AI is a fantastic tool. I use it daily to run my firm, and it’s present in many aspects of medical practice and facility operations. I’ve written about AI’s operational impact in other posts, but that’s not my focus today.
Instead, I want to address the fact that many medical group and facility agreements deal with AI’s operational side, if they mention it at all, but ignore the legal and compliance risk it creates. That defect is a time bomb waiting to blow up, taking you with it.
Anyone who has bought an older home knows this one. Your inspector told you that the wiring was perfectly fine; it was built to code. Then you add a home office, a couple of big-screen TVs, a space heater, and an electric car charger, and you learn that “built to code” referred to a world with a toaster and a black-and-white television.
Nothing in the walls changed. The load did. That’s how house fires start: quietly, behind the walls, long before anyone smells smoke.
That’s a fair description of the agreements and policies running through many medical groups and facilities right now. They were drafted, often from a borrowed form, for a world in which AI was a conference topic, not a feature quietly switched on in your vendor’s software last quarter. The documents haven’t changed. The load has.
AI Doesn’t Come In Through the Front Door
Physician group and facility leaders assume that if AI risk arrives at all, it will show up as an “AI agreement” that will get the scrutiny it deserves.
But it hardly ever arrives that way.
Instead, it slips in sideways. An RCM vendor announces a new “platform.” An EHR or dictation vendor rolls out a feature update. The hospital at which your group holds an exclusive contract deploys a new tool and expects your physicians to use it. A physician, trying to get home before 9 p.m., pastes a patient’s history into a consumer chatbot to tidy up a note.
None of that involves signing anything new. All of it is governed, or more accurately, not governed, by documents you already have: business associate agreements, billing and revenue cycle vendor agreements, hospital professional services and exclusive contracts, management services agreements, physician employment and independent contractor agreements, and the group’s internal policies.
Some are agreements you signed without thinking about AI. Some are agreements you neglected, the ones that auto-renewed for the fifth time while the vendor’s technology changed underneath them. And some are agreements, and policies, you never entered into at all, or your own policies that you failed to update or never wrote. Every one of them is a time bomb, and every one of them is risk you don’t have to carry.
Some Questions Your Agreements Have to Answer
Strip away the jargon, and the AI issues hiding in those documents come down to three business questions.
Whose data is it, and what can be done with it? Your patients’ information, your coding patterns, your payer rates, your physicians’ clinical judgment captured in thousands of notes and reads: that’s an asset. Many vendor agreements, and the BAAs attached to them, permit the vendor to de-identify data, and de-identified data generally falls outside HIPAA’s protections. But that’s an oversimplification and certainly not the entire set of risks in an AI world – if the risks aren’t seen, they are not addressed. Translation: the “compliant” agreement you signed may let a vendor build a product out of your group’s work and sell it to the group across town, or to the hospital that would like to replace you. And it isn’t theft if you signed the permission slip.
Who’s responsible when the AI is wrong? If an algorithm suggests a code, the claim still goes out under your group’s billing numbers. If a hospital-selected tool flags, or fails to flag, a clinical problem, the physician who relied on it is the one most likely to be named in the lawsuit. “The software did it” is not a defense the government, a plaintiff’s lawyer, or a medical board is likely to find persuasive.
Who controls how it’s used? When someone else selects the tool, configures it, sets productivity expectations around it, and measures your physicians against it, control and responsibility have been separated. Your group keeps the liability. Someone else keeps the steering wheel.
If your agreements are silent on these questions, the answers will be supplied later, by whoever has the leverage at the time. Hint: it probably won’t be you.
Forms Won’t Protect You
The instinctive fix is to grab a form: an “AI addendum,” a template policy, the vendor’s updated BAA. That’s like fixing the old house’s wiring with a heavier-duty extension cord.
Forms are written either by the other side, in which case they protect the other side, or generically, in which case they protect no one in particular. None of them knows how your group actually uses AI, how your hospital deploys it, what your billing company is really doing with your data, or what your physicians are doing at 9 p.m.
The risk for your group ranges from giving away valuable data and intellectual property to seven-figure exposure once HIPAA penalties, breach response costs, and litigation are added up. Most of that is risk you don’t have to carry. Why take it?
To chat more about how we help medical groups and facilities review existing agreements, negotiate new ones, and counsel on AI-related policies and procedures, see AI Contract & Policy Risk or reach out to me at markweiss@weisspc.com.
