Current AI Usage in Healthcare

Just like many other industries, the healthcare industry has increasingly found uses for artificial intelligence (AI), which is now built into daily clinical workflows and administrative practices and has been increasingly embraced by many clinicians. Many clinicians use AI to review medical images, draft clinical notes, and support their clinical decisions, whereas back-office teams rely on AI for summarizing files, drafting documents, and managing correspondence.

Healthcare organizations and their vendors must now focus on deploying AI responsibly and lawfully. Our overview covers the leading AI usages in healthcare right now, along with related legal and compliance hurdles.

The most mature applications for healthcare AI pertain to medical imaging and diagnostics. The FDA's public database now features well over 1,000 AI-enabled medical devices cleared for marketing in the U.S., with that number rising quickly and especially concentrated in radiology. Current tools flag possible strokes on head CT scans, screen for diabetic eye disease using retinal photographs, and detect arrhythmias in EKG traces. Some advanced EKG models can accurately identify atrial fibrillation or left ventricular dysfunction.

Most of these authorized devices rely on standard predictive models rather than the generative AI that has been dominating media headlines as of late. This distinction matters for legal purposes. A tool that provides a diagnostic classification is making a clinical claim, which means it requires FDA clearance or approval. Medical imaging, heart rhythm analysis, and skin cancer detection have advanced furthest because the underlying data is quantitative and the regulatory pathways for approval are relatively clear.

Clinical decision support (CDS) is not a new area and is one of the fastest-evolving AI sectors. On January 6, 2026, the FDA provided updated guidance easing key restrictions on certain CDS tools. Such tools include computer-generated alerts and reminders for providers and patients, clinical guidelines, order sets tied to specific conditions, and targeted patient data reports and summaries. The FDA said it will hold off on enforcement for tools that give a single, sensible clinical recommendation, as long as the doctor can independently review the reasoning, data sources, and guidelines behind it. Industry watchers call this a "glass box" standard instead of a "black box" one: the tool must show its work in exchange for lighter regulation.

This is not a free-for-all or a move towards complete deregulation. In fact, the FDA still keeps a close eye on models that hide their reasoning, tools used for time-sensitive decisions, and software that tries to substitute for a doctor's judgment. The overall landscape has shifted, as generative AI tools can now handle supporting tasks (e.g., checking clinical guidelines against a specific patient's data) that would once have required full device clearance.

Organizations rolling out these tools should not treat enforcement discretion as an excuse for non-compliance. The policy depends on transparency and active clinician oversight, providing no protection against malpractice claims if an AI error causes patient harm.

While diagnostics is the most mature clinical use, ambient clinical documentation is the most visible. Ambient AI "scribes" listen in on patient visits and automatically draft clinical notes, sparing physicians hours of charting. The American Medical Association’s reporting on The Permanente Medical Group's rollout describes an analysis covering 7,260 physicians across more than 2.5 million patient encounters in a single year, with an estimated 15,791 hours of documentation time saved relative to non-users. Furthermore, 84% of physicians said the tool improved their communication with patients and 82% reported better work satisfaction.

Beyond notetaking, natural language processing extracts structured data from unstructured clinical notes, while "agentic AI" manages admin tasks from start to finish, including prior authorizations, billing, and patient correspondence. Gartner's 2026 forecast notes that agentic AI can sharply reduce administrative costs while maintaining compliance, so long as it is deployed carefully. Payers are moving in the same direction: on January 1, 2026, CMS launched the Wasteful and Inappropriate Service Reduction (WISeR) Model, a six-year pilot testing AI and machine-learning tools for prior authorization and pre-payment review of select traditional Medicare services in six states, including Texas. Providers on the other side of these tools should track how the model's determinations are made and preserve documentation to support appeals.

However, compliance landmines abound. For example, an ambient scribe creates far more protected health information (PHI), as defined under HIPAA, beyond just the final note saved to a chart. A single appointment can generate a live audio stream, intermediate transcript, AI-generated draft, and background metadata. Each piece counts as electronic PHI that the healthcare organization is legally required to safeguard, including copies stored on vendor servers.

Several obligations follow naturally:

• Any vendor handling this PHI is legally a business associate under HIPAA and must sign a Business Associate Agreement (BAA) before processing a single visit.
• The Privacy Rule's minimum-necessary standard applies. A tool recording an entire visit, including casual small talk, might capture way more data than necessary.
• Because recording clinical conversations can trigger state wiretap and all-party consent laws (e.g., the California Invasion of Privacy Act, Florida Security of Communications Act, Illinois Eavesdropping Statute, Pennsylvania Wiretapping and Electronic Surveillance Control Act), it is best to spell out ambient documentation use in a Notice of Privacy Practices, provide patients a means for opting out, and include strong data retention terms in the BAA.

AI also speaks directly to patients via automated triage and intake chatbots, alongside wearable tech tracking continuous vital signs. The FDA has leaned into an expanded "general wellness" framework for non-invasive consumer wearables. Devices reporting stats like heart rate or blood oxygen can bypass device regulations as long as they are marketed strictly for wellness and avoid explicit diagnostic or treatment-related claims.

Ultimately, any patient-facing tool’s ability to withstand regulatory scrutiny hinges entirely on its marketing. If promotional copy drifts from general "wellness" into "diagnosis," it crosses the line straight into medical device regulation, a risk worth reviewing with legal counsel before going live.

Across all these use cases, technology adoption has outpaced internal governance. For example, recent survey data from Wolters Kluwer Health found that roughly 40% of healthcare workers were aware of colleagues using unapproved generative AI tools, and about 17% admitted to using such tools themselves, often because their organizations had not approved tools with the functionality they needed.

This so-called "shadow AI," whereby employees plug patient data into unauthorized tools without a BAA or data-flow tracking, creates serious exposure. Guidance from organizations like The Joint Commission and the Coalition for Health AI highlights how AI can genuinely improve care but presents risks like algorithmic bias, low transparency, and dangerous overreliance if teams don't validate how a tool performs on their specific patient population. AI models trained on skewed data can quietly entrench existing healthcare biases and disparities.

If your organization is adopting AI, a few core governance rules apply:

• Keep an active inventory of every AI tool currently running in your system, including the shadow tools employees introduced on their own.
• Require a signed BAA from any vendor touching PHI, and read the fine print on data retention and model training clauses.
• Validate tools locally against your own patient population instead of relying solely on vendor marketing metrics.
• Keep a human in the loop. AI notes and recommendations make mistakes or hallucinate details, meaning human review is both a clinical necessity and a legal safety net.
• Align patient disclosures (e.g., your Notice of Privacy Practices) with what your AI tools are actually doing behind the scenes.

AI's footprint in the healthcare industry will continue to expand. Successful organizations will pair their enthusiasm for AI with their attention to privacy, regulatory boundaries, and liability.

Disclaimer: This industry insight is for general information only, is not legal advice, and does not create an attorney-client relationship.