AI Governance in Healthcare: What Compliance Leaders Should Know

AI Governance in Healthcare: The Compliance Leader's Role blog header

Many compliance leaders struggle with the question of what their role in AI governance is. Lisa Estrada, JD, believes an organization’s compliance officer shouldn’t agree to be the sole organizational owner of AI governance. Rather, they should be making sure the right people are governing it together.  

In this blog, she explains what healthcare compliance leaders should know to effectively help their organizations build and operate robust AI governance frameworks.  

QUICK TAKE

Compliance should help coordinate AI governance, not serve as its sole owner. Start by identifying where AI is being used, establishing clear accountability across departments, and applying risk assessment and ongoing monitoring.

Compliance Programs and AI Governance: What’s Similar? 

Compliance programs have always been about paying attention to what can go off the rails before it does. 

AI governance is the same. Organizations need to be thinking in a systematic way about: 

  • Where could this go wrong? 
  • Who would get hurt? 
  • How would we know? 
  • What do we do about it? 

Assurance Is a Common Requirement  

“An assurance framework gives boards and management teams confidence grounded in evidence that controls exist and work as intended,” Estrada explained. “It’s not a policy. It’s the ongoing cycle of identifying the risk, assigning an owner, testing the control, reporting the results to leadership, and fixing what you find.” 

That model, which typically includes risk assessments and monitoring plans, is very familiar to compliance officers. It’s exactly how most compliance programs are structured. And, according to Estrada, the same model can be applied to AI governance. 

Two Tools for AI Governance Assurance

Risk Assessment

A structured way to identify what could go wrong, who could be affected, and where safeguards or oversight are needed. It helps leaders prioritize the most significant risks and decide where to focus attention.

Monitoring Plan

Describes how the organization will continue to watch areas of greatest risk over time. It identifies what will be reviewed, who’s responsible, how often monitoring will occur, and how concerns will be reported and addressed.

“Compliance officers know how to build and maintain assurance frameworks; they know how to conduct risk assessments and develop monitoring plans,” Estrada said. “This makes them an obvious choice when boards and organizational leaders ask for assurances around how AI is being used.” 

How Are Compliance Programs and AI Governance Different? 

Estrada noted important distinctions between the risks managed by typical compliance programs and those presented by AI: 

Speed and scale of change. AI can change things quickly, and its risks can scale across an organization just as rapidly. Something that used to take months to spread can now hit every claim overnight. As a result, an annual risk assessment, the common standard for compliance programs, is probably inadequate in the world of AI. 

Probabilistic, not deterministic. Healthcare compliance programs are rule- or standards-based. The same facts get the same answer, so a point-in-time audit tells you something lasting. By contrast, AI is probabilistic. Passing a test once doesn’t mean it will pass the next time. For confident governance, AI monitoring must be continuous, not point-in-time. 

Opacity: Compliance programs run on root cause analysis. When we find a problem, we don’t just fix it. We dig in to figure out why it happened. With AI, we often can’t get there alone. We can see the output was wrong, but was it the data, the model, a vendor update, or how someone used it? Compliance can’t answer that. Neither can data science on its own. It may take the data people, the clinicians, the vendor, and the people using the tool every day to find answers. That’s why AI governance must be multidisciplinary. It’s how you get to root cause. 

Who Should Own AI Governance in Healthcare? 

“In traditional compliance programs, there’s usually a single clearly designated owner: the compliance officer sets the framework, oversees the work and escalates problems.” said Estrada. 

“AI governance in healthcare is different. Accountability can be named, but the expertise and control have to be distributed. The business leader deploying the AI-driven tool should be accountable for its use and outcomes, with a named executive who can pause or stop it.”  

But… 

  • Clinicians must define what “safe and effective” looks like. 
  • Data and technology teams must evaluate performance. 
  • Privacy, security, legal and compliance must test risks and controls. 
  • AI tool users must report what’s happening in practice. 

“Multidisciplinary governance doesn’t mean diffused governance. The model is shared expertise, clear accountability and explicit authority to make a decision and stop the AI if necessary.” – Lisa Estrada

Next Steps for Compliance Leaders 

Estrada shared three important tactics to help compliance leaders get their arms around AI governance in healthcare. 

1. Learn the language. 

“Seek out AI educational opportunities,” Estrada says. “AI has its own vocabulary and concepts, and if you don’t know them, you can’t be effective in the conversation.” 

Estrada recently earned the Artificial Intelligence Governance Professional (AIGP) certification available through the International Association of Privacy Professionals (IAPP). It’s a resource that compliance leaders can invest in to build necessary AI governance and strategy skills. 

The training focuses on: 

  • Foundations of artificial intelligence governance 
  • How laws, standards, and frameworks apply to AI (such as EU AI Act) 
  • How to govern AI development 
  • How to govern AI deployment 

About a third of the exam involves scenario-based questions tied to applied judgment in real-world case studies. 

2. Take Action. Drive Action. Lead Action. 

Compliance doesn’t have to own AI governance. But it does have to make sure the right people are governing it together. Depending on the organization, that might include 

  • Operations 
  • Clinical (in healthcare) 
  • Information Technology and Security 
  • Legal and Regulatory 
  • Operations 
  • Risk Management 
  • Internal Audit 

“Act as a convener,” Estrada says. “Don’t wait to be asked and don’t try to own it alone.” 

3. Start with an AI inventory 

“You can’t assess or monitor risks you can’t see,” she explained. 

Take inventory of: 

  • Where AI is already being used 
  • For what purpose 
  • By whom 
  • With what data 
  • Through which vendors 

“Then get the right people in the room and bring the assurance framework, because that’s what compliance officers know better than anyone.” 

Compliance Must Deal with AI Boom 

AI governance is no longer an issue compliance leaders can watch from the sidelines. The question is how quickly and how effectively they will engage. These practical steps can help leaders prepare their teams, bring the right functions together, and give their organizations confidence in how AI is being used and governed. 

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.  

About the Author 

Lisa Estrada, JD, AIGP, is co-founder of Reframe Compliance, which helps growth-stage healthcare companies build right-sized compliance and risk management programs and systems. A former Chief Compliance Officer at Fresenius Medical Care North America and LifePoint Health, she has more than 25 years of experience in healthcare regulatory compliance and enforcement.   

Ready for More? 

Here’s another resource to guide good AI governance strategies for your healthcare organization: “Compliance Leader’s Guide to Getting Started with AI.” Cut through the hype and confidently implement AI with proven strategies. This clear, tactical guide will help you save time, reduce risk, and future-proof your compliance processes. 

Download to learn: 

  • Five Practical Ways to Use AI in Compliance Work 
  • Six Critical Considerations When Adopting AI for Healthcare Compliance 
  • Five Things to Know to Leverage AI for Process Improvement 

Building a Common Compliance Language in the Age of AI

jerry shafran compliance language in age of ai banner

This thought leadership update explains why it’s more important than ever to communicate in a common language. The piece brings compliance executives up to speed on the role of language and communication in today’s compliance programs. Fresh insights and tips capture the current views of the original author, Jerry Shafran, a compliance industry veteran and seasoned, effective communicator.  

Continue reading

How to Use AI for Systems Thinking in Compliance Processes 

How-to-Use-AI-for-Systems-Thinking-in-Compliance-Processes blog header

Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. Compared with other business functions, compliance has been slower to embrace AI, especially in healthcare, where concerns about risk, regulation, and potential bleed-over into clinical decision-making have made organizations particularly cautious. 

Yet the opportunity is substantial, especially when it comes to systems thinking. 

Why Systems Thinking Matters in Compliance 

Effective compliance programs depend on systems thinking. Rather than viewing each request for guidance, investigation, or remediation as an isolated issue, savvy compliance teams look at how individual problems fit into larger patterns. 

One of the challenges in any business function is the tension between individual heroics and well-designed systems, and, ultimately, systems win every time. Many compliance officers have been conditioned to act like lifeguards, diving in to save departments from themselves. But this reactive approach consumes time and limits impact. You stay busy, but the organization doesn’t necessarily become more compliant. 

AI compliance processes and systems in healthcare

Shifting away from heroic interventions requires time, strategic thinking and structural planning, resources that compliance professionals rarely have in abundance. This is where AI becomes a powerful ally. 

How AI Helps Compliance Move from Reactive to Proactive 

The key to building proactive compliance is carving out the mental space to think more broadly about operational processes. AI doesn’t replace human expertise, but it can significantly accelerate the work. 

AI tools can analyze the countless issues compliance teams handle daily and help generate system-level recommendations. Think of AI as a partner that gets you to the 50- or 60-yard line, far enough to give you a strong foundation, but still requiring human judgment to complete the plan. 

Using AI to Organize Compliance Processes 

The first step is identifying patterns: 

  • What repeatedly goes wrong? 
  • What are the recurring themes? 
  • Where are the inefficiencies or high-risk points? 

Once you see the trends, you can begin imagining the systems that will address them. AI excels at helping structure these ideas. 

A practical way to start is by giving your AI assistant raw input: 

  • Here’s what is happening. 
  • Here’s the environment. 
  • Here are the recurring issues. 

Then you can prompt the AI with something like: 

 “I want to build a system to help identify and minimize these risks within a complicated environment. What elements should be included, and what considerations fall under each element?” 

The output becomes a foundation, a map of decision points and organizational steps you can refine. 

Supercharging Systems Thinking 

Compliance work is complex, and many officers get stuck not because they lack insight but because they lack time. AI helps break the gridlock by organizing information, highlighting key considerations, and suggesting frameworks. 

The AI provides structure; the compliance professional brings subject-matter expertise. In this collaborative process, the AI’s suggestions spark additional ideas and help you think more holistically. The result is a level of systems thinking that becomes far more accessible even in hectic environments. 

The Human-AI Partnership 

Despite its power, AI cannot replace an experienced compliance officer. It draws from online information and from what you feed it, but it cannot grasp organizational nuance, personalities, or culture. 

For example, an AI may outline a solid system, but only the compliance officer understands how a skeptical executive will respond. That’s where the human element comes in. You can ask the AI to help tailor communications or anticipate objections, but the strategic decision-making remains yours. 

Staying Focused with AI Frameworks 

One of the hidden challenges of compliance work is staying focused long enough to complete long-term system projects. Urgent tasks constantly pull attention away, and partially built frameworks can easily get lost for months. 

AI-created structures help maintain focus. They provide guardrails, the methodological anchors that keep the conversation and planning on track. Most of the framework can often be developed in a single sitting, creating a roadmap you can return to even if you’re pulled into other issues. 

Even with the limitations of some AI tools, especially free versions that cap conversation length, paid versions make it easier to resume discussions, refine ideas, and maintain continuity. 

AI in healthcare compliance processes

A Faster Roadmap to a Roadmap 

Compliance professionals work hard and add value every day, but much of that value is short-term because they lack the time to build the long-term systems that create lasting change. 

AI solves this by offering a “faster roadmap to a roadmap.” It accelerates the groundwork: 

  •  Defining the problem 
  • Outlining the system  
  • Highlighting the risks 
  • Mapping the components 

That clarity frees the compliance officer to focus on the human side of adapting the system to the organization, navigating culture, and communicating effectively with leaders. 

With an AI-driven framework, compliance work becomes more disciplined, efficient, and proactive. Systems thinking becomes not only achievable, but sustainable. AI doesn’t replace the expertise of compliance professionals—it elevates it. 

Download our Latest Whitepaper
Sign-up for our Weekly Newsletter
Schedule a quick overview
27 Ungated Resources for Compliance Leaders and Teams 
Resources for healthcare compliance professionals

Compliance professionals sometimes feel undervalued in comparison to other functions in their organization. They think leaders and colleagues don’t really understand what they do.  

These resources will help. Packed with ideas, tips and recommendations, these pieces were written by professionals with many years of compliance experience. 

You can quickly skim for articles that relate to your needs and interests. Bookmark this page as a reference for future questions or projects.

Visit Now