklist for Healthcare & Regulated Industries

AI systems inventory reviewed for PHI access or processing

HIPAA applicability assessed for each identified AI deployment

Clinical AI identified and assessed separately from administrative AI

Staff-adopted general-purpose AI tools inventoried and assessed

Tracking technologies on patient-facing properties reviewed

BAA requirement determined for each AI vendor with PHI access

BAAs executed with all vendors meeting business associate definition

BAA terms reviewed for required HIPAA provisions

Sub-processor relationships identified and BAA chain compliance confirmed

BAA renewal and review schedule established

Vendor data retention policies reviewed and documented

AI model training data usage terms reviewed for vendors with PHI access

Security certifications confirmed for high-risk vendors (SOC 2, ISO 27001)

Vendor privacy policies reviewed for data usage rights

Vendor incident notification requirements confirmed

Staff AI usage policy covering PHI restrictions developed and distributed

Approved AI tools list communicated to all staff

Prohibited uses of AI with patient data explicitly defined

Staff HIPAA AI compliance training delivered and documented

Escalation pathway for staff AI compliance questions established

Vendor assessment records documented and maintained

BAA execution and review records maintained

HIPAA risk analysis updated to address AI-related risks

Staff training records maintained

AI-related incident records documented

Governance committee decisions affecting AI compliance documented