Do you really know all of the places and ways that AI is being used in your ASC? If not, it’s time to perform an inventory and take control of the situation before it gets away from you. And “getting away from you” could mean everything from survey failures to incorrect clinical decisions being made for your patients.
The solution is to establish a solid governance framework to ensure everyone at your center is using AI safely. Fortunately, the Accreditation Association for Ambulatory Health Care (AAAHC) is here to help.
AAAHC’s standards emphasize patient safety, quality improvement, leadership accountability, and operational excellence—and effective AI governance addresses all of them. During her session last month at Periop Leader Week in Savannah, Ga., “Leading AI safely: A practical governance framework for perioperative leaders,” Julie Lynch, MS, BSN, RN, director of the Institute for Quality Improvement with AAAHC, laid it all out for ASC leaders.
“I’m here to answer the question: How do I know whether AI use in my organization is safe, appropriate, and frankly, under control?” Ms. Lynch told assembled ASC leaders, as she described the need for and utility of the new AAAHC 1095 Advance AI Governance Guide. “It includes all of the information you’re going to need to answer that question, as well as immediately implementable tools you can use to create your safe AI governance.”
Julie Lynch, MS, BSN, RN, director of AAAHC’s Institute for Quality Improvement
“Technology changes, and boy, it changes fast, doesn't it?” said Ms. Lynch. “But good governance is what endures. AI itself isn’t the risk. Poor governance is the risk that you’ll experience with AI.
“We know that AI is a powerful tool that can do great things,” said Ms. Lynch. “You can have AI systems that touch activities that affect some pretty big things in your organization: patient safety, risk management, efficiency, and of course your regulatory or accreditation readiness. But AI is never going to replace human judgment.
“Organizations are adopting AI because the benefits are real. It can reduce administrative burden, improve efficiency, increase consistency. This is a COO’s or a CEO’s dream—improving efficiencies. It can also identify patterns and flag risks so you can adequately take care of them. It’ll support decision making in areas that really were never possible before.
“But I hate to break it to you: It’s not perfect. It can also generate inaccurate information. It can reflect bias in its results. It can create big-time privacy and security concerns. It can contribute to automation bias—people begin trusting the AI outputs more than their own judgment. An additional challenge with AI: When a person makes a mistake, it’s usually one mistake. Unfortunately, AI can replicate that mistake hundreds or thousands of times before it’s even noticed.
“The goal isn’t to avoid AI. The goal is to maximize it while containing these risks. That’s where your governance fits in. Issues happen when there’s no oversight, no validation, no training, no monitoring, no accountability.
“Imagine a clinician who starts using an AI tool that was never approved by your organization. What if staff has a quick question about something and enters PHI into public platforms like ChatGPT? Now you have a major PHI breach. Those aren’t people failures. They’re not AI failures either. Those are governance failures. It’s all about how you govern it.”
So what does good AI governance look like? The AAAHC has assembled a framework for ASC leaders built around four core principles:
Oversight and accountability. “AI should never show up in your organization by accident,” said Ms. Lynch. “It should be a plan. Someone needs to approve it. Someone needs to oversee it. Someone needs to be accountable for its use. The governance is what establishes all of that before a problem occurs, not after.”
Transparency, validation, and accuracy. “Anybody who touches AI needs to know what it is supposed to do, its limitations, and what to do if it’s not working as we thought it was working,” she said. “Before you safely rely on an AI system, you need evidence that it works within your environment—and solely in your environment. We know it works perfectly in the vendor’s environment.”
Data security and privacy. “We're putting all of our sensitive organizational information into some of these systems,” said Ms. Lynch. “We’re uploading everything about a patient; every identifier possible is hitting the AI tool. We need to make sure that we, as well as our vendors, meet the same cybersecurity protections that apply elsewhere in any kind of healthcare.”
Human oversight and accountability. “AI can support decisions, but it can’t assume responsibility for them,” said Ms. Lynch. “Whether the tool generates a note, recommends a schedule, or predicts a risk, the responsibility and the final decision remains with the human who is using it.”
Part of effective AI governance is to not treat all AI applications the same. Some use cases are riskier than others. For example, taking notes during a meeting is probably low risk, but an error in a patient EHR that leads to a poor clinical decision is a much higher risk. With a solid AI governance process in place, ASC leaders will know what to do to address each level of risk: low, moderate, or high.
A low-risk example is using speech recognition to summarize your leadership meetings and staff meetings. “In that scenario, an occasional error is unlikely to affect any patient safety situations, so you can just apply some routine oversight to that,” said Ms. Lynch. She described a situation where the summary changed someone’s name from “Jen” to a nonexistent employee named “Jim.”
“That’s an easy fix: Change ‘Jim’ back to ‘Jen.’ No big deal, no patient safety issue,” said Ms. Lynch. “Now apply that same technology to generating an operative note that’s going to be part of the clinical record. What if there’s an omitted complication? What if there’s an inaccurate statement? That’s going to affect your documentation integrity, your billing, and—hopefully not—but a legal situation may occur. The technology didn’t change here. The consequences of the error have changed.”
When performing an AI risk assessment, Ms. Lynch said ASC leaders must understand the AI system’s intended purpose and evaluate the impact if the output is incorrect. She suggests answering these five questions to establish an AI application’s risk level:
“These questions establish the foundation,” said Ms. Lynch. “You're going to know if it is low risk, moderate risk, or high risk. AI doesn’t have an inherent level of risk. The risk is based on how you use it within your daily practice. AI use for clinical decision making carries a significantly higher risk, so it will require more oversight, validation, and governance.” That said, she urged leaders not to overlook lower risk applications that can lead to one minor mistake being replicated over and over again.
A formal AI risk assessment tool is included with AAAHC’s AI Governance Guide that can be applied to every AI system and application in use at your center. “It will help you with applying what you need to do from a governance level,” said Ms. Lynch. “As you move from low to moderate to high risk AI, validation increases, monitoring increases, leadership involvement increases, accountability increases and of course human oversight increases. The higher the potential consequences of an error, the stronger the governance you’ll need to apply.”
Ms. Lynch said ASC leaders should ask these five questions about any AI app or use case:
“Whenever someone tells you they want to use an AI tool, these should automatically be your first five questions,” said Ms. Lynch. “Organizations tend to get into trouble when they know they have AI but can’t answer them. The biggest governance decision most organizations make about AI today is really not a decision at all. It’s allowing that adoption to occur without even realizing it.”
Ms. Lynch warned ASC leaders to be on the lookout for these potential failure points:
Shadow AI. “This is the AI that’s lurking behind the shadows that you don’t know about,” she said. She mentioned examples, such as a staff member uploading PHI to the public ChatGPT, which can lead to a breach.
Embedded AI. Be aware if your existing applications such as your EHR are using AI to perform certain functions. “That makes your IT and your legal department very nervous,” said Ms. Lynch. “You can’t govern what you don’t know, so get to know an inventory of all the AI you are using in your organization. Many leaders find out after it’s too late.”
Your ASC is responsible for the impacts of your AI use—not your AI vendor. “The vendor is not responsible for this tool after you purchase it and implement it,” she said. “From a surveyor perspective, we’re going to ask who is overseeing this. Be fully aware that you are solely responsible for it.”
Know your AI inventory. “Inventory all of the different types of AI that you have in your organization,” said Ms. Lynch. “If you don’t know what you have, you can’t do a risk assessment. And if you can’t do a risk assessment, you don’t know what’s happening, and pretty soon you’re probably going to find an error.” Assign everything a risk classification: low, moderate or high, which will trigger the correct governance approach in your framework. “A meeting summary tool shouldn’t require the same amount of governance as a clinical decision-making tool would,” she said.
Address automation bias. Ms. Lynch said some providers can develop an overreliance on AI outputs, which over time can lead to automation bias. “If you’re ever in a situation with a regulatory body or within a survey, ‘the computer told me so’ is going to be the wrong answer. You need to know who is overseeing it and what it does,” she said.
Lack of monitoring. “A tool that worked six months ago may not work now,” said Ms. Lynch. “The technology is truly changing that fast, and performance drift does happen.”
AI is not “set it and forget it.” Don’t view AI purchases or upgrades as a one-time implementation and then you’re done. “If you upgrade to the new Outlook, installed it, and trained the staff on it, you move on and you just get used to it. That approach works very poorly in the world of AI,” said Ms. Lynch. “AI governance is a lifecycle.” That lifecycle includes evaluation, approval and risk assignment, validation, and monitoring.
Know where AI-driven information is stored. Said Ms. Lynch, “Where does the information go? Does it go to a cloud? Who monitors that cloud? Who’s responsible for it? What information is going there? How long is it stored? These are questions that savvy consumers are going to start to ask, because this makes them nervous.”
Lack of documentation. “Make sure you document all those little things, the errors you’re finding, and the overrides you need to do,” said Ms. Lynch.
Lack of improvement. Ms. Lynch advised to keep performance improvement in mind as you move forward with AI applications and use cases. As needed, adjust your workflows, strengthen your controls, retrain users, and revalidate the system as you go. “Continuous verification is what good governance looks like,” she said. “The goal is not perfection. The goal is maturity over time. AI is a journey. It’s not a destination. What’s the next step forward for you? Always improving.”
“The surveyors aren’t there to determine that you’re using the coolest AI,” said Ms. Lynch. “What they’re looking for is if you can demonstrate that you have the foundation built to use your AI safely.” She said surveyors will ask the following primary questions about AI use in your organization:
“We’re not going to restrict any of your innovation. We just want to help support safe innovation,” said Ms. Lynch of surveyors. “Everything should come back to this main principle: AI supports human expertise, but it never replaces human judgment. It’s there to make your jobs easier. It’s there to advance patient care. But it will never replace the human judgment. It can’t think. It doesn’t have emotion. It gives you facts and it gives you predictions. You still need to use that human component. The human remains accountable—not the vendor, not the algorithm, not the software. This principle protects your patients, your organization, your clinicians. It creates trust in responsible AI use. Human oversight isn’t a feature of good governance; it’s the foundation of good governance.”
If all of this sounds kind of overwhelming to you as a clinical, operational or business leader at an ASC, well...it is in a sense. The important thing is to get started, or to improve on your existing AI governance where needed.
“Don’t try to solve everything next week,” said Ms. Lynch. “AI governance is a journey.” She said the AAAHC 1095 Advance AI Governance Guide includes tools to help, such as an AI inventory tool, a risk assessment tool, a sample policy, an AI vendor evaluation tool and checklist, an AI lifecycle management checklist, an AI survey readiness checklist, and even a survey-related Q&A based on new AAAHC AI-related standards that provides appropriate answers to typical surveyor questions.
“We want to do the right thing, and we’re trying to make it easier for you,” said Ms. Lynch. “We want you to govern this appropriately, so we’ve tried to give you as many tools as possible. You don’t need to create this from scratch. These resources were designed specifically to help you move through this process efficiently.”
Download AAAHC’s free 1095 Advance AI Governance Guide here.
Ms. Lynch encouraged ASC leaders to make a commitment to yourself by creating an AI governance action plan. She said one thing is certain: AI and the innovation it produces will not slow down or go away.
“AI tools may look very different over the next two years; heck, I think they’re going to look different in the next two weeks,” she said. “Some technologies will disappear; others haven’t even been implemented or created yet. But governance principles are going to endure. The organizations that thrive won’t necessarily be the organizations with the most AI. They’re going to be the organizations that understand what they are using, why they are using it, the risks involved, the safeguards required, and who remains accountable.
“Success won’t be measured by how much AI you adopt, but by how safely, responsibly, and intentionally you govern it. So remember: Technology changes, but good governance endures. That’s the foundation of AI leadership.”
