Patient agency
Explain when AI is used, the purpose and limitations, available human support and applicable choices. Provide accessible language and respect proxy/minor and sensitive-record rules.
AUTOGOVERN HEALTH · FREE PUBLIC VISION BOARD
Better care.
Accountable AI.
Give patients clearer access, give care teams more time, and make every AI-assisted decision traceable to an accountable human and an approved purpose.
THE NON-NEGOTIABLE FOUNDATION
Design safety into the workflow.
Suggested controls to validate in the actual care setting. Patient safety, privacy, equity and operational resilience need evidence throughout the lifecycle.
Privacy by design
Classify PHI/PII in context; map purpose and recipients; apply minimum necessary where required; review required BAAs. Removing names alone does not establish de-identification.
Clinical safety
Maintain a clinical hazard log. Test local population and workflow, serious omissions, automation bias and workload. Clinicians set task-specific acceptance limits.
Security and controlled actions
Authenticate people/services; enforce organization and patient scope before retrieval; restrict tools and egress; test injection, leakage, stale approvals and duplicate actions.
Equity and usability
Measure performance and access across relevant groups with sample sizes and uncertainty. Include patient and practitioner feedback; missing data is unknown coverage.
Evidence and resilience
Track source and release versions, actual human decisions and monitoring freshness. Rehearse downtime, incident containment, rollback and clinically safe alternatives.
Privacy references: HHS cloud and BAA guidance, minimum necessary, de-identification.
THE VISION BOARD
Eight opportunities. Three adoption horizons.
These are proposed uses, not live services or readiness ratings. Expand each card for its data, controls, owner, evidence, monitoring and fallback.
01 / Establish the foundation
Begin with bounded assistance and approved information. Lower autonomy still requires privacy, security and quality review.
Patient access & navigationHelp people find services, understand administrative instructions and reach a person.
- Data involved
- Approved service directory, hours, accessibility information and reviewed administrative content. Start without patient records.
- Human authority and limits
- No diagnosis, personalized treatment or autonomous clinical triage. Route clinical questions to the approved care pathway.
- Controls to implement
- Bound topics and retrieval sources; provide a visible human handoff; test urgent and out-of-scope questions, languages and accessibility. Avoid collecting health details in general analytics.
- Accountable team
- Patient-services lead; clinical safety reviewer approves escalation behavior.
- Evidence before use
- Reviewed knowledge sources, adversarial dialogue tests, handoff drill and accessible user testing.
- What to monitor
- Successful handoffs / attempted handoffs; unsupported answers / reviewed answers; abandonment and accessibility failures.
- When to pause and fallback
- Pause affected answers when unsafe advice or failed escalation is found; retain phone and staffed access.
Operational assistanceReduce repetitive administration through draft scheduling messages, coding suggestions and work-queue summaries.
- Data involved
- Only the authorized workflow fields; coding assistance uses signed clinical documentation. Financial data and patient metadata remain sensitive.
- Human authority and limits
- Staff approve material scheduling, billing and coding changes. Do not let optimization silently deny care or alter a clinical record.
- Controls to implement
- Separate financial from clinical decisions; validate recipients, codes and record context; bind approval to the exact proposed action.
- Accountable team
- Operations or revenue-cycle lead with privacy and clinical reviewers where care access may change.
- Evidence before use
- Representative task tests, duplicate-action tests, recipient checks and review of access/equity impacts.
- What to monitor
- Corrections / suggestions; duplicate actions; unsupported codes; waiting times across relevant groups.
- When to pause and fallback
- Disable affected automation on wrong-recipient actions, unsupported billing or access disparities; return to the staffed queue.
AI-assisted governanceHelp reviewers map evidence, identify gaps and draft risk or incident summaries.
- Data involved
- Authorized policies, test summaries and minimized evidence references. Keep patient details in restricted clinical/incident systems.
- Human authority and limits
- AI proposes; control owners validate. AI cannot certify compliance, accept its own residual risk or close material findings by itself.
- Controls to implement
- Source-linked suggestions, access-scoped retrieval, independent review and retained correction history. Treat documents as untrusted input.
- Accountable team
- Governance lead; privacy, security and clinical owners decide matters in their domains.
- Evidence before use
- Citation-support tests, deliberately missing/conflicting evidence, reviewer disagreement and prompt-injection tests.
- What to monitor
- Supported citations / reviewed citations; missed gaps; reviewer rejection; overdue findings and stale evidence.
- When to pause and fallback
- Suspend unreliable mappings or summaries; continue manual review from original evidence.
02 / Validate clinical assistance
Introduce patient-context assistance only after local evaluation, clinical ownership, data-use approval and rehearsed fallback.
Clinical documentationDraft notes and source-linked chart summaries so clinicians can focus on the encounter.
- Data involved
- Authorized encounter audio/text and scoped chart facts; approved recording process, recipient and retention schedule.
- Human authority and limits
- Clinician reviews, corrects and signs. Draft output does not become an order, confirmed diagnosis or signed note automatically.
- Controls to implement
- Patient/encounter binding; label generated drafts; preserve source dates and provenance; approved vendor endpoint; retention/deletion verification.
- Accountable team
- Clinical informatics lead and accountable clinical service owner; privacy/security review data paths.
- Evidence before use
- Independent local review of unsupported findings and important omissions; subgroup/sample limitations; interruption and wrong-patient tests.
- What to monitor
- Clinically important errors / reviewed notes; edit burden; review completion; retention exceptions; net documentation time.
- When to pause and fallback
- Pause the affected release on serious factual or context errors; use ordinary documentation and correct records through amendments.
Predictive decision supportHelp clinicians identify patients who may benefit from a defined assessment or follow-up.
- Data involved
- Validated features with provenance, time windows and missing-data handling; only the intended population and setting.
- Human authority and limits
- A risk estimate supports an approved clinical workflow. No autonomous diagnosis, medication change or discharge decision in this proposed model.
- Controls to implement
- Assess intended-use/device and certified-health-IT applicability; validate locally; define clinical response, override, workload and fallback.
- Accountable team
- Clinical service lead with evaluation, safety, data science and equity reviewers.
- Evidence before use
- Discrimination, calibration, sensitivity/specificity and predictive values; subgroup uncertainty; prospective workflow evaluation as appropriate.
- What to monitor
- Outcome-linked performance, prevalence and input changes; missed cases; alert burden; response time and subgroup coverage.
- When to pause and fallback
- Restrict or suspend when validated limits are breached, input meaning changes or monitoring is inadequate; use the approved clinical protocol.
Imaging assistanceAssist specialists with candidate findings and work prioritization within a validated imaging workflow.
- Data involved
- Approved studies and associated clinical context; images and metadata can contain identifiers.
- Human authority and limits
- Credentialed professionals interpret and act. Use is limited to the evaluated modality, population and intended function.
- Controls to implement
- Review applicable device authorization and labeling; reconcile study identity; control versions; validate ordering/prioritization effects.
- Accountable team
- Radiology or specialty clinical lead with imaging engineering, safety and regulatory reviewers.
- Evidence before use
- Relevant local validation, missed-finding and false-positive analysis, device/interface conformance and downtime scenarios.
- What to monitor
- Missed findings / reviewed studies; false positives; queue delays; subgroup/device/site changes and specialist overrides.
- When to pause and fallback
- Remove affected assistance or prioritization on identity failures or unsafe performance; preserve the ordinary reading workflow.
03 / Expand with evidence
Expand only when measured outcomes and monitoring support the new population, site and workflow. This is a maturity sequence, not a release calendar.
Care coordination & home monitoringSupport follow-up tasks and highlight information for review between encounters.
- Data involved
- Authorized care plans, patient communications and validated device observations with timestamps, units and source quality.
- Human authority and limits
- A staffed team owns review and response. Do not imply continuous monitoring or emergency coverage unless it is actually staffed and validated.
- Controls to implement
- Define response hours, backup owners, thresholds, escalation and device-offline behavior; obtain required permissions; track task acceptance and closure.
- Accountable team
- Care-management clinical lead and monitoring service operator.
- Evidence before use
- Missed-signal, offline-device, delayed-message and handoff drills; usability across patient groups; response-capacity review.
- What to monitor
- Unreviewed alerts; signal freshness; completed follow-ups / required follow-ups; false alarms; workload and patient access.
- When to pause and fallback
- Suspend unreliable signals with a patient-safe communication plan; activate alternative contact and clinical follow-up.
Population health & research supportHelp teams explore care gaps, evaluate programs and prepare appropriately approved research analyses.
- Data involved
- Purpose-approved datasets with cohort/denominator lineage; de-identification or other authorized data-use pathway as applicable.
- Human authority and limits
- Exploratory associations are not causal findings or patient-level treatment recommendations. Research and operational uses need separate scope review.
- Controls to implement
- Review consent/authorization and research oversight where applicable; validate cohorts; restrict small-cell disclosure and exports; track model and dataset versions.
- Accountable team
- Population-health or research lead with data stewardship, privacy, clinical and relevant research oversight.
- Evidence before use
- Cohort reconciliation, missingness and bias analysis, access/export tests and reproducibility review.
- What to monitor
- Coverage, missingness, subgroup uncertainty, disclosure risk, reproducibility and downstream use changes.
- When to pause and fallback
- Hold exports or conclusions on unauthorized use, cohort defects or insufficient evidence; correct analyses and notify affected decision-makers.
Assess each clinical software function and intended use for applicable FDA oversight. Review ONC decision-support requirements where the certified-health-IT criteria apply. A horizon does not establish regulatory status.
FROM REQUEST TO ACCOUNTABLE OUTCOME
A controlled integration path
1 / Authorized workflow
Patient, clinician or staff initiates a bounded task. The server resolves identity, organization, patient context and permitted purpose.
2 / Policy and data boundary
Check permissions and approved release before scoped retrieval. Keep source dates and provenance; protect derived indexes and caches.
3 / Controlled AI service
Use approved endpoints and tools, limited context, protected transport and reviewed retention. Untrusted content cannot expand authority.
4 / Review and execution
Present a labeled proposal with sources. Bind required human approval to the exact action and context; execute only through authorized EHR APIs.
5 / Evidence and feedback
Record minimized version/review/outcome references, monitor coverage and errors, and route incidents to accountable teams. Feedback triggers a new review when needed.
The EHR remains the clinical system of record. AI produces a proposal; authorized clinical APIs enforce writes. Governance receives minimized evidence references. Stop controls disable affected AI use while preserving essential care.
Read the detailed AI action controls →WHO APPROVES WHAT
Five gates to maintain accountability
Scope & ownership
Define intended use, affected people, setting, prohibited actions, benefit hypothesis and who can stop use.
Evidence: Use-case card, hazard assessment and named decision owners.
Decision condition: A bounded use with an accountable owner; unresolved scope is a hold.
Data & vendor approval
Map collection, prompts, tools, storage, logs, support, training and deletion. Review legal basis, exact services, subcontractors and required agreements.
Evidence: Reviewed data-flow diagram, access model, vendor decision and retention schedule.
Decision condition: Approved data paths and services; no unapproved fallback provider.
Evaluation & workflow testing
Set acceptance limits before tests. Evaluate local tasks, subgroup uncertainty, misuse, access boundaries, human review and recovery.
Evidence: Versioned evaluation, representative user tests and stop/fallback drill.
Decision condition: Required evidence supports the intended scope; unknown coverage is not a pass.
Supervised release
Limit users and setting; train reviewers; bind approval to model, prompt, corpus, tools and policy versions; set expiry and expansion limits.
Evidence: Approved release manifest, training record, monitoring plan and pilot decision.
Decision condition: All required approvals and runtime restrictions are active for that exact release.
Monitor, change & retire
Review quality, patient outcomes, coverage, incidents and vendor changes. Reassess material changes; revoke access and manage retained data on retirement.
Evidence: Fresh metrics with denominators, incident actions, retests and retirement evidence.
Decision condition: Continue, restrict, suspend or retire through a recorded human decision.
Assign named people and delegates. Separate change authorship from required review. AI can prepare evidence; domain owners make clinical, legal, security and risk-acceptance decisions. This operating model is a suggested use of NIST's voluntary AI RMF resource.
TURN THE VISION INTO A PROGRAM
A suggested first 90 days—and beyond
A planning cadence, not a promise that clinical use will be ready in 90 days. Advance only when evidence and required approvals support it.
First 30 days / discover
Inventory AI already in use, assign owners, map one workflow, establish a risk baseline and prioritize a bounded candidate. Output: scoped use case and gap register.
Days 31–60 / prove the controls
Use synthetic data for integration tests; resolve vendor/data permissions; define evaluation measures and test oversight, failure and recovery. Output: evidence-backed readiness review.
Days 61–90 / decide on a pilot
Only if prerequisites are met, approve a limited supervised pilot with trained staff, monitoring and stop criteria. Otherwise continue remediation. Output: recorded pilot or hold decision.
Beyond 90 days / earn expansion
Compare benefit, harm, burden and equity with baseline; validate each new site/population/use. Budget for ongoing review, support and retirement. Output: scoped expansion decisions.
Fund clinical review time, integration engineering, privacy/security, vendor services, evaluation datasets, patient engagement, training, monitoring and support. See the detailed assumptions and effort estimates.
MEASURE BENEFIT AND HARM TOGETHER
Success requires more than model accuracy.
Choose task-specific metrics and acceptance limits before deployment. Record numerator, denominator, sample size, uncertainty, subgroup coverage, release version, source and last collection time. Compare net time saved after review, patient access, clinically significant errors, override burden and follow-up outcomes against a baseline. Disconnected telemetry is unknown, not green. Clinical leaders define stop thresholds; there is no universal safe accuracy percentage.
Patients
Access, understandable information, timely follow-up, avoidable harm and availability of human help.
Care teams
Net time saved, factual quality, review burden, alert fatigue and confidence in fallback.
Governance
Coverage of approved uses, fresh evidence, unresolved hazards, incident response and verified corrective action.
Run a vision-to-pilot workshop
- Choose one opportunity and write its intended benefit, population and forbidden actions.
- Name the accountable owners and map the exact data and vendor paths.
- Set acceptance and pause criteria; identify evidence gaps and assign dates.
- Record a pilot or hold decision after the gates. Keep patient details in authorized systems.
Scope and primary sources
US-focused proposed adoption model, reviewed September 8, 2026. These are planning ideas and suggested controls, not deployed integrations, clinical protocols, compliance certification or a guarantee of safe performance. AutoGovern currently supports healthcare governance metadata and public learning; live EHR/PHI monitoring is not connected.
In AutoGovern, Healthcare Governance supports organization metadata records. Use the public how-tos for practical steps and the EHR architecture report for the full technical design and capability gaps.