AI and Cybersecurity
AI Governance Is No Longer Optional
North Country Hospital shows how a rural critical access hospital built a practical framework for evaluating AI technologies, ensuring accountability and preparing for an AI-enabled future
By Jed Batchelder and Andrea Dale, M.D.
Artificial intelligence is entering hospitals through many doors: clinical documentation, revenue cycle, sched-uling, patient communication, analytics and embedded electronic health record (EHR) functionality.
Trustees and senior leaders have an important role to play in ensuring AI is adopted deliberately, with a governance process that can evaluate tools, approve appropriate uses, monitor results and explain how decisions are made.
At North Country Hospital (NCH), the AI Committee was created to make AI adoption safer, more transparent and more useful, not to slow down innovation.
NCH is a critical access hospital in Newport, Vt., just a few miles from the Canadian border. The nearest tertiary hospital is nearly two hours away and the next closest hospital is about 45 minutes down the road.
At NCH, as in many hospitals, AI is arriving one use case at a time: a documentation tool here, an analytics product and vendor upgrade with embedded AI features there. The permeation of AI into patient care and healthcare administration is happening faster than regulatory bodies can keep up with. Nationally, recent lawsuits regarding a lack of meaningful disclosure and consent to AI use in patient care illustrate why transparency, documentation and oversight have quickly become practical governance concerns.
A Rural Hospital Confronts New AI Questions
In early 2025, NCH was considering implementing an ambient listening scribe platform. Physicians raised questions about whether patients needed to consent before the tool was used. It was standard practice to obtain consent for a human scribe, but it was unclear whether that consent covered an AI-based scribe, where recordings and protected health information would be stored on vendor servers outside the hospital’s direct control.
These questions were posed to the hospital Ethics Committee, which recommended, based on the principle of transparency, that patients be informed of the AI scribe’s use and consent to it, either verbally or in writing. Recognizing that AI was entering other areas of patient care and administration, the committee also recommended creating a dedicated AI governance group to set a policy and standard for the hospital going forward. With these recommendations, administrative and clinical leadership sought a repeatable process for analyzing AI tool safety without blocking the innovation needed for NCH to adapt to growing pressures and limited resources.
For a critical access hospital, AI governance must answer some basic questions: What is the tool? Is it a solution to an actual problem? Who owns it? What data does it use? Does it impact patient care? Who validates it? How will we know if it is working? What happens if it fails?
Establishing Accountability and Oversight
The most important governance decision we made was conceptual: AI is a tool to augment the clinical expertise of our physicians, streamline workflows and improve patient outcomes. It does not replace accountability. Clinicians remain accountable for clinical judgment. Operational leaders remain account-able for business decisions. The organization remains accountable for privacy, safety and patient trust.
AI governance also requires people who see different kinds of risk. Our AI committee includes clinicians, information technology, clinical informatics, operations, compliance and medical ethics. The members have a broad range of AI experience. Some are true AI enthusiasts while others had little or no direct experience with AI before joining the committee. That range has proved valuable. The enthusiasts help the group understand what is possible. Those newer to AI often ask basic questions that are just as important: How would this work in a real clinical or operational setting? What could go wrong? A clinician may ask whether the tool affects clinical judgment and outcomes. An ethicist may ask whether it may minimize or worsen disparities in patient care. Compliance may ask whether patients need to be informed. IT may ask where the data flows.
At NCH, the AI Committee functions as a multidisciplinary management committee, bringing together clinical, operational, tech-nical, compliance and ethics exper-tise to evaluate AI solutions. While the committee is responsible for the day-to-day governance of AI adoption, board oversight remains an integral part of the organization’s overall governance framework, with AI governance elevated through existing executive, clinical and board reporting channels. This oversight is critical because AI can affect clinical decision-making, patient trust, operational performance, legal and regulatory exposure and the organization’s strategic direction.
From AI Approval to Ongoing Monitoring
The committee’s process starts with an AI Solution Request Form. A request form may sound simple, but it changes behavior. It shifts the conversation from enthusiasm to evidence: What problem are we solving? What data are we exposing? Who is accountable? What benefit do we expect? What risks are we accepting?
The form captures the solution name and vendor, AI functionality, expected benefits, potential risks, use of protected health information (PHI) or personally identifiable information (PII), data sources, integration needs, human oversight, business owner, cost and documentation. The committee then classifies tools as clinical, operational, administrative, embedded in an existing approved system, or potentially fast-track and low-risk. A vendor questionnaire asks AI vendors about validation, explainability, security practices, model maintenance, bias testing and drift prevention. The committee can recommend approval, conditional approval or deferral, with a written summary.
To avoid causing unnecessary bottlenecks for project implementation, we created a fast-track review process for AI tools that are administrative in nature and do not involve clinical decision support, diagnosis or other direct patient-care decisions. The committee’s approval of an AI solution is just the beginning. AI solutions must be monitored and measured to ensure they remain compliant and achieve expected benefits. This includes go-live readiness checks, training completion, data security confirmation, defined performance metrics, incident reporting, annual reevaluation and review after major upgrades. The business owner remains responsible for reporting results back to the AI committee.
Governance Beyond the Hospital Walls
The committee has already demonstrated its value. Patient consent for ambient documentation is an early example. Ambient listening solutions can record, transcribe, summarize and transmit patient-clinician conversations and in doing so, pose a risk for medical record accuracy and data privacy. The committee determined the appropriate level of patient-informed consent and ensured workflows include an opt-out or alternative process when needed. To align our policy with recommendations from national organizations, including the American Medical Association, our committee came to the consensus that transparency within our organization and between our organization and our community must be one of our fundamental guiding principles.
Another example of the value of the committee is its ability to evaluate AI embedded in the EHR and other systems. AI may arrive through a vendor upgrade rather than a new procurement. The organization needs to know where AI is already embedded, where outputs appear in the workflow, whether staff under-stand how to use it and how the tool will be monitored over time.
The AI committee also addresses staff members’ unapproved use of generative AI by creating policies and working with IT to implement technical safeguards to prevent PHI and PII from being entered into public domain AI solutions.
Smaller hospitals should not assume AI governance is only for large academic medical centers. Critical access hospitals may need governance even more because they have fewer resources to manage, track and evaluate AI solutions. If rural hospitals hesitate to develop a structured approach, their lack of deliberate AI adoption could become another form of digital divide, where organizations with the most resources are best positioned to benefit while smaller rural hospitals fall further behind.
Governance as Strategy
As the committee developed, we began to see that its role extended beyond traditional governance. Its primary purpose is safe, thoughtful and accountable AI adoption, but it also gives NCH a structured forum for strategy. Without a chief AI officer, innovation team or dedicated data science department, AI decisions can become fragmented across departments. The committee brings those conversations together, serving as both a guardrail and a strategic lens for evaluating AI’s role in the organization. In doing so, it ensures NCH can benefit from AI and does not miss opportunities available to larger, better-resourced organizations.
The committee’s strategic role has become even more apparent as NCH begins implementing Epic. By the time we go live in spring 2027, Epic will have released many additional AI-enabled features affecting revenue cycle and clinical care. Taking advantage of those tools will require more than simply turning them on. NCH will require leaders, clinicians and staff who understand how AI should be evaluated, what efficiencies can be gained, what risks need to be managed and how human judgment will remain firmly in control.
AI governance also needs to account for the external environment in which hospitals operate. Even if a smaller hospital adopts AI cautiously, it may still be affected by AI-enabled decisions made by outside parties, particularly payers. Hospitals are increasingly navigating questions about AI-supported documentation, coding, claims review, downcoding, denials and other payment decisions. For critical access hospitals, this means AI governance is not only about the tools the hospital chooses to implement internally but also about preparing leaders to understand, evaluate and navigate AI-driven processes from outside the organization that may affect reimbursement, operations and patient access.
AI has real potential to improve access, strengthen operations, support clinicians and improve patient outcomes. This transformative potential may be most significant in smaller rural hospitals, yet hospitals will only realize that potential if patients, clinicians and staff can trust how AI is selected, used, monitored and explained. Governance provides the structure for responsible innovation. For critical access hospitals, the goal should be to adopt AI deliberately, transparently and in a way that strengthens the trust between the hospital and the community it serves. For trustees, that also means ensuring there is a clear governance structure that gives the board appropriate visibility into AI-related risks, opportunities and strategic decisions while allowing management to lead implementation and operational oversight.
Jed Batchelder (www.linkedin.com/in/jedbatchelder), is the founder/principal consultant for Symphonic Healthcare Solutions in Burlington, Vt., where he advises hospitals and health systems on operational improvement, interoperability, governance and emerging technology adoption.
Andrea Dale, M.D., (adale@nchsi.org), is a family and geriatric medicine physician and co-chair of the AI Committee at North Country Hospital in Newport, Vt., where she provides primary and geriatric care and helps lead the hospital’s AI governance efforts.
Please note that the views of authors do not always reflect the views of the AHA.