Healthcare AI Governance
Shadow AI Risk in a Health System: Finding Unapproved AI and Governing What Replaces It
Clinicians, coders, and administrators are already using AI tools that compliance never reviewed. Kriv AI helps health systems find that use, decide what is permitted, and give staff a governed alternative.
Shadow AI in a health system is staff using AI tools that compliance, security, and IT never reviewed, often with patient information pasted in. Governance starts with finding what is in use, deciding what is permitted, and putting a risk analysis and business associate assurances behind every approved tool. Kriv AI helps, starting at $200 per hour.
context
What Shadow AI Looks Like Inside a Health System
Shadow AI is any AI tool used for work that the organization has not reviewed or approved. In a health system it rarely looks like a rogue project. It looks like a nurse manager summarizing a note, a coder drafting an appeal letter, or an analyst pasting a spreadsheet into a free chatbot to save an hour.
Why health systems are exposed
Health systems hold some of the most sensitive data an organization can hold, and staff are under constant time pressure. A tool that drafts a prior authorization letter or condenses a long chart is attractive precisely because the work is repetitive and the volume is high. When no approved option exists, people use what they can find.
The risk is not only the tool itself. It is that nobody can say which tools are in use, what data went into them, or whether any agreement covers that data. A policy that simply says "do not use unapproved AI" does not answer those questions and is hard to enforce without visibility.
What the HIPAA Security Rule asks you to be able to show
The HIPAA Security Rule at 45 CFR 164.308 requires a covered entity or business associate to "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." A tool you do not know about cannot be in that assessment.
The same section requires procedures to "regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports." Activity inside an unsanctioned AI service generally does not appear in the records your security team reviews.
ai gap
Where Shadow AI Programs Break Down
The most common failure is a ban with no alternative. Staff keep using the tools, they simply stop talking about it, and the organization loses the little visibility it had. A second failure is treating discovery as a one-time survey. Tools change monthly, and browser extensions, note-taking assistants, and AI features added to software you already license can all introduce new data flows without a purchase order.
A third gap is the vendor agreement. The Security Rule says a covered entity "may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances" that the information will be appropriately safeguarded. If a department adopts a tool that touches patient information on its own, that question was never asked. Whether a given tool and its vendor fall under those provisions is a determination for your privacy officer and counsel.
capabilities
What a Governed Response Includes
Discovery that continues
Combine a short staff survey with network, browser, and software-license evidence to build an inventory of AI tools in use, including AI features inside existing products. Treat the result as a living register with an owner, not a report that is filed and forgotten.
Tiers of use, not a single rule
Sort uses by the data involved and the consequence of an error. Work with no patient information, such as drafting a general policy summary, can have light rules. Work that touches patient information or influences care needs an approved tool, a completed risk analysis, and defined human review.
An approved path that is easier than the workaround
Offer a sanctioned option for the common tasks, with the agreements and controls already in place. People move to the approved tool when it is as fast as the unapproved one. If the approved route takes weeks of paperwork, shadow use continues.
Clear escalation and no-blame reporting
Give staff a simple way to ask whether a tool is allowed and to report a mistake, such as patient information pasted into the wrong tool. Define who triages it, when the privacy officer is involved, and how the finding feeds the risk analysis.
framework
Using the NIST AI RMF as the Structure
NIST describes its AI Risk Management Framework as "intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems." It is not a HIPAA control set and does not replace one.
It is still a useful skeleton for a shadow AI program. Govern: assign who owns AI risk and approves tools. Map: find where AI is actually used and what data it touches. Measure: track how many tools are in use, how many are approved, and what incidents occurred. Manage: act on the findings, retire or approve tools, and update the HIPAA risk analysis. Your compliance counsel decides how this maps to your specific obligations.
differentiation
How This Differs From Our Related Pages
This page is about unapproved AI use by staff inside a health system. Our general shadow AI risk management page covers detection, policy, and agent security across industries. Our page on building a health system AI governance committee covers the oversight body, our HIPAA AI compliance requirements page covers the regulatory text, and our page on hospital AI vendors that fail a HIPAA risk assessment covers vendors you did approve. Use this page when the question is what staff are already doing and how to bring it under governance.
engagement
How an Engagement Works
We start with discovery: interviews with a cross-section of clinical, revenue cycle, and administrative staff, plus the technical evidence your security team can provide. We then propose the use tiers, the approval path, and the register, and help you align them to your risk analysis and vendor review process. Your privacy officer, security officer, and counsel make the compliance determinations; we do not replace them or monitor your staff.
tiers
What You Get at Each Tier
1. Enterprise / regulated organizations
A shadow AI discovery plan, use tiers, an approved-tool intake path, a living register design, and an incident and escalation process aligned to your HIPAA risk analysis.
2. Fractional CTO / AI governance lead
Ongoing ownership of the register and approval path as tools and staff behavior change, working with security, privacy, and clinical informatics leadership.
3. Specialized advisory
A single session or second opinion on a shadow AI policy, a discovery approach, or whether a specific tool should be approved.
rate card
Kriv AI's Rates for This Work
These are Kriv AI's own published rate floors, not an industry average.
| Track | Kriv hourly rate | Typical engagement model | Minimum engagement |
|---|---|---|---|
| Enterprise / regulated (banks, broker-dealers, payment processors) | From $200/hr | Fixed-scope project or retainer | $8,000 |
| Fractional CTO / AI governance lead | $300 to $400/hr | Part-time, ongoing (monthly) | $8,000 |
| Specialized advisory (vendor evaluation, second opinion) | $400 to $700/hr | Hourly, per-session | Varies by engagement |
| Small business | $150/hr | Referred to Kriv AI's partner network | n/a |
get a quote
How to Get a Real Quote
The rates above are floors, not a quote. Actual price depends on the size of the system, how many departments and sites are in scope, what discovery data your security team already has, and how mature your vendor review process is. Book a discovery call and we will scope it honestly.
Straight answers
Frequently asked questions about Shadow AI Risk in a Health System: Finding Unapproved AI and Governing What Replaces It
What is shadow AI in a health system?
It is AI tools used for work that the organization has not reviewed or approved, such as staff pasting notes or spreadsheets into a public chatbot. The concern is unknown data flows, not the tool alone.
Should a health system ban AI tools?
A ban with no approved alternative tends to push use out of sight. A better approach combines clear tiers of permitted use with a fast, sanctioned option for common tasks.
Does the HIPAA Security Rule mention shadow AI?
It does not use that term. It requires a risk analysis of electronic protected health information and satisfactory assurances from business associates, which unreviewed tools can bypass.
Does the NIST AI RMF apply to hospitals?
NIST describes it as voluntary. Many health systems use it as a reference structure for AI governance alongside, not in place of, their HIPAA obligations.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call