Your healthcare organization is implementing AI for clinical decision support or administrative workflows. You've evaluated vendors, reviewed use cases, and secured budget. But before you deploy, you need to answer one question: can you prove where every piece of protected health information goes when it enters your AI system?
If you can't diagram that data flow in detail, you're not ready to deploy. This checklist walks you through the data governance foundations that make AI implementations defensible under the Health Insurance Portability and Accountability Act and other regulations.
Prerequisites
Before you start this checklist, confirm you have:
- Executive sponsorship for data governance work. This isn't an IT project. You need authority to map data flows across clinical, administrative, and vendor systems.
- Access to system architecture documentation. You'll need to trace data from ingestion through processing, storage, and deletion.
- A cross-functional team. Include your legal counsel, IT security, clinical informatics, and vendor management representatives.
- Clarity on your AI use case. General "we're exploring AI" initiatives can't be governed. Define whether you're deploying clinical decision support, administrative automation, or predictive analytics before you begin.
Data Governance Checklist
1. Document Every Data Source Feeding Your AI System
What to do: Create an inventory listing each system, database, or data stream that provides input to your AI application. Include electronic health records, claims systems, lab interfaces, imaging archives, and any third-party data sources.
Requirement reference: HIPAA Security Rule § 164.308(a)(1)(ii)(A) requires a risk analysis that identifies where electronic protected health information is created, received, maintained, or transmitted.
Good looks like: A spreadsheet or diagram showing 15 specific source systems, the data elements each provides (demographics, diagnoses, medications, lab results), and the legal basis for each data flow (treatment, payment, healthcare operations, or patient authorization).
2. Map Data Flows Through Processing and Storage
What to do: For each data source, document how data moves into your AI system, what transformations occur, where it's stored (on-premises, cloud, vendor infrastructure), and who has access at each stage.
Requirement reference: Understanding data flows is foundational to meeting HIPAA's administrative safeguards and determining whether a use qualifies as permissible under the HIPAA Privacy Rule.
Good looks like: A visual diagram showing data ingestion points, processing steps (anonymization, aggregation, model training, inference), storage locations with encryption status, and access controls at each stage. You can trace a single patient record from source system to AI output.
3. Classify Data by Sensitivity and Regulatory Status
What to do: Tag each data element as protected health information, de-identified data, or anonymized data. Document which elements include direct identifiers (names, medical record numbers) versus indirect identifiers that could enable re-identification.
Requirement reference: HIPAA Privacy Rule § 164.514 defines de-identification standards. Misclassifying data as de-identified when it isn't can trigger breach notification obligations.
Good looks like: A data dictionary showing that your AI training set includes 47 data elements, 12 of which are direct identifiers removed before processing, 8 of which are dates generalized to month and year, and 27 of which are clinical values with no direct link to individuals.
4. Verify Permissible Use for Each AI Application
What to do: For every AI use case, document whether it qualifies as treatment, payment, healthcare operations, research with authorization, or another HIPAA-permitted purpose. If protected health information is used outside these categories, that use may constitute a reportable breach.
Requirement reference: HIPAA Privacy Rule § 164.506 defines permissible uses and disclosures. Using protected health information for non-permitted purposes without authorization triggers breach notification requirements.
Good looks like: A table listing your three AI applications (clinical decision support for sepsis prediction, administrative prior authorization automation, operational bed capacity forecasting) with the HIPAA permissible use category for each and the specific Privacy Rule section supporting that classification.
5. Document Vendor Access and Business Associate Agreements
What to do: List every vendor, cloud provider, or AI platform provider that processes, stores, or accesses your data. Confirm you have executed business associate agreements with each entity that handles protected health information.
Requirement reference: HIPAA Security Rule § 164.308(b) requires covered entities to obtain satisfactory assurances that business associates will safeguard protected health information.
Good looks like: A vendor register showing your AI platform provider, cloud infrastructure host, and model training consultant, with signed business associate agreement dates, annual security assessment completion dates, and breach notification procedures documented for each.
6. Establish Access Controls and Audit Logging
What to do: Define who can access AI systems, training data, and model outputs. Implement Role-Based Access Control and the Principle of Least Privilege. Enable comprehensive audit logging for all data access.
Requirement reference: HIPAA Security Rule § 164.312(a)(1) requires access controls, and § 164.312(b) requires audit controls to record and examine system activity.
Good looks like: An access control matrix showing that only three data scientists can access raw training data, clinical users see only de-identified model outputs, and your audit log captures every query with user ID, timestamp, and data elements accessed. You can produce a complete access report for any patient record within 24 hours.
7. Define and Test Your Breach Response Procedure
What to do: Document how you'll detect if protected health information is used impermissibly (for example, accessed by unauthorized users, used for non-permitted purposes, or disclosed without authorization). Define your breach assessment and notification process.
Requirement reference: HITECH Act breach notification requirements mandate notification within 60 days of discovering a breach affecting 500 or more individuals.
Good looks like: A written procedure specifying that your Computer Security Incident Response Team will assess any AI-related data incident within 24 hours, legal counsel will complete breach determination within 72 hours, and you have template notifications ready for patients, the Department of Health and Human Services, and media if required.
Common Mistakes
Assuming de-identification is automatic. Removing names and medical record numbers doesn't create de-identified data. You must meet HIPAA's Safe Harbor or Expert Determination standards, which require removing or generalizing 18 types of identifiers.
Treating AI governance as an IT-only project. Data flow inventories require input from clinical staff who understand how data is used, legal counsel who can assess permissible use, and compliance officers who manage business associate relationships.
Skipping the data flow diagram. You can't secure data you can't trace. If you don't know which vendor systems touch your training data or where model outputs are stored, you can't assess breach risk or respond to Data Subject Access Requests.
Confusing "healthcare operations" with any operational use. HIPAA defines healthcare operations narrowly (quality assessment, training, accreditation). Using protected health information for general business analytics or marketing doesn't qualify, even if it feels operational.
Next Steps
Complete this checklist before you deploy any AI system processing protected health information. Schedule quarterly reviews to update your data flow inventory as you add data sources, change vendors, or expand AI use cases.
If you discover gaps (for example, vendor access without business associate agreements, or AI applications using protected health information for non-permitted purposes), halt deployment and remediate before proceeding. The cost of a breach notification and regulatory investigation will exceed any timeline pressure you're facing.
Your data governance framework isn't a compliance checkbox. It's the foundation that lets you deploy AI confidently, knowing you can answer regulators' questions about where data goes and why that use is permitted.
