How to Extend a Health System AI Operating Model to Employed Physician Groups and Ambulatory Clinics

What carries over and what must adapt

Most of an operating model is a set of decisions about what AI may do with data and who must approve exceptions. Those decisions do not depend on whether the setting is a hospital or a clinic. The policy baseline, the definition of actions that require human approval, the evidence schema and the role definitions for accountability can transfer largely unchanged.

What changes is the environment those decisions run in. Employed physician groups and ambulatory clinics often run different EHR configurations and local tooling, use ambient documentation and clinical assistant tools, and have thin local IT and security staff. PHI is handled across many small locations rather than inside one centrally managed environment. A policy written centrally gets interpreted locally, and interpretation drifts.

The practical consequence is that guidance documents and committee review do not scale to this footprint. A control has to be something the site cannot interpret differently, which means it has to be enforced where the AI interaction happens. Approval paths also need adapting, because a role that exists at a hospital, such as a dedicated security reviewer, may not exist at a small clinic.

Runtime enforcement across distributed clinics

Enforcement placement is the central design choice. A control that reviews activity after the fact depends on someone looking, which is the exact capacity thin clinic staffing lacks. A control in the execution path decides before the interaction completes and records that decision as it happens.

At the interaction and tool-call level, the baseline resolves to a small set of actions. Each applies to a single interaction or a single call from an AI tool to another system, and each is determined by the central policy plus any approved site override.

• Allow: The interaction matches policy and proceeds, with evidence recorded.
• Redact: PHI or other restricted fields are removed before data reaches a model or tool.
• Block: The interaction or tool call violates policy and does not execute.
• Rate limit: Volume from a user, tool or site is capped to contain unexpected behavior.
• Escalate for human approval: The action pauses until a designated approver at the site or centrally decides.

Evidence for HIPAA 164.312(b) audit controls

As of November 2026, 45 CFR 164.312(b) requires hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. The access control standard in the same section speaks of allowing access only to those persons or software programs that have been granted access rights. That wording is relevant when AI tools or agents reach systems holding ePHI. A January 2025 HHS proposal would change the Security Rule, but the current text remains the operative requirement and a proposal should not be treated as binding.

For a multi-site network, the useful question is whether one query can show what AI was allowed to do and what it did, at every site. A practical evidence record per interaction or tool call includes the site, the user role, the tool, the policy version applied, the action taken, any redaction, and the approver and outcome for escalations. Because the enforcement point produces these records itself, evidence does not depend on each clinic's local configuration.

The exact content, retention period and format of this evidence should be settled with compliance and legal counsel. Design the system so retention and export are configurable rather than fixed.

One more scoping point: AI features may arrive through a certified EHR, which falls under the ONC HTI-1 requirements for predictive decision support interventions in certified health IT, or through separate tools. The governance path can differ, so record the source of each AI capability in the site inventory.

A phased rollout

Sequence the work so that evidence exists before scale does. The phases below are a design suggestion and can be compressed where an enterprise baseline is already running.

• 1. Inventory: List AI tools, EHR configurations and PHI data flows per site, including ambient documentation and assistant tools.
• 2. Map controls: Map each AI-involved system to 164.312 controls and note gaps at thinly staffed sites.
• 3. Set the baseline: Define policy, escalation rules, approver roles and the evidence schema centrally.
• 4. Pilot: Enforce at runtime in a few representative sites and test overrides and human approval at realistic staffing.
• 5. Expand and report: Roll out network-wide and report on actions, escalations and overrides across all sites.