A clinician AI use policy has to do two jobs at once: name which tools are sanctioned for which use and set a real rule for what a prompt may contain, and be something the institution can show it followed, not just adopted. HIPAA’s minimum necessary standard sets the legal floor for the first job. The Joint Commission and Coalition for Health AI guidance published in 2025, which is voluntary, sets out what the governance around the policy should look like. A policy that only does the first job is not finished.
What does HIPAA’s minimum necessary standard require of a prompt?
45 CFR 164.502(b) requires that when using or disclosing PHI, or requesting it from another covered entity or business associate, a covered entity or business associate “must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.” HHS’s guidance adds that for uses, the entity’s policies must identify who in its workforce needs access, to which categories of information, and under what conditions. Applied to a prompt, on our reading, the policy should tell clinicians to send what a specific AI task needs, not a full chart pasted in to save a step. Pasting an entire record into a tool to get a two-line summary is the kind of use or disclosure the standard is aimed at, unless an exception applies.
The standard has real exceptions, and a policy that ignores them will misstate the rule in the other direction. Minimum necessary does not apply to disclosures to or requests by a health care provider for treatment, and HHS’s guidance says a hospital’s policies may let doctors and nurses involved in treatment reach the entire medical record as needed. How those rules map onto an AI tool is not settled. A clinician’s use of a tool the institution runs itself is a use; sending PHI to an AI vendor is a disclosure to a business associate, and the exception’s text speaks of disclosures to a health care provider. No OCR guidance we read says how the treatment exception applies to AI tools, so the institution’s counsel has to draw that line until OCR does. Whatever the answer, the exception does not remove every other obligation. A vendor tool still has to be one PHI may lawfully reach at all, which under 164.502(e) means a business associate agreement in place first, and confidentiality and security duties do not go away because minimum necessary does not apply to a given use. The policy should say which side of that line each sanctioned use falls on, rather than leave clinicians to guess.
What should the policy name, tool by tool?
A policy that names “AI” broadly and forbids the rest does not stop a paste, because the decision happens at the keyboard, in the seconds before a prompt is sent, not in a memo clinicians read once. A more useful policy names each sanctioned tool, its approved use case, and where it runs, since that changes who can answer for what the model received later. Who keeps the transcript from an ambient scribe covers what a vendor-hosted tool leaves the institution able to answer on its own, and what it does not. The policy also has to say what happens for everything not on that list, since unsanctioned tools do not stop being used just because a policy does not mention them; see what is shadow AI for the shape of that gap.
What should the governance around the policy include?
On September 17, 2025, the Joint Commission and the Coalition for Health AI (CHAI) released their Guidance on the Responsible Use of AI in Healthcare (RUAIH), voluntary guidance for how health care organizations implement and use AI tools. It names seven elements: AI policies and governance structures; patient privacy and transparency; data security and data use protections; ongoing quality monitoring; voluntary, blinded reporting of AI safety-related events; risk and bias assessment; and education and training. On governance, it calls for a formal structure, which need not be a standalone team, with a designated lead who has appropriate technology expertise, drawing as appropriate on leadership, compliance, IT, clinical, cybersecurity and privacy expertise, and people who represent affected staff and patients. On transparency, it says patients should be notified, when appropriate, when AI directly affects their care. A clinician-facing policy is the operational layer underneath that governance structure, not a replacement for it, and a policy with no named governance structure behind it is missing the element the guidance lists first.
On June 1, 2026, the Joint Commission launched a voluntary Responsible Use of AI in Healthcare (RUAIH) certification for U.S. hospitals, critical access hospitals, and health systems, which it describes as delivering on the promise of its 2025 guidance. Its standards are organized around five areas: governance; effective data management; risk and bias reduction; monitoring, evaluating, and validating safety performance, effectiveness, and responsible use; and transparency, education, and training. It certifies an organization’s use and governance of AI, not individual AI products or tools, and an organization does not need Joint Commission accreditation to apply. A policy does not need the certification to be sound, but the same five areas are a reasonable check on whether a policy is complete.
Does the policy need to say anything about audit and evidence?
Yes, and this is where a policy can fall short without anyone noticing until it is tested. A written instruction to limit what goes into a prompt is not evidence that clinicians did, the same way a training record shows staff were told a rule, not that the rule held. Does HIPAA require logging what an AI model received covers the audit controls standard behind this in depth. What belongs in the policy itself is narrower: which tools produce a record the institution can reach, who reviews it, and on what schedule, so the policy’s own claims about what clinicians may send are something the institution can check rather than assume.
Who signs off, and does the duty end at go-live?
The governance structure named in the policy signs off, and the duty does not end there. The Joint Commission and CHAI guidance calls for ongoing, risk-based quality monitoring after deployment, because AI tools, their data inputs, and their underlying algorithms can change over time. A model version changes, a new use case gets adopted informally, or a tool that was administrative starts getting used at the bedside, and each of those can change what the policy should say. For a patient care decision support tool, part of that ongoing review has a legal anchor: Section 1557’s ongoing duty to identify tools that use protected characteristics as inputs and to mitigate the risk, covered in what Section 1557 requires for AI decision support tools. The policy should name who owns that ongoing review, not just who approved the tool the day it was adopted.
A clinician AI use policy that names tools, sets a real minimum necessary instruction, and stops there is half a policy. The other half is a governance structure that owns it after go-live and a record the institution can point to when someone asks whether the rule held.
What you need in place
- Every sanctioned tool named with its approved use, and an explicit rule for anything not on that list.
- A minimum necessary instruction specific to prompts, with the treatment exception explained rather than assumed to apply everywhere.
- A governance structure named in the policy, not implied by it, drawing on clinical, technical, compliance, and privacy expertise and on people who represent affected staff and patients.
- A business associate agreement for each vendor AI tool that touches PHI, with the data use terms the Joint Commission and CHAI guidance recommends, reviewed on a set cadence.
- A monitoring and incident-reporting channel clinicians know how to use.
- A record of what each sanctioned tool received, from your own systems or obtained through the vendor contract, reviewed against the policy’s own instruction, not just a training acknowledgment on file.
Sources
- 45 CFR 164.502(b) and (e), minimum necessary standard and its exceptions, and disclosures to business associates
- Minimum Necessary Requirement, HHS guidance
- The Joint Commission and the Coalition for Health AI, Guidance on the Responsible Use of AI in Healthcare (RUAIH), September 17, 2025
- The Joint Commission, press release on the Responsible Use of AI in Healthcare certification, June 1, 2026
Where Verillian fits
Verillian governs AI use on the devices you enroll. A checkpoint on each device sits between your people’s AI tools and agents and the AI providers. A tool call your policy bans is removed before your machine can run it. Each record is signed on the device it came from and hash-chained to the one before it, so a change to its signed fields is detectable, and it stays on your own infrastructure. The admin server runs where you choose: on premises or in a private cloud you run. macOS, Windows and Linux are supported. For a health system, that record shows which AI services people on enrolled devices used through the checkpoint, evidence a training log or a signed acknowledgment form cannot produce on its own.
When a vendor’s service calls a model on the vendor’s servers, as an ambient scribe or a hosted report-writing tool does, the record of what that model received is created on the vendor’s side, and the contract is your lever for it. What Verillian gives you is the record of AI use that starts on your own devices.
See what a signed business associate agreement changes and what it does not on the ChatGPT question, and how this maps to healthcare and other regulated sectors.
