As the use of artificial intelligence in healthcare rapidly grows, hospital executives are still wrangling with practical questions around governance policies to establish basic rules of the road.
Only 16% of health systems currently have a systemwide governance policy specifically intended to address AI usage and data access, based on a survey (PDF) with 35 healthcare leaders from 34 health systems. These governance polices are needed to address concerns related to data privacy and security as well as legal issues.
Nineteen percent said their organizations don't have AI-specific governance policies but do have broader policies that cover AI.
While healthcare AI is generating a lot of buzz, many organizations remain in the early stages of evaluating and implementing AI solutions, according to the survey results.
The Center for Connected Medicine (CCM) at UPMC teamed up with KLAS Research to poll health system leaders last fall about how they are navigating both the promise of AI and the possible risk to patient data and privacy that could accompany the use of AI in healthcare without appropriate safeguards.
CCM and KLAS Research sought to explore where health systems are on the journey to establish governance policies and usage guidelines that protect patient data and comply with regulations. Most of the survey respondents said their health systems have yet to draft AI-specific policies but many said they are in the process of laying the groundwork for policy adoption by first forming committees to oversee the use of AI.
Several survey respondents also said their organizations are waiting for federal regulations to be issued before creating their own policies. In December 2023, the Office of the National Coordinator for Health IT (ONC) introduced a set of regulations that include transparency requirements for AI that is used in solutions certified by ONC.
Other challenges or roadblocks to setting up systemwide AI policies cited by respondents included navigating the complexity of AI and its intersection with ethical, legal, and compliance rules and policies; a lack of internal expertise to evaluate AI solutions in a clinical environment; a desire to focus on more immediate priorities; and a need to first develop mature IT infrastructure to support AI application, according to the survey.
Many health systems are focused on forming cross-functional teams—typically comprised of health system executives—to oversee the deployment of AI, according to survey respondents. Chief information officers and chief data and/or analytics officers were most commonly cited by respondents as the executives involved in overseeing AI, but many of these high-level leadership committees do not involve front-line physicians.
In many cases, it seems health systems are faced with the challenge of "building the plane as they fly it" while also trying to keep pace with the rapid evolution of tech innovation.
"We used an analytics governance structure to decide which available solution was the best. That was how we came up with the idea to create a general analytics and AI governance steering group. That group has been in place for several months. The landscape is changing so quickly that I don’t think we will ever get to the point that we will create a policy; as soon as we create a policy, it is out of date," one health system chief technology officer said, according to the report.
“There are many ways health care can and will benefit from AI, including freeing up our clinicians to focus more on caring for patients and helping systems more efficiently process a range of tasks,” said Robert Bart, M.D., chief medical information officer for UPMC, which is a founding partner of the CCM. “But it is essential that health care executives also take seriously the responsibility to protect our patients’ privacy and health data. At UPMC, we uphold the highest standards of security and privacy for all our data.”
The survey responses echo ongoing discussions that indicate health systems are still grappling with foundational issues like developing their AI strategy and data governance.
"One of the things I've been noticing over the last year that I think is distinct from what we saw with the adoption of predictive analytics is that folks are evolving their governance processes around these applications in parallel to adopting the technology," Seth Hain, senior vice president of R&D at Epic, said during an AI panel at the J.P. Morgan Healthcare Conference in January.
A Bain & Company survey of health system leaders back in August found that only 6% of health systems have an established generative AI strategy in place.
Health systems have various approaches to integrating AI, such as implementing point solutions from various vendors to meet specific needs or simply using AI solutions that are integrated with their electronic health record.
Epic and Microsoft, for example, announced last year that they were expanding their collaboration agreement to integrate generative AI solutions into health records systems.
As a result, a significant number of health systems are likely planning to adopt AI solutions via EHR vendors due to the easy integration and the ability to work with fewer vendors, according to the CCM survey.
More than 70% of respondents in this survey said their organizations were planning to adopt AI solutions integrated with their EHR. Just 10% said their organizations would not be implementing AI solutions from their EHR vendor.
“We have to use AI solutions that are in the EHR,” one chief pharmacy officer was cited as saying in the report. “We are investigating which vendors to use; we are thinking about Microsoft, Google, or other potential AI vendors depending on what their offerings are. We use Epic, and Epic’s AI tool has more compatibility and a lot of other workable solutions within it, so we will see where we land.
Epic’s partnership with Microsoft is seen as a strategic move that will benefit the existing infrastructure of many organizations. Oracle Health (Cerner) was also considered; some organizations are debating whether to wait for the vendor to release AI tools or to use a best-of-breed vendor, the survey found.
But some respondents said no single EHR vendor can provide a comprehensive AI solution due to the range of organizations’ specialized needs and the fact that EHR vendors don’t specialize in AI. Many executives expect their organizations may end up using solutions from both EHR vendors and non-EHR vendors.
Asked about the near-term adoption of generative AI tools, healthcare system executives identified improving efficiency, bringing more visibility to clinical decisions and automating repetitive tasks as the top three ways they expect generative AI to enhance healthcare.
“Before adopting generative AI technologies in health care, it’s crucial for executives to clearly define their objectives and establish measurable benchmarks,” said Jeffrey Jones, senior vice president of product development at UPMC Enterprises, the innovation, commercialization and venture capital arm of UPMC. “Regular evaluations are essential to adjust strategies as necessary. Generative AI is not a one-time fix, but a dynamic tool that requires attention and calibration.”
When asked about AI solutions health systems plan to implement in the near term, executives cited general solutions such as ambient speech, automation tools, documentation, patient engagement and prior authorization. Specific vendors that executives named include Aidoc, Epic, Microsoft Copilot, Nuance and Medalogix.
Amid the excitement, some organizations are still in the early stages of deciding which AI solutions to implement, saying ROI and vendor negotiations are influencing their decisions, the report found.
Other health systems aren’t yet ready to implement AI and are instead focusing on improving their data management with solutions like enterprise data warehouses, which can be foundational to future AI efforts.
Alongside the practical considerations of data privacy and security and which solutions to purchase, health systems also are focused on change management to drive adoption of the technology they do adopt.
"I always say adoption is 80% people and 20% technology because technology is the easy part to deploy. If something is technically feasible, we can deploy it. It is the change management that we need to bring about for people to adopt something," one health system chief medical information officer said in the report.