Governing AI Costs Embedded in EHR Vendor Contracts

How AI is priced and packaged inside EHR agreements

EHR vendors are adding generative AI and predictive features to existing agreements rather than selling them as separate programmes. The commercial structures usually fall into four types: usage-based fees, per-user add-ons, tiered module licences, and consumption credits. Each has a different driver. Usage-based fees follow volume, such as the number of generated outputs or processed encounters. Per-user add-ons follow headcount, which makes them predictable but easy to expand as more clinicians are enabled. Tiered module licences tie AI features to a higher product tier, so a feature you want can pull in a larger commitment. Consumption credits are prepaid or committed pools that draw down as features are used.

These structures are often combined, and they sit in different documents. The master agreement sets general terms, order forms set quantities and rates, and renewals reset both. The result is that no single reader sees the whole commitment. Finance sees invoices, IT sees which features are configured, compliance sees the business associate agreement, and clinical leaders see workflow changes. Variable charges can grow beyond what was approved at signing without any one group noticing, because the hospital usually learns about usage from the vendor's own reporting.

PHI, business associate scope and algorithm transparency

Cost terms and compliance terms are linked, because a feature that processes PHI changes both the risk and the review needed before it is switched on. Under the HIPAA Security Rule, a covered entity may permit a business associate to create, receive, maintain or transmit ePHI only with satisfactory assurances that it will safeguard the information, documented in a written contract or other arrangement. A business associate must obtain the same assurances from its own subcontractors before they handle ePHI. For each AI feature, the hospital should confirm that the business associate agreement covers it and ask whether subcontractors process ePHI for AI components.

The Privacy Rule adds a limit: a covered entity may not contractually authorise a business associate use or disclosure of PHI that the Rule would prohibit. Contract language on AI data use therefore needs compliance review before signature, not only legal and procurement review.

HHS has noted that when a hospital contracts with a cloud-based EHR vendor, both parties have control over the ePHI in the EHR. That shared control is the reason the hospital needs its own record. Separately, as of October 2026, HTI-1 describes transparency requirements for AI and predictive algorithms in certified health IT, so clinical users can access baseline information about the algorithms they rely on. That information supports clinical assessment of fairness, validity and safety. It is framed around clinical users, so it should not be expected to answer billing or metering questions.

Controls and evidence the hospital holds independently

Contract terms define what is permitted. They do not enforce it, and they do not prove what happened. A hospital that relies only on vendor-reported metrics cannot independently reconcile an invoice, and cannot show an auditor that AI use stayed within approved policy. Two capabilities close that gap: policy enforced at the point where AI activity occurs, and durable evidence of each decision.

This is where runtime policy enforcement fits. Trussed enforces policy in the execution path of AI interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Policy is enforced at runtime, not reviewed after the fact. Each enforcement decision produces audit-ready evidence, mapped to HIPAA, including 164.312(b) audit controls. That gives the CFO a record held by the hospital, in its own cloud under self-managed deployment, with configurable retention and data residency. Trussed runs in production with healthcare organizations.

The scope is specific. Enforcement applies to individual interactions and tool calls that run through the path, so the hospital should decide which AI traffic, including vendor-embedded features, can be routed through it and which must be covered by contract rights alone. Where it applies, the evidence supports the monthly reconciliation step and the HIPAA audit conversation. It does not replace negotiated metering definitions, caps and audit rights. Those remain the foundation, and the independent record is how the hospital tests them.