Ambulatory Care RN

Why Healthcare AI needs Governance and security. Table of contents. Healthcare is at the forefront of other industries when it comes to its adoption of artificial intelligence, with organizations of all shapes and sizes using AI to transform clinical care, improve administrative workflows and advance research. But there are still growing pains, and some significant imperatives around healthcare AI governance security need addressing, according to leaders from the National Institute of Standards and Technology and the Coalition for Healthcare AI. The core challenge behind Healthcare AI governance security. As the front end of the AI adoption curve relies heavily on vendor assessments to screen for clinical safety, data integrity and model validation before AI is integrated into clinical workflows, ongoing AI monitoring and continued navigation of emerging legal and regulatory uncertainties are needed to safeguard patients and data. A central question for the industry. "As healthcare moves from experimenting with AI to deploying it at scale, who will define what trustworthy actually means? And how do organizations put that into practice?" Baxter Lee, president of cybersecurity firm Clearwater, asked during a recent webinar featuring Brendan Hill, CHAI's head of operations and general counsel, and Julie Chu, NIST's applied cybersecurity vision director. A year of optimism around Healthcare AI governance security. "I find it interesting that healthcare, at least from my perspective, is one of the industries that's kind of leading AI adoption right now," said Hill, who was previously the regulatory strategy and compliance manager at Mayo Clinic Platform and a member of its Software as a Medical Device Review Board. Healthcare is also cognizant and applying lessons learned, according to Chu, who previously directed the Governance, Risk Management, and Compliance Division within HHS's Office for Information Security. "There is a lot of leaning in, in terms of being on top of the governance piece," she said. Defining organizational trustworthiness. Chu said organizations are asking, "How do we define our trustworthiness within our organizations? How do we look at that metric or that measure for what we think as an organization should be trustworthy or should be ethical or should be all the other AI risk management framework characteristics for what trustworthy AI is?" Starting with AI amid growing tool portfolios. Anecdotal evidence indicates that some health systems are considering between 200 and 500 AI tools in their queues, Hill said. Both the Joint Commission and CHAI have put together playbooks to help healthcare organizations manage the challenges those investments bring. The Joint Commission recently released governance playbooks as part of its voluntary AI responsibility certification program, and CHAI launched its national PULSE initiative this month to engage public health practitioners in co-developing and piloting five key generative AI use cases. The hardest part: AI monitoring. The goals of CHAI's playbooks are to "position organizations to think critically," Hill said, focusing on control methodologies to help organizations understand the entire AI lifecycle. But one of the hardest parts for organizations to implement is AI monitoring, largely due to how fast the technology is moving. "There are no clearly defined metrics for what we should monitor," Hill said. "Science hasn't quite caught up with where people are adopting and what people are doing. There's still very much a 'black box' sense to AI, even though we have more in-depth understanding about it." Training and ROI challenges within Healthcare AI governance security. Training, which also affects AI uptake within organizations, is a second key challenge, Hill said. "I think one of the more emerging issues that organizations are starting to struggle with is the training and education component," he said. "How do you train a staff member to use AI responsibly?" A third key hurdle is scaling the use of AI so that it brings a return on investment. "Not many organizations, if any, have been able to tackle that yet," Hill said. "But I think there's going to be a lot of thought that's put into that in the coming years." Establishing risk-based tiers. Healthcare leaders must treat AI vendors as a supply chain issue, contractually requiring third-party vendors to notify the organization before baking AI into existing tools as organizations build auditable trails to justify their AI governance choices in the event of an incident, Hill said. Smart governance accelerates adoption by categorizing AI into low, medium and high-risk tiers. "Start with the low-hanging fruit," he said. When low-risk applications move quickly through streamlined checks, high-risk tools can undergo intensive reviews. Why governance speeds rather than slows adoption. "The reason why governance does the opposite of slowing [AI] down is you're getting the right people with the right expertise solving the right problem along the governance chain," Hill said. "An enterprise governance mechanism should own AI as a leadership team," Chu added. Organizations succeeding at this take a risk-based approach where each level of risk requires a specific level of governance to be applied, rather than getting bogged down in details for everything. Vendor vetting for clinical safety. After studying more than 800 intake questions from 15 different institutions, Hill said clinical safety and efficacy are the chief concerns, so vendor assessments must evaluate tools for fairness and nondiscrimination. Considering how an ambient scribe might work across clinical practices, for example, requires examining legal and regulatory compliance, security and access controls, workflow integration, and data integrity with demonstrable data lineage. CHAI has worked to bring its intake questionnaire down to about 60 questions it plans to release in the coming months. How changing cybersecurity frameworks support Healthcare AI governance security. Chu, who co-led the development of the Cybersecurity Act of 2015 Section 405, said NIST is looking at AI from a cybersecurity perspective: "How is AI changing the guidance, the guidelines, frameworks, standards that we have today in terms of cybersecurity and privacy?" Governance and enterprise risk management go "hand in hand," she said. The NIST AI Risk Management Framework, which is undergoing updates with a public comment period expected to open later this year, includes a set of trustworthy characteristics that are AI-specific and can be integrated with any organization's existing governance structure. Additional NIST resources. Chu recommended other NIST-based resources, including NIST's Small Business Program, Quick Start Guides on cybersecurity, enterprise risk management and workforce management, and the Cyber AI Profile. "We use the NIST AI RMF to inform a lot of our frameworks, as well," Hill added. Shifting to product-centric AI within Healthcare AI governance security. Organizations are moving away from top-down, centralized AI committees toward product managers who directly own specific use cases and act as points of contact between clinical staff and vendors, enabling operational and contractual guardrails and empowering health systems to negotiate critical protections into contracts, such as the right to pre-approve model updates, tie payments to performance benchmarks, or disable unverified features. Why cross-collaboration strengthens contracts. Cross-collaboration with business users will ultimately lead to stronger contracts, Hill said. "The lawyer is not going to have the subject matter expertise to say, 'We should have a number of different things in a contract to protect our organization,' because they just don't understand the nuances of how it's going to be used in the workflow," he said. Why elevating risk is a sign of good governance, not failure. "It is very important that people realize, when you elevate a risk, it's not failure," Chu said. "It means you're managing and you have a good governance process, method, approach. That's why a risk is elevated, or that's why it's become much more important or the priority has changed." Both leaders acknowledged the difficulty of the work. "It is not easy to do governance well," Chu said. "It is hard work," Hill agreed. "It is a process, and dedication is needed when pulling these together," Chu added. What this means for health systems building their own AI governance. As health systems continue expanding their AI tool portfolios into the hundreds, this discussion around healthcare AI governance security underscores that successful governance isn't about slowing adoption, but about routing decisions to the right people with the right expertise at each risk tier. Organizations still struggling with monitoring metrics, staff training, and ROI measurement may find CHAI's forthcoming 60-question vendor intake framework and NIST's updated AI Risk Management Framework useful starting points as they build out their own structures. What to watch going forward. With NIST's AI RMF update expected to open for public comment later this year, and CHAI planning to release its refined vendor intake questionnaire in the coming months, health systems building or refining their governance frameworks should watch for how these evolving standards shape best practices industrywide. Given how quickly the underlying technology continues to change, both Hill and Chu's emphasis on treating governance as an ongoing process, rather than a one-time policy exercise, suggests organizations should expect their healthcare AI governance security frameworks to require continuous revision rather than a single definitive setup.

Joint Commission International launches Center of Excellence Certification to address market gap, signal to patients clinical service-line distinction. New certification offers international healthcare organizations a rigorous and visible signal of commitment, performance, and trust. 2 minutes read Joint Commission International (JCI) announced its Center of Excellence (COE) Certification, a first-of-its-kind globally credible program that provides a comprehensive, independently validated framework to define and recognize clinical service-line excellence. Achieving this certification from JCI signals to patients and families that an organization demonstrates what it truly means to be experts in providing the specialized, high-quality, safe care that so many lives depend on. At launch, the certification is available for five clinical service lines, reflecting areas of strong global interest among healthcare organizations, including: pediatrics, oncology, trauma, orthopedics, and maternal-perinatal care. JCI will continue to expand the COE certification portfolio to include additional clinical specialties as regional and national programs grow and individual organization needs evolve globally. "The term 'Center of Excellence' is widely used in healthcare, but often without a consistent or objective basis for how it is defined or evaluated," said Joint Commission said Jonathan B. Perlin, MD, PhD, president and CEO, Joint Commission. "Any hospital can simply call itself a Center of Excellence - and many do - but the new JCI Center of Excellence Certification fills that gap by providing a transparent and internationally recognized approach for healthcare organizations to define and measure clinical excellence." "Our COE program shows patients, their loved ones, health authorities, and other stakeholders that these organizations chose to commit, invest, and be held accountable for excellence. It's a step above - it's about signaling both capability and commitment," added executive vice president and COO, Jim Merlino, MD. The unique aspect of the COE program is that it meets healthcare organizations where they are in their quality and patient safety journey, without requiring JCI accreditation as a prerequisite. This flexibility enables organizations that are not yet accredited to begin demonstrating their commitment to excellence at the service line level, starting in areas where they already have strength. At the same time, for organizations that are JCI accredited, COE Certification represents a "next level" recognition of performance within a clinical specialty, strengthening consistency, measurement, and performance. The program reinforces key capabilities aligned with accreditation, such as standardized performance measures and structured processes for care delivery, while applying them in a more focused, service-line context. In doing so, COE helps organizations build confidence and momentum to expand excellence within a service line and progress toward broader organizational goals. For international health authorities, JCI's COE Certification provides a credible, standardized framework that helps validate excellence in specific clinical areas. Many health authorities have their own Center of Excellence programs, and JCI's approach is designed to complement these efforts with an internationally recognized benchmark for performance. COE framework integrates evidence-informed standards, internationally recognized clinical practice guidelines, and standardized measurement. Certification is not a one-time achievement; organizations are expected to demonstrate sustained performance and ongoing improvement during annual performance reviews each year, ultimately enabling them to strengthen quality of care and safety over time for patients and families who require specialized care. Healthcare organizations that provide acute patient care outside of the United States can apply for JCI Center of Excellence Certification today. For more information and eligibility criteria, visit https://www.jointcommission.org/en/certification/center-of-excellence