Your Practice Already Uses AI. Does It Have an AI Policy?

Ambient scribes draft visit notes. The EHR suggests portal replies. The billing vendor runs coding checks with machine learning. A front-desk employee pastes a long insurance letter into a free chatbot to summarize it. In many physician practices, AI arrived one tool at a time, and nobody wrote down the rules.

The short answer: yes, a practice that uses AI in any form needs a written AI policy, even a short one. It should say which tools are approved, what data may go into them, who reviews AI output, when patients are told, and how vendors are vetted. In Texas, state law now requires patient disclosure for certain AI uses, which makes a policy a practical necessity rather than a nice-to-have. Healthcare organizations looking to adopt secure and scalable technology can explore Softnotions' Healthcare Software Development Services to support their digital healthcare initiatives.

How Widely Are Practices Using AI Today?

Adoption is now mainstream. In an August 2026 MGMA Stat poll, 83% of medical groups reported using AI in patient visits, up from 71% in 2025, and 45% said AI was used in more than a quarter of visits, up from 24%. The AMA's 2026 physician survey (March 12, 2026) found 81% of physicians using AI professionally, most often to summarize research, draft care plans and notes, and document billing codes and visits.

Policy has not kept pace. In a January 2026 MGMA poll on AI governance, only 20% of practices had a formal AI policy or governance structure, 22% were developing one and 56% had neither. MGMA noted that groups without policies most often use AI for documentation, revenue cycle and administrative work.

Why a Practice-Level Policy Matters

Large health systems have AI committees. Most practices do not, and they don't need one. They do need clear answers to a few questions, because the risks are concrete:

Patient data in the wrong tool: Entering protected health information into a consumer chatbot without a business associate agreement can create a HIPAA problem (our article on HIPAA and LLMs in clinical workflows covers the data-flow side).

Unreviewed output: AI-drafted notes, letters and portal replies can contain errors. Someone must be accountable for checking them.

Vendor-embedded AI: Many tools add AI features through routine updates. Without a review step, the practice may not know what changed.

Physician trust: Physicians want a say. The AMA survey found 88% want safety and efficacy validation, 86% want data privacy assurances and 85% want to be consulted on AI adoption decisions.

A policy turns these into routine decisions instead of surprises. Building a structured approach to AI adoption is also an important part of healthcare digital transformation, helping practices modernize operations while maintaining control over their technology infrastructure.

What Texas Practices Need to Know

Two Texas laws in particular affect how physicians use AI. Practices elsewhere should check their own state's rules, which are changing quickly.

Senate Bill 1188 (Effective September 1, 2025)

• Allows licensed practitioners to use AI for diagnostic purposes, including recommendations for diagnosis or treatment based on medical records, within their scope of practice.
• Requires practitioners to disclose AI use to patients and review AI-generated records in accordance with medical record standards.
• Requires covered entities, including medical practices, to ensure that electronic health records (EHRs), including those maintained by vendors, are physically stored in the United States or its territories.
• EHRs created before September 1, 2025, had until January 1, 2026, to meet the location requirement.

House Bill 149 (Texas Responsible Artificial Intelligence Governance Act) (Effective January 1, 2026)

• Requires healthcare providers to provide written disclosure to patients or their personal representatives when a service or treatment involves interaction with an AI system.
• This may include patient-facing AI chatbots and voice assistants.
• Disclosures must be clear, conspicuous, and written in plain language.

• Providers must deliver the disclosure by the date of service or, in an emergency, as soon as reasonably possible.

Sources: the Texas Medical Association on SB 1188 (October 2025) and on HB 149 and SB 1188 (updated February 2026), and TMLT (December 2025). Under SB 1188, TMA reports civil penalties of $5,000 to $250,000 per violation depending on intent, and possible discipline after three or more of the same violation. HB 149 is enforced by the Texas attorney general after a written notice and a 60-day cure period, with possible licensing-board sanctions; Jackson Walker summarizes penalties of up to $12,000 per curable and $200,000 per uncurable violation, with no private right of action.

This is a summary, not legal advice. A Texas practice should confirm with its counsel how these rules apply to each AI tool it uses, especially ambient documentation and patient-facing tools.

What Should a Practice AI Policy Include?

MGMA suggests starting with one umbrella policy that defines AI in your office and governs different categories differently. For most practices, a short version works. A practical outline:

Scope and categories: Separate consumer AI tools (public chatbots), enterprise AI under contract, AI embedded in the EHR or billing systems, predictive tools, and patient-facing AI such as chat or voice agents. Each category gets its own rules.

Approved tools list: Name the tools staff may use and for what. Anything not on the list needs approval.

Data rules: State what may never go into consumer tools (any patient-identifiable information) and what approved tools may receive, consistent with your business associate agreements.

Human review: Define who checks AI output before it is used: for example, the signing physician reviews every AI-drafted note before signing, and a staff member reviews AI-drafted patient messages.

Patient transparency: Decide which uses are disclosed, how and where (intake forms, signage, visit discussion), and how patients can ask questions or opt out. In Texas, align this with SB 1188 and HB 149.

Vendor requirements: Require clarity on data use and retention, security and breach notification, model updates and evidence that the tool performs as claimed.

Ownership and reporting: Name an executive owner (often the practice administrator with a physician lead), and give staff a simple way to report AI errors, similar to reporting a safety event.

Review cycle: Review the policy and the tool list at least annually, and whenever a new AI tool or major feature is introduced.

Illustrative scenario: A 12-physician family medicine group in Dallas adopted an ambient scribe last year and later found two staff members using a free chatbot for appeal letters. Its new two-page policy lists the scribe and the EHR's built-in drafting tool as approved, bans patient data in consumer tools, requires physicians to review every AI-drafted note before signing, and adds written AI disclosure wording, reviewed by its health care counsel, to the intake packet. The practice administrator owns the tool list, and the medical director signs off on new clinical uses.
As AI adoption grows across healthcare, understanding how to implement responsible and secure AI governance solutions can help medical practices establish better oversight of their AI-powered workflows.

How to Put a Policy in Place in 30 Days

Week 1: AI Tool Inventory

• Identify every AI tool and feature currently in use, including AI embedded in vendor systems and informal AI use by staff.
• Owner: Practice administrator with IT.

Week 2: Risk Classification and Compliance Review

• Classify each AI tool by category and risk level.
• Review business associate agreements (BAAs) and data flows to understand how information is accessed, processed, and shared.
• Owner: Compliance or privacy lead.

Week 3: Policy Drafting and Physician Review

• Draft the AI usage policy, patient disclosure wording, and rules for reviewing AI-generated outputs.
• Obtain input from physicians to ensure the policy supports clinical workflows.
• Owner: Administrator and physician lead.

Week 4: Approval, Training, and Implementation

• Obtain leadership approval for the AI policy.
• Conduct a brief staff training session.
• Update patient intake forms and publish the approved AI tool list.
• Owner: Leadership.

After launch, track a few signals: tools added or removed, staff-reported AI errors, and whether the expected time savings appear. MGMA's August poll is a useful caution: in open-ended replies, more leaders described work shifting elsewhere (37% of mentions) than said AI had simply reduced staff workload (19%).

Common Mistakes to Avoid

• Copying a hospital policy: It will be too long to follow. Keep it to what your practice actually uses.
• Banning everything: Staff will use tools anyway. Approving safe options works better than prohibition.
• Forgetting embedded AI: Ask each major vendor which AI features are active in your systems.
• No owner: A policy without a named owner stops being updated.
• Treating disclosure as an afterthought: In Texas especially, decide disclosure wording and placement before the next tool goes live.
  

How Softnotions Can Help

Writing the policy is the easy part; making it work across your systems takes engineering. Softnotions supports practices with:

• AI inventory and data-flow review: finding where AI is already running, including inside vendor tools, and where patient data goes.
• Governance set-up: a right-sized policy, approval workflow and vendor checklist, working with your compliance lead and counsel, through our AI governance for healthcare practice.
• Secure implementation: access controls, logging and integration for approved tools, with our healthcare cybersecurity and compliance team.
• Monitoring: simple ways to track AI use, errors and impact over time.

For larger organizations, our article on why mid-size health systems need their own AI governance model covers committee-level governance.

Most practices did not decide to adopt AI; it arrived through vendors and busy staff. A short, specific policy lets the practice keep the benefits while staying in control of patient data, accuracy and disclosure, and in Texas it supports compliance with new state law.

If you want help taking stock of the AI already running in your practice, book a free consultation with our healthcare engineering team.