Description
HIPAA PRIVACY & SECURITY RULES | 45 CFR 164.530(j), 164.316(b)(2)
HIPAA AI Governance Operating Kit Template
Document ID: HEL-AI-KIT-001 • Version 1.0
An AI governance policy that states the Committee “shall maintain an AI System Registry” has created an obligation, not a registry. HIPAA requires documentation of policies, actions, and assessments to be retained for six years under 45 CFR 164.530(j) and 164.316(b)(2), and the same principle governs every AI-specific determination an organization makes: which tools are approved, which records fall inside the designated record set, whether recording consent was captured, how a bias evaluation came out, and who reviewed an AI-supported coverage denial. When OCR, an accrediting body, or a plaintiff’s attorney asks how a specific AI system was governed, the organization has to produce the record itself. A policy document alone does not answer the question.
This Kit supplies the 14 record instruments that discharge those obligations, each mapped to the specific provision of the AI Governance Policy (HEL-AI-GOV-001) and AI Governance Committee Charter (HEL-AI-CHARTER-001) it satisfies, with the responsible owner named for each. Every register carries its own operating rules: who holds write authority, what triggers an update, how often the Committee audits it, and how long it is retained. Sections may be extracted and used individually, and any instrument may be maintained inside an existing GRC platform, spreadsheet, or EHR module rather than as a standalone document. A Small Organization Implementation Path defines a compliant scaled structure for practices without a multidisciplinary committee, and an Ambient AI Scribe Fast-Track reduces the most common first AI deployment to a fixed ten-item pre-go-live checklist.
What Is Included
Inventory and Pre-Deployment Approval Records
- AI System Registry with 22 fields covering risk tier, regulatory classification, validation results, BAA status, and retirement disposition
- Approved AI Tool List with PHI permissions, data-type restrictions, and review dates
- Ethics Review Record with six documented criteria, applied as a separate gate from technical risk assessment
- AI Model Material Change Log with FDA Predetermined Change Control Plan assessment field
Monitoring, Legal, and Records Determinations
- Bias, performance, and model drift monitoring log with validation baseline, seven-population disparity evaluation, and escalation thresholds
- State law preemption worksheet covering California AB 3030 and CMIA, Colorado SB 26-189 and SB 21-169, Illinois BIPA, HB 3773, and HB 1806, Texas TRAIGA, and NYC Local Law 144
- Recording consent determination for ambient and voice-capture AI under the Federal Wiretap Act (18 U.S.C. 2510) and state all-party consent statutes
- Designated record set determination for AI notes, drafts, audio, transcripts, prompts, and vendor-held outputs (45 CFR 164.501, 164.524, 164.526)
Incident, Payment, Workforce, and Lifecycle Records
- AI incident report with the four-factor breach risk assessment applied to AI outputs, embeddings, and caches (45 CFR 164.402(2)), plus HHS, media, EU AI Act Article 73, and FDA medical device reporting fields
- AI coverage and payment determination record capturing the human reviewer’s credentials and individualized clinical rationale, with quarterly denial and overturn rate review
- Workforce AI concern report log with anonymous reporting and non-retaliation (45 CFR 164.530(g))
- Retirement authorization request with vendor PHI deletion confirmation covering model weights, training logs, and inference caches, and training attestation and completion log (45 CFR 164.530(b))
Scaled Implementation for Smaller Organizations
- Small Organization Implementation Path mapping each full-structure requirement to a scaled equivalent, with the non-negotiable elements identified
- Minimum Viable Record Set: the five records any organization should be able to produce for every AI system in use
- Ambient AI Scribe Fast-Track: a ten-item pre-go-live checklist where any single “No” stops the deployment
Who This Is For
Privacy officers, security officers, and compliance leaders at hospitals, health systems, and medical groups that have adopted an AI governance policy and now need the registers and forms that make it auditable. AI Governance Committees use the Kit as their standing documentation set. Solo practitioners and small practices without a multidisciplinary committee use the Small Organization Implementation Path to meet the same legal obligations with a scaled structure. Organizations deploying an ambient AI scribe as their first AI system can work from the Fast-Track checklist alone.
Every register and form in this Kit is a starting structure, not a mandated format, and none of them is evidence of governance until it is completed and maintained. Fields may be added, removed, or merged to fit existing documentation systems. The Kit assumes the AI Governance Policy (HEL-AI-GOV-001) and Committee Charter (HEL-AI-CHARTER-001) have been adopted, since each instrument discharges a specific obligation created by those documents. State law determinations and retention periods should be confirmed with counsel, and the state law worksheet should be re-verified at each annual review rather than carried forward.
Format: Microsoft Word (.docx), fully editable • Delivered as an instant digital download • Document ID: HEL-AI-KIT-001
Reviews
There are no reviews yet.