A small practice should use the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF) as a short checklist, not a program. Its four functions, Govern, Map, Measure and Manage, become a one-page AI policy, a list of every AI use in the practice, a routine for checking output, and a plan for when something goes wrong. Add the federal items that already apply to you: HIPAA business associate agreements for any AI vendor that touches patient data, your EHR vendor's algorithm information, and Section 1557's rules on patient care decision support tools.
What is the NIST AI RMF, and does it apply to us?
NIST released the AI RMF 1.0 on January 26, 2023, and describes it as intended for voluntary use. No law requires a practice to adopt it. It is useful because it is neutral, free and widely recognized, so a policy built on it is easy to explain to a payer, a hospital partner or an auditor. NIST notes that the framework is being revised, so check the page for the current version.
The framework is written for every kind of organization, including ones that build AI. A practice of 5 to 50 providers almost never builds models. You buy tools: an ambient scribe, a chatbot on the website, an AI feature inside your EHR, a general assistant staff use for drafting. NIST explicitly lets users pick the categories that fit their resources, which is what a small practice should do.
What do Govern, Map, Measure and Manage mean for a practice?
NIST calls Govern a cross-cutting function that informs the other three. In practice terms:
| Function | NIST's idea | What it means in a 5 to 50 provider practice |
|---|---|---|
| Govern | Policies, accountability and culture for AI risk | A one-page policy, a named owner, staff training, and vendor terms |
| Map | Establish the context for each AI system | A list of every AI use: what it does, what data it sees, who relies on it |
| Measure | Analyze, assess, benchmark and monitor AI risk | A regular check of a sample of output against the source, with results written down |
| Manage | Allocate resources to risks and respond to incidents | Decide to keep, restrict or stop a tool, and a plan for when it gets something wrong |
Two Govern items are worth calling out. NIST asks for mechanisms to inventory AI systems and for policies on risks from third parties. For a practice that buys rather than builds, those two lines do most of the work.
What does the Generative AI Profile add?
In July 2024 NIST published the Generative AI Profile, NIST AI 600-1, a companion to the AI RMF for tools that generate text, images or code. It lists risks that generative AI creates or makes worse and suggests actions for each.
Two of those risks matter most to a practice. The first is erroneous or false content produced in response to prompts, which in a practice means a confident but wrong letter, summary or explanation. The second is data privacy, which in a practice means patient information pasted into a tool that should never have seen it. Your policy's human review and data rules exist to handle exactly these two.
What goes in a one-page AI policy?
Keep it to one page so people read it. Cover these items:
- Owner. One named person approves new tools and keeps the policy current, with a physician partner signing off on anything that touches patient care.
- Approved tools. A short list of tools staff may use, and for what. Anything not on the list needs the owner's approval first.
- Data rules. What may go into each tool: no protected health information (PHI) in any tool without a business associate agreement, and only the minimum data the task needs in tools that have one.
- Human review. Every AI output that reaches a patient, a payer or a chart is reviewed by a named role before it is used. Clinicians remain responsible for clinical content.
- Vendor BAAs. A signed business associate agreement on file for every vendor that creates, receives, maintains or transmits PHI for the practice, as HHS describes business associates.
- AI inventory. A list of every AI use, including AI features turned on inside existing software. Record the tool, purpose, data it sees, owner, review routine and date last checked.
- Incident handling. How staff report a wrong or harmful output, who looks at it within a set time, when a tool is paused, and when the HIPAA breach process applies.
- Review date. The policy and inventory are reviewed at least once a year and whenever a new tool is added.
Check state law too. State rules on AI in health care can add requirements, so ask counsel what applies where you practice.
Which federal rules should a practice know about?
HIPAA. The Health Insurance Portability and Accountability Act (HIPAA) does not have a separate AI rule. It already applies: an AI vendor handling PHI is a business associate, minimum necessary applies to what you send it, and the tool belongs in your security risk analysis. We cover the practical side in what an AI operations analyst does for a clinic.
ONC algorithm transparency. The Office of the National Coordinator for Health Information Technology (ONC) HTI-1 final rule set transparency requirements for AI and other predictive algorithms in certified health IT, which ONC calls decision support interventions. The aim was that clinical users could see baseline information about the algorithms they use and judge them for fairness, validity and safety. These requirements fall on EHR developers, not practices. On October 26, 2026, ONC's HTI-5 final rule revised the decision support interventions criterion and removed the older clinical decision support criterion. Ask your EHR vendor what information about its AI features it will keep providing, and record the answer in your inventory.
Section 1557. Under the Affordable Care Act's nondiscrimination rule, 45 CFR 92.210 bars covered entities from discriminating on the basis of race, color, national origin, sex, age or disability through patient care decision support tools. It adds an ongoing duty to make reasonable efforts to identify tools that use those factors as inputs, and to reduce the risk for each one. The 2024 final rule defines these tools broadly, as any automated or non-automated tool used to support clinical decision-making, and gave covered entities 300 days from its July 5, 2024 effective date to comply with the identification and mitigation duties. The same rule says HHS now treats Medicare Part B as federal financial assistance, which matters for practices that bill Medicare. Add a column to your inventory for "uses a protected characteristic as an input," and ask counsel how the rule applies to you.
How we approach this
We start with the inventory, because a practice cannot govern tools it has not listed, and AI features are often switched on inside software it already uses. Then we write the one-page policy around what is actually in use and set up a review routine the practice can run without us.
Ben Miller, who leads EMBERSTONE Partners, built an AI runtime governance harness with declared guardrails, pass/fail checkpoints and human-in-the-loop escalation, self-mapped to the NIST AI Risk Management Framework. We bring the same pattern to practices: say what each tool may do, check it at fixed points, and send anything uncertain to a person. Our AI operations transformation and strategic operations work both build governance in from the first use case.
Where to start
This week, build the inventory. Ask each team lead which AI tools and AI features their people use, including anything inside the EHR, the phone system and email. For each one, write down the data it sees and whether you have a business associate agreement. That single list tells you where your policy needs to be strict and where it can be simple. If you want a second set of eyes on it, book a free strategic assessment.