Artificial intelligence is already embedded in the way medical groups and facilities operate: in billing and coding platforms, dictation and documentation tools, EHR features, hospital-deployed clinical software, and the consumer chatbots your physicians and staff may be using on their own.

Very little of it arrived through an “AI agreement.” It arrived through a vendor’s software update, a billing company’s new “platform,” a hospital’s new tool, or a physician’s late-night shortcut. And it’s governed, or more often not governed, by agreements and policies drafted before anyone was thinking about AI: agreements you signed, agreements that auto-renewed while the technology changed underneath them, and policies that were never written at all.

Each of those is a source of risk your group or facility doesn’t have to carry. We help you find it and fix it.

Where AI Risk Hides

Business Associate Agreements

HIPAA requires a BAA whenever a vendor handles protected health information, but it says almost nothing about AI. We review and negotiate BAAs for the issues most templates ignore, including:

• Whether the vendor may de-identify your data, and what it may then do with it.

• Data aggregation rights that let a vendor pool your data with other clients’ data.

• Whether the vendor’s own AI providers and subcontractors are bound by the same obligations.

• Return-and-destruction clauses that can’t actually be performed once data has been used to train a model.

• Breach definitions, response obligations, and cost allocation that account for AI-related incidents.

Billing/Revenue Cycle (RCM) Vendor Agreements

When an algorithm suggests a code, the claim still goes out under your billing numbers, and the compliance exposure stays with you. We address:

• Responsibility, audit rights, and indemnification for AI-assisted coding and claim submission.

• Transparency into how AI is used on your claims, and the documentation trail needed to defend them.

• Vendor use of your non-PHI data, such as payer rates and contract terms, which a BAA doesn’t protect.

• Performance metrics and reporting that reflect how the vendor’s AI actually performs.

Hospital and Facility Agreements

Professional services agreements, exclusive contracts, and coverage arrangements rarely address what happens when the hospital or facility selects an AI tool and expects physicians to use it. We address:

• Who selects, configures, and controls clinical and operational AI tools, and who bears the liability when they fail.

• Indemnification and insurance coverage for AI-assisted clinical decisions.

• Use of the group’s clinical work, such as notes, reads, and documentation, to train or benchmark AI systems.

• AI-generated quality and productivity metrics used to evaluate, discipline, or replace the group.

• Preservation of physicians’ independent medical judgment.

Hospital Agreements with Physician Groups and Medical Staff

When a hospital deploys an AI tool, physicians it doesn’t employ are often the ones using it: contracted anesthesia, radiology, emergency medicine and hospitalist groups, along with independent members of the medical staff. Most professional services agreements, exclusive contracts and medical staff documents were drafted before those tools existed. We help hospitals address:

•  Requirements that contracted physicians use hospital-selected AI tools, and how responsibility is allocated when those tools fail.

• Indemnification and insurance provisions that account for AI-assisted clinical decisions by contracted physicians.

• Rights to use clinical documentation, reads and other work product generated by contracted groups, including for AI development, benchmarking or quality programs.

• Use of AI-generated quality and productivity metrics in contract performance standards, renewal and termination decisions, and peer review.

• Medical staff bylaws, rules and policies on physicians’ use of AI, including tools physicians bring in on their own.

• Business associate and data-sharing arrangements with contracted groups and their vendors.

• Preserving physicians’ independent medical judgment, which matters for both patient care and corporate practice of medicine considerations.

Internal AI Policies

If your group has no rules for AI use by physicians and staff, you have a policy anyway; it’s just not one you chose. We draft and update policies and related employment and independent contractor agreement provisions covering:

• Approved and prohibited AI tools, including consumer chatbots.

• Protection of patient information and confidential business information.

• Ambient documentation and AI scribes, including patient notice and consent.

• Physician review of, and responsibility for, AI-generated documentation and recommendations.

• Training, monitoring, and enforcement.

Management Services and Private Equity–Backed Arrangements

When a management company owns the technology stack, it may also control the data and the AI built on it. We address data ownership, AI use, and what happens to both if the relationship ends.

Other Agreements

AI risk also turns up in EHR, telehealth, and other technology platform agreements; payer agreements; malpractice and cyber insurance policies; and representations and due diligence in practice acquisitions and sales. We review those through the same lens.

How We Help

• AI risk review of existing agreements and policies.We inventory where AI touches your organization, review the agreements and policies that govern it, and identify the gaps, prioritized by exposure.

• Negotiation of new and renewing agreements. We treat every vendor, hospital, facility, and management agreement as an AI agreement, whether or not anyone calls it that.

• Policy development. We draft AI-use policies and agreement provisions built around how your organization actually operates.

• Ongoing counsel. As vendors update their products and the legal landscape evolves, we help you keep your agreements and policies current.

Why Forms Won’t Do It

Forms are written either by the other side, in which case they protect the other side, or generically, in which case they protect no one in particular. An “AI addendum” or a vendor’s updated BAA doesn’t know how your group uses AI, how your hospital deploys it, or what your billing company is doing with your data. Protection comes from agreements and policies tailored to your relationships, your risks, and your strategic goals.

Who We Work With

We represent hospital-based physician groups, including anesthesiology, radiology, emergency medicine, and hospital medicine groups; office-based medical groups; ambulatory surgery centers and other outpatient facilities; and hospitals across the country.