Healthcare AI Governance: Frequently Asked Questions
Last updated: October 2026
Healthcare AI governance is the documented system that decides which AI tools an organization uses, who approves them and how they are monitored after launch.
Integral Healthcare Solutions (IHS), founded in 2002 by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC, drafts AI governance programs for health plans, health systems, health IT developers and pharmacies. IHS drafts the charter, inventory, risk records and policies for your compliance, clinical and IT leaders to review and approve. This page answers common buyer questions about the federal sources, state and EU rules, documents and cost. The sources were opened on October 6, 2026. See the AI governance service overview for the full engagement.
Which federal sources bear on healthcare AI governance?
Four federal sources come up most often in healthcare AI governance work. Each row summarizes the source in IHS's words, with a link to the Federal Register or agency page opened on October 6, 2026. This page does not report changes made after publication, so check the current text before you rely on it, and ask your counsel which sources apply to your organization.
| Source | What it covers |
|---|---|
| ONC HTI-1 final rule, 89 FR 1192, January 9, 2024 (effective February 8, 2024) | Revises the certification criterion for decision support interventions in the ONC Health IT Certification Program and adds a new baseline version of USCDI. It is aimed at health IT developers in the certification program. |
| HHS Section 1557 final rule, 89 FR 37522, May 6, 2024 (effective July 5, 2024) | Includes 45 CFR 92.210 on nondiscrimination in the use of patient care decision support tools by covered entities. |
| FDA final guidance on Predetermined Change Control Plans for AI-enabled device software functions, 89 FR 96259, December 4, 2024 | Gives FDA's recommendations for the information a PCCP should contain in a marketing submission for a device with AI-enabled software functions. |
| NIST AI Risk Management Framework 1.0, released January 26, 2023 | A framework intended for voluntary use to manage AI risks. NIST's page says it is being revised as part of the White House AI Action Plan. |
What this is not
IHS is not a law firm. This page is not legal advice, and IHS gives no opinion on whether a law applies to your organization.
IHS is not a regulator, certifier or accrediting body, and it does not certify that an organization is compliant. IHS drafts, and your organization's named contact submits to any agency.
IHS is not a HITRUST licensee and does not perform HITRUST assessments. No engagement guarantees an audit, certification or enforcement outcome.
Frequently asked questions
What is AI governance in healthcare?
It is the documented system that controls how an organization selects, approves, deploys, monitors and retires AI tools in clinical, coverage and administrative workflows. The core records are a governance charter, an AI inventory, risk records and policies. A committee that meets but leaves no records cannot show how a tool was approved and monitored.
What does ONC HTI-1 require for decision support interventions?
The HTI-1 final rule revises the certification criterion for decision support interventions in the ONC Health IT Certification Program, which applies to health IT developers in that program. The Federal Register summary lists revised criteria for "decision support interventions" and a new USCDI baseline of Version 3 (89 FR 1192, page opened October 6, 2026). Read the current regulation at 45 CFR 170.315(b)(11) and confirm with counsel whether your products are covered.
What does Section 1557 say about patient care decision support tools?
The 2024 final rule includes 45 CFR 92.210, which prohibits a covered entity from discriminating on the basis of race, color, national origin, sex, age or disability through the use of patient care decision support tools. Paragraphs (b) and (c) add a duty to make reasonable efforts to identify uses of tools that employ input variables measuring those characteristics and to mitigate the risk of discrimination (89 FR 37522 and the eCFR text, pages opened October 6, 2026). Confirm with counsel whether your organization is a covered entity.
Is the NIST AI Risk Management Framework required?
No, NIST describes the AI RMF as intended for voluntary use. IHS uses AI RMF 1.0 as a reference when it compares your current state with a governance framework, and NIST's page says the framework is being revised (page opened October 6, 2026). Check NIST's page for the current version.
Which state AI laws affect healthcare organizations?
State AI laws vary by jurisdiction, and your counsel decides which ones apply to your footprint. Two bills IHS reads with counsel, from state legislature pages opened October 6, 2026: Colorado SB24-205, titled Consumer Protections for Artificial Intelligence, covers developers and deployers of AI systems that make consequential decisions (Colorado General Assembly), and Texas SB 1188, captioned as relating to electronic health record requirements, was signed June 20, 2025 and lists an effective date of September 1, 2025 (Texas Legislature Online). Colorado SB25B-004 extended the SB24-205 effective date to June 30, 2026 (Colorado General Assembly, SB25B-004, page opened October 6, 2026). That date has passed, so confirm the current status in the statute with counsel. IHS builds a table of the laws to review for your footprint, and the healthcare AI regulatory tracker lists the sources IHS opened.
Does the EU AI Act apply to U.S. healthcare companies?
It can, depending on what you sell and where your AI output is used. Article 2(1) applies the regulation to providers placing AI systems on the EU market whether or not they are established in the EU, and to providers and deployers in third countries where the output of the AI system is used in the Union (Regulation (EU) 2024/1689, Article 2, page opened October 6, 2026). The Act entered into force on the twentieth day after its publication in the Official Journal on July 12, 2024, and applies in stages (Regulation (EU) 2024/1689, Article 113, page opened October 6, 2026). Ask EU-qualified counsel which dates and obligations apply to your products.
What is a Predetermined Change Control Plan for an AI-enabled device?
It is a plan, included in an FDA marketing submission, that describes modifications planned for an AI-enabled device software function. FDA's final guidance recommends that a PCCP describe the planned modifications, the methodology to develop, validate and implement them and an assessment of their impact, so FDA can review them as part of the submission (89 FR 96259, page opened October 6, 2026). Device makers need their regulatory counsel and engineers for this work.
What documents does an AI governance program include?
IHS drafts a governance charter and committee structure, an AI inventory with a protocol to find unapproved tools, intervention risk management records, bias and health equity audit records, a review of AI vendor business associate agreements for your counsel to approve and a state AI law table. For certified health IT developers, IHS also organizes transparency documentation for predictive decision support interventions. Your clinicians, data scientists and counsel supply the technical and legal content.
How much does healthcare AI governance consulting cost?
The cost has three parts: IHS's consulting fee, your internal time from compliance, clinical, legal and IT staff, and any fees charged by outside assessors or testers, which those bodies set. FDA publishes its annual device user fees on its MDUFA fees page (page opened October 6, 2026), and those are fees for device applications and establishments, not for governance consulting. IHS sets a fixed fee for each engagement after a free discovery session, because scope, number of sites and gap severity change the work.
Who is this not for?
An organization that wants IHS to write an FDA submission, give legal advice on a state or EU AI law or run a certified algorithm audit is not a fit. Those need your regulatory counsel, your engineers or a qualified auditor. IHS drafts governance documents for your leaders and counsel to review and approve.
Related resources
- AI governance service overview: what IHS drafts, the engagement phases and who it serves.
- Healthcare AI regulatory tracker: the federal and state sources IHS opened, with dates.
- AI governance framework comparison: NIST AI RMF, ISO 42001, HAIGS and HITRUST.
- HITRUST security compliance foundations: policies, governance and evidence for a HITRUST effort, with assessments performed by a HITRUST-licensed firm.
Ready to build your AI governance program?
A free discovery session covers where your organization stands against the sources above and what it would take to close the gaps. IHS drafts, and your organization's named contact submits to any agency.
Schedule a Free Discovery Session