A short AI use policy template for a medical practice

In a poll of medical group leaders by the Medical Group Management Association (MGMA) on January 20, 2026, only 20% said their organization had AI governance or a formal policy on AI use. Another 22% said they were working on one, and 56% said no. A practice can close that gap with a short written policy that names who approves AI tools, keeps patient information out of unapproved ones, and puts a person between every AI draft and the patient.

The template below is that policy, and it fits on two printed pages. After the template, you'll find the federal and California rules behind its clauses and five steps to put it in place. It is not legal advice, so treat it as a first draft for your compliance lead or counsel to mark up.

What should the policy say?

This one has eight short sections and a signature line. Copy everything from the title to the signature line, replace each bracket, and delete any section that does not apply to your practice.

Which rules is the policy built on?

HIPAA is the reason the approved list has two tiers, one for tools with a signed business associate agreement and one for tools without. Under its privacy rule, a covered practice may let a vendor create, receive, keep or send patient information on its behalf only after getting satisfactory assurance, in a written contract or other written agreement, that the vendor will safeguard it (45 CFR 164.502(e)). That contract is the business associate agreement.

The template says a missing name is not enough because, under HIPAA, patient information counts as de-identified only when 18 kinds of identifiers are removed or an expert finds the risk of identifying anyone very small. The 18 run from names and every part of a date except the year to phone numbers, medical record numbers and full-face photos (45 CFR 164.514(b)). HIPAA also requires a covered practice to train its staff on its privacy policies and to document that training (45 CFR 164.530(b)). The signature line in the template gives the practice a dated record that each person has read the AI rules.

The clause on clinical decision tools comes from the federal rule under Section 1557 of the Affordable Care Act, which prohibits discrimination in certain health programs. Since May 2025, the rule has required covered healthcare organizations to make reasonable efforts to find any tool that supports clinical decisions and uses race, color, national origin, sex, age or disability as an input, and then to reduce the risk that the tool discriminates (45 CFR 92.210). The rule covers health programs that receive federal financial assistance from the Department of Health and Human Services (HHS). HHS counts Medicare Part B payments as federal financial assistance, so a practice paid under Medicare Part B is covered even if it receives no other federal money (final rule, May 6, 2024). The same rule confirms that these tools include AI used to support clinical decisions.

In October 2025 a federal court struck down the 2024 rule's provisions on gender identity. HHS's notice of that ruling, published June 2, 2026, does not list 92.210 among the parts struck down and says the rule's other provisions remain in force (HHS notice, June 2, 2026).

The section on patient messages follows California Assembly Bill 3030, signed in September 2024 (AB 3030, Health and Safety Code section 1339.75). The Medical Board of California says the law has applied since January 1, 2025 (the board's notification requirements page). The law requires a physician's office or group practice that uses generative AI to write patient messages about clinical information to tell the patient that AI generated the message and how to reach a person.

Review by a licensed or certified healthcare provider removes that requirement, and the board says medical assistants do not count as healthcare providers for this rule. The law's definition of patient clinical information leaves out appointment scheduling, billing and other clerical or business matters. The law makes a physician's violation a matter for the Medical Board of California or the Osteopathic Medical Board of California.

MGMA's guidance on AI governance, published with the January poll, makes several of the same points as the template (MGMA Stat, January 21, 2026). It says a policy should spell out what cannot go into consumer AI tools, naming patient identifiers, staff HR details and sensitive contract terms.

MGMA also says any new AI tool, or any major new AI feature in software a practice already has, should trigger a short description of the use and of what data goes in, what comes out and where it is stored, plus a pilot plan with success measures and an owner who watches for problems. Among the leaders who review their AI governance or AI use policies on a regular schedule, MGMA reports that once a year is the most common.

Other states may add rules of their own, so check the template against your state's laws before you adopt it.

How does a practice put the policy in place?

Five steps take the template from a draft to a signed policy that staff follow.

The first step matters most, because the approved list is only as good as the inventory behind it. Ask each person which AI tools they use for work, including free accounts they opened on their own and AI features that arrived with a software update. Before a tool goes on the approved list, get written answers to the five data questions in how to score an AI vendor before the demo, including whether the vendor will sign a business associate agreement and whether it trains its models on your data.

The rules on patient information and human review match the five data rules for AI training, so staff hear the same rules in training and in the policy. If you are still choosing where to start, the problems a practice can hand to AI without patient data can be worked on with tools approved only for work with no patient information.

When is a short policy not enough?

A short policy covers the rules staff follow every day. It does not find the tools nobody mentions, set how much review each tool needs, or give a committee its charter. The AI Governance Starter does that in three weeks for $8,500, fixed: an AI inventory with an anonymous staff survey, a plain-language AI use policy, a risk tier for each tool, a vendor and BAA checklist, a committee charter and a one-page board summary. If you want only the policy, written with your own leaders, the half-day AI Leadership Workshop drafts it for $3,500, and the fee is credited toward the Starter within 90 days.