The AI paperwork your first health system customer will ask for

In a 2025 Healthcare Financial Management Association (HFMA) survey of 233 health systems, nearly 80% said an existing vendor, or a firm partnered with one, would have a significant advantage over a new vendor looking to pilot AI. A new vendor can still bring the paperwork a health system's AI review asks for: a business associate agreement, data use terms, security evidence, a model card, validation results, a monitoring and incident plan, and staff training.

Below are the seven documents, the rule or guidance behind each request, and a packet index to copy. This is not legal advice, so have counsel review any agreement before you sign it.

What will a health system's AI review ask for?

Most of the list comes from guidance that the Joint Commission and the Coalition for Health AI (CHAI) released on September 17, 2025 (AHA News). The guidance tells healthcare organizations what to request from AI vendors during procurement and what to put in their data agreements. HIPAA, the federal health privacy law, requires the business associate agreement when a vendor handles patient information, and a federal civil rights rule adds questions about the inputs of a clinical tool.

The Joint Commission has since built a voluntary certification for responsible AI use on this work, and its review guide was issued on June 1, 2026. A reviewer traces at least two of the organization's AI tools, and one option is a tool from an outside vendor, followed from intake through monitoring. For that tool, the reviewer asks what documentation the vendor provided, such as a model card or validation reports, and expects to see the vendor's documentation of known biases, limitations and risks, along with the business associate agreement or data use agreement.

In 2025, many health systems were still building the review your product will go through. In the same HFMA survey, 88% of health systems were using AI internally, and 18% had a mature governance structure and a fully formed AI strategy.

Why does the customer need each document?

Business associate agreement

A health system covered by HIPAA may let a vendor create, receive, keep or send patient information on its behalf only with satisfactory assurance, in a written contract or other written agreement, that the vendor will safeguard it (45 CFR 164.502(e)). That contract must limit how you use the information, require safeguards under the HIPAA Security Rule, require you to report any use the contract does not allow, and require you to return or destroy the information when the contract ends, if that is feasible (45 CFR 164.504(e)). HIPAA's breach notice rule covers unsecured patient information, which means information that was not made unreadable to unauthorized people by a method set out in federal guidance (45 CFR 164.402). After you discover a breach of that information, HIPAA requires you to notify the customer without unreasonable delay, and no later than 60 calendar days after discovery (45 CFR 164.410).

If your product sends patient information to an AI model that another company runs, that company is your subcontractor under HIPAA's definitions (45 CFR 160.103), and you must make sure it agrees to the same restrictions you accepted. The same rule applies to any AI tool your own staff use with customer patient information, so list every one of those companies in the packet.

Data use terms

Data use terms cover what the business associate agreement does not, including de-identified data. The Joint Commission and CHAI guidance suggests that a health system's data use agreements define the permitted uses of the data it shares, prohibit re-identification and reserve the right to audit vendors. It also suggests adding rights around model outputs, local performance data and monetization of data. So decide before the first call whether you want to use a customer's data, your tool's outputs or its performance data to improve your product, and say so in the packet.

Security evidence

The same guidance lists encryption of patient data in transit and at rest, strict access controls with regular audits of access logs, regular security assessments and vulnerability scans, and an incident response plan. It also suggests that a health system's data use agreements require vendors to meet the agreement's security and privacy requirements, including encryption, access controls and regular security assessments. CHAI's governance playbook, quoted in the Joint Commission's review guide, names HITRUST, SOC 2, the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Cybersecurity and Infrastructure Security Agency (CISA) as examples of security methods. If you hold a SOC 2 report or a HITRUST certification, include it. If you do not, describe the controls you run and the date each was last tested.

Model card

The guidance tells health systems to request information from vendors on a tool's known risks, biases and limitations, and to consider asking how bias was evaluated and for which populations. It names CHAI's Applied Model Card as one way to collect that information. CHAI's card covers intended use, performance, risks and responsible AI principles, so one completed card can go to every customer.

If your tool supports clinical decisions, the card should also list every input the tool uses, because your customer may have a legal duty to check them. Since May 1, 2025, a federal civil rights rule has required healthcare organizations that receive federal financial assistance from the Department of Health and Human Services (HHS) to make reasonable efforts to find decision support tools that use race, color, national origin, sex, age or disability as inputs, and to reduce the risk that each one discriminates (45 CFR 92.210). When a health system does not know whether a vendor's tool uses those inputs but has reason to believe it does, HHS's Office for Civil Rights says it should consult public sources or request the information from the developer (final rule, May 6, 2024).

Validation results

During procurement, the guidance says, health systems should ask how a tool was tested and validated for its intended use, whether the vendor will tune or validate it on a sample that is representative of the customer's own setting, and how relevant biases were evaluated. Write the results so the customer can check them: the data source, the setting, who ran the test and the results for each patient group you checked.

The same goes for any outcome claim in your sales deck. In a 2026 Peterson Health Technology Institute survey of digital health purchasers at health plans, employers and health systems, 182 used performance-based contracts, which tie part of a vendor's fee to results, and 38% of those 182 said they could not independently verify the outcomes vendors report.

Monitoring and incident plan

The guidance says monitoring responsibility should be discussed during procurement and contracting, with clear channels so the customer hears about model changes or updates that might call for an unplanned performance check. The Joint Commission's reviewers ask what monitoring the vendor does and what the organization does, how the organization validates the performance the vendor reports, and what response time the vendor owes when the two of them investigate a problem.

Training materials

The reviewers also ask how the vendor educates and trains the organization's staff to use the product, so send training for each user role with the packet.

The packet, ready to copy

Copy the index below onto the first page of a shared folder, replace each bracket, and send the folder when a health system starts its review.

How do you put the packet together?

Five steps take the packet from scattered files to one folder.

Start with the data map, because every other document depends on knowing what data the product touches and which companies handle it after you. Then check the packet from the buyer's side: how to score an AI vendor before the demo lists five data questions a healthcare buyer should get answered in writing, and the packet should answer all five. Selling to health systems that favor vendors they already use is also one of the health-tech problems in where AI tools fit in healthcare, by kind of organization.

Update the packet whenever the model, a subcontractor or a security control changes, and date each version, so the people monitoring the tool at each customer know what changed.

What if your company has no AI policy of its own?

Write one before the first review, along with a list of every AI tool your company uses, because the subcontractor rule reaches any of those tools that handle customer patient information. The AI Governance Starter does that in three weeks for $8,500, fixed: an AI inventory with an anonymous staff survey, a plain-language AI use policy, a risk tier for each tool, a vendor and BAA checklist, a committee charter and a one-page board summary. It does not replace a security certification such as SOC 2, and the model card and the validation results remain your product team's work.