A care team may want AI to help with notes, forms, or billing. Those goals make sense. Less busywork can leave more room for people. But a tool needs more than a good demo. Staff need to know what they may use, what data may go in, and who checks the result.
Governance means the rules and roles used to make decisions. Good governance gives staff a clear path from an idea to an approved use. It also gives them a way to stop when something goes wrong. The goal is useful support for care, with work that people can manage.
This article shows leaders how to put the Behavioral Health Responsible AI Framework into practice. It uses the same five domains, or review areas. It does not create a second framework. It is an evolving planning guide, not a validated test or certification. The work steps and timing below are proposals. Adapt them to your setting and the rules that apply.
Start with a task, not a tool
Ask staff where work gets stuck. Choose a problem you can describe and measure. “Our team spends too long fixing visit notes” gives you a place to start. “We should buy AI” does not tell you what needs to improve.
Name the exact task. Drafting a public staff agenda is office work. Drafting a client note supports care and may affect billing. Suggesting treatment has a more direct effect on care. Each use needs its own review. Approval to draft an agenda does not approve the same tool to write client notes.
Private data can appear in office tasks too. A billing file or appointment list may contain health data. Review what the tool will receive and do, rather than judging only by the task name.
Give each use an owner
Choose a person to lead the review and keep the use record current. This use owner tracks open questions, test results, and review dates. They do not need to answer every question alone.
Bring in people who know the work. For a note tool, include a clinician, a staff user, and the people who handle privacy and security. Add billing staff when the use may affect claims. A client adviser may help the team understand how the new process feels during care. Ask for views without sharing private client details.
Name who can approve, limit, pause, or end the use. Name a backup too. In a small practice, one person may hold several roles. Write down those roles and seek outside help when a needed skill is missing. An owner cannot fill a gap in legal or security knowledge simply by signing a form.
Clear roles, training, and leadership responsibility are part of NIST's voluntary AI guidance. The roles described here are a proposed way to apply that guidance in a care team. NIST AI RMF Core, GOVERN 2 and 3.
Review the same five areas every time
Keep the master framework as the shared source. Use these five areas in your approval record, staff training, and review meetings.
Clinical Appropriateness: fit the tool to the care task. State its allowed role and limits. Review evidence for the service and people involved. A seller's demo is a seller claim, not proof of better therapy outcomes. A trained person must be able to judge whether the output fits the task.
Privacy & Security: know and control the data path. Review inputs, storage, access, logs, and deletion terms. Check needed agreements and permissions before using live data. Use the existing AI data-handling worksheet. Describe data types in it; do not add real client details.
Reliability & Safety: test how the tool works and fails. Start with made-up cases. Include missing facts, unclear wording, and uses outside the allowed scope. Set pass and pause rules before seeing results. Keep a way to finish the work when the tool is unavailable.
Human Oversight: give qualified people time and power to review. They need the source facts and a way to edit, reject, or stop the result. Checking care judgments calls for clinical skill. Checking a billing draft calls for the right billing knowledge. Review is part of the workload and cost.
Governance & Accountability: keep ownership and decisions clear. Record the approved task, users, data, limits, and review date. Track changes and problems. Name who handles each issue and how the team leaves the service if needed.
Do not average these areas into one score. A useful draft cannot cancel a missing privacy approval. Fast output cannot make up for a lack of qualified review.
Keep laws, guidance, and team rules distinct
A law sets duties for the people and situations it covers. Professional guidance explains standards or recommended practice. A team policy sets local rules. Your approval record should show which kind of rule supports each decision.
For a HIPAA-covered entity, a cloud service that handles electronic protected health information on its behalf is generally a business associate. A suitable business associate agreement and the other applicable HIPAA duties are needed. HHS also explains the need for risk analysis and risk management. A signed agreement alone does not settle every proposed use. HHS cloud guidance.
Some substance use disorder records have added federal protections under 42 CFR Part 2. That rule does not cover every record that mentions substance use. HHS lists February 16, 2026 as the compliance date for the 2024 final rule. Have the privacy team review whether Part 2 applies. HHS Part 2 guidance.
Also check state law, record rules, consent needs, and contract terms with the right advisers. This article cannot decide those facts for your organization. A proposed monthly AI review meeting, for example, is a local planning choice. It is not a universal legal duty.
Make the decision easy to find
Use the master framework's four decision states for each task:
- Hold: a key fact, approval, or control is missing. Do not start live use. Name the gap, its owner, and the next step.
- Pilot with limits: a small trial is approved. Write down its scope, review plan, and stop rules.
- Approved with conditions: the trial supports this use and its controls are in place. List the allowed users, data, tasks, limits, and next review date.
- Paused or ended: the use has a problem or no longer meets its conditions. Use the fallback process and record the response.
Keep one short decision record. Include the work need; tool and version; allowed task and data; findings from all five areas; open gaps; decision and approver; review date; and response plan. Link to evidence held in approved systems. Do not copy private client records into a shared AI planning file.
Staff should have a simple place to check what is allowed. A short list with the task, tool, limits, and help contact is often more useful than a long policy they cannot find.
A made-up case: a note tool with a billing feature
A community care team wants less after-hours note work. It chooses a tool to draft visit notes. During setup, staff notice that the tool can also suggest billing codes.
The use owner separates the two tasks. The note pilot will test draft quality and total note time. Code suggestions will stay off while billing staff review that use. A shared product name does not make them one approved task.
The team first tests made-up visits. One draft adds a symptom that was not in the source. The team records the error, checks whether reviewers catch it, and asks how the problem will be handled. It does not treat a polished note as proof of accuracy.
Privacy and security staff review the data path and agreements before a live pilot. Clinicians practice reviewing against source facts. The owner sets a limited trial with named users, a review date, and stop rules. Staff also keep their usual note process ready.
At the review, leaders check total time, including edits and review. They ask whether clinicians can stay present with clients. If fixes take too long or serious errors continue, the team narrows or pauses the use. If the trial meets its conditions, the team may approve that task in stages. This example shows a process; it does not prove that a tool saves time or improves care.
Write rules that help staff finish their work
A useful policy tells staff what they can do next. Include approved tasks and tools, allowed data, required review, and the person to contact. Explain how to request a new use. State what to do if a feature appears in software already in use.
Make it easy to report an unapproved use or an error early. Staff may turn to a tool because a task is hard to finish. Ask what problem they were trying to solve. Then provide an approved route, training, or a better work process. Read What Leaders Should Know About Shadow AI for a fuller example.
Training should use the actual workflow. Have staff spot a draft that changes meaning, reject it, and report the issue. Make sure they know how to keep working without the tool. A policy read-through alone may not show that they can do these steps.
Track results and respond to changes
Choose measures that match the goal. For notes, count total work time and errors that change meaning. For billing, check correct claims, rework, and denials with billing staff. For office tasks, track time and effort. Include fees, setup, training, review, and support when looking at costs.
Ask staff and clients about the experience where it fits. Less typing may help, but it does not by itself prove better care. Set a baseline before the pilot so the team can compare the full process fairly. Keep limits in mind: a small trial may not reflect all clients, languages, or busy days.
Review sooner after a serious error, a new data use, a major tool change, or a missing reviewer. A proposed response is to stop the affected task, protect records, alert the right leads, and use the fallback. Privacy and legal staff should assess any required notices or other duties. Keep facts about the issue and its resolution in approved systems.
NIST's voluntary guidance supports ongoing review, inventories of AI systems, and plans to end use. It does not set the local schedule or thresholds proposed here. NIST AI RMF Core, GOVERN 1.
Build the process in small steps
In the first week, name the decision leads and list known AI uses. Invite staff to describe needs and tools already in use. In the next two weeks, choose one useful task and complete its five-area review. Use the 25-question purchasing checklist if a purchase is involved.
Then test, train, and resolve gaps before seeking pilot approval. These are suggested planning periods, not deadlines. A high-impact task or unclear data path may need more time. Keep a task on Hold until the needed facts and controls are in place.
Good governance should make responsible use easier to understand. Staff know the limits. Leaders can explain the decision. Clients have a way to raise concerns. The same five areas stay in use as the tool and work change. That gives a care team a practical path toward less burden and more room for human care.
Govern the feature, account, and data path
The product name alone is not a complete inventory. Record the model or feature where known, the approved account, connected services, and allowed data. An API may send a request to another provider. RAG may search a document collection. Each change needs an owner and a review suited to its effect.
Separate explanation from accountability. A generated reason is not an audit record. Keep approved settings, source versions where useful, human review steps, and reported errors. Use the existing five-domain framework to decide whether a changed use stays approved.
AI-literacy additions reviewed October 11, 2026. See AI Terms for Care Teams for the related terms and examples.
References and limits
- Behavioral Health Responsible AI Framework, version 1.0: the master guide for this companion article. Both use the same five domains and four decision states.
- NIST AI Risk Management Framework, released in 2023, and AI RMF Core: voluntary guidance. NIST reports that version 1.0 is being revised. Cody's five domains are his organizing approach, not NIST's named functions.
- HHS HIPAA cloud guidance: explains duties for covered entities and business associates using cloud services.
- HHS Part 2 guidance: explains protections for covered substance use disorder records and the 2024 rule's compliance date.
Sources checked October 5, 2026. The case, work steps, and timing are proposed examples. This guide does not establish a tool's safety, legal compliance, savings, or care outcomes. Keep the review record current and obtain setting-specific advice when needed.