AI in Healthcare: A Practical Roadmap for Health Informatics Leaders

Imagine you are a health informatics director at a mid-sized hospital. The CEO just returned from a conference where every vendor promised AI-driven predictions, automated documentation, and operational miracles. She hands you a mandate: “Make us an AI-forward organization by next year.” Your budget is tight, your IT team is already stretched, and your EHR is certified but not exactly bleeding-edge. What do you actually do?

This is a scenario I've seen play out across the country. And the answer isn't to chase every shiny algorithm. It's to build a solid foundation—one that starts with interoperability, respects security, and grounds every AI project in clinical reality. In this guide, I'll walk you through the steps I recommend to any informatics leader facing this challenge.

1. Assess Your Data Foundation: Interoperability First

Before you can layer AI on top of your health IT, you need to know what data you have and how it flows. The health IT ecosystem is fragmented, but we've made progress: as of 2021, 96% of U.S. non-federal acute care hospitals had adopted certified health IT (ONC/HHS Report to Congress). Yet adoption doesn't equal interoperability. You might have certified systems that still struggle to exchange data cleanly.

My first step is to audit your current data exchange capabilities. Are you using HL7 Version 2 for legacy workflows? It's still the most widely implemented standard, used by more than 95% of U.S. healthcare organizations (HL7 International). But for modern, developer-friendly APIs, you should be looking at FHIR. FHIR R4 (4.0.1), published in December 2018, was the first release with normative content, making it stable enough for production (HL7 FHIR Version History). If you're building new interfaces, start with FHIR R4—it's the foundation for patient access APIs required by CMS (Federal Register, CMS-9115-F).

Don't forget the semantic layer. Your AI models need coded data that means the same thing everywhere. SNOMED CT for clinical terms, LOINC for labs—these aren't optional. As of LOINC version 2.82, released February 2026, there are over 109,000 concepts (LOINC). That's the vocabulary your AI will learn from. If your data is a mess of free text and inconsistent codes, your AI will be, too.

2. Understand the Regulatory Landscape: HIPAA, Information Blocking, and AI Transparency

Now that you know your data, you have to make sure you're handling it legally. HIPAA is the floor. You're a covered entity if you transmit health information electronically for covered transactions (45 CFR 160.103). The Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI (45 CFR 164.308, 164.310, 164.312). That's not just a checkbox—it's a roadmap for securing AI systems that process ePHI.

Then there's information blocking. The 21st Century Cures Act made sharing electronic health information the norm, not the exception (ONC/HHS Information Blocking). If you're a health IT developer or provider, you can't hoard data. AI thrives on data, but you can't use that as an excuse to limit patient access. The ONC HTI-1 final rule, effective March 2024, added transparency requirements for AI and predictive algorithms in certified health IT (ONC/HHS HTI-1). That means you need to be able to explain how your AI works—what data it uses, how it was trained, and what its limitations are. This isn't a burden; it's a chance to build trust.

Ignoring these rules can be expensive. For 2026, the annual HIPAA penalty cap is over $2.1 million, and a single violation for willful neglect can cost over $73,000 (Federal Register, 91 FR 3665). That's a strong incentive to get security and compliance right from the start.

3. Choose the Right AI Use Cases: Start with High-Value, Low-Risk Projects

Not every AI idea is worth pursuing. I've seen too many organizations jump into predictive analytics for sepsis when they haven't even cleaned up their medication list. My advice: start with use cases that improve operational efficiency or clinical documentation, not those that make life-or-death predictions. For example, AI-powered speech recognition for clinical notes is a low-risk, high-reward starting point. It reduces physician burnout and improves EHR adoption.

Another safe bet is using AI to flag potential claim denials or to automate prior authorization. These touch financial and administrative domains, where errors are less critical. You can also use AI to prioritize messages in your patient portal, directing urgent ones to the right clinician. These projects are manageable, measurable, and don't require the same level of clinical validation as, say, an algorithm that recommends cancer treatments.

But whatever you choose, you must involve clinicians from day one. They'll tell you if the AI fits their workflow. And don't forget: the HIPAA minimum necessary standard applies to AI too. You can't feed your algorithm all the data you have if it only needs a subset. Limit access to what's needed for the task (45 CFR 164.502(b)).

4. Build for Security and Privacy from the Start

If you're building or buying AI, security can't be an afterthought. The NIST AI Risk Management Framework, released in January 2023, gives you a voluntary but excellent structure for managing AI risks (NIST AI RMF). Pair that with NIST SP 800-66 Rev. 2, the 2024 guide to implementing the HIPAA Security Rule (NIST SP 800-66 Rev. 2). It's the definitive resource for translating HIPAA's requirements into concrete actions.

When you're evaluating vendors, ask about encryption, access controls, and audit logs. The HIPAA Security Rule requires technical safeguards like unique user identification, emergency access procedures, automatic logoff, and encryption (addressable) (eCFR 45 CFR 164.312(a)). Make sure your AI vendor can demonstrate compliance with these. And remember, if they're a business associate, they're liable too. The breach notification rule requires you to notify patients within 60 days of discovering a breach of unsecured PHI (45 CFR 164.404). So you need a plan for when—not if—a breach happens.

5. Validate and Monitor AI Performance Continually

Your AI isn't a set-and-forget tool. It needs ongoing validation to ensure it's still performing as expected. That's especially true in healthcare, where patient populations change and new data comes in. As part of the HTI-1 rule's transparency requirements, you'll need to document how your AI was developed and how it should be monitored (ONC/HHS HTI-1). I recommend establishing a governance committee that meets quarterly to review AI performance metrics and address any drift.

One way to think about validation is to compare AI outputs against a gold standard. For example, if your AI predicts hospital readmissions, compare its predictions to actual readmissions every month. If it starts to slip, retrain it. But here's a warning: do not let AI make autonomous clinical decisions without human oversight. The technology is not there yet, and the liability isn't worth it. Always keep a human in the loop for anything that affects patient care.

Also, think about the data your AI uses. If you're incorporating genomic data, remember that genomics is the study of all of an organism's DNA (NHGRI). Whole-genome sequencing now costs a few thousand dollars, and the data it produces is vast (NHGRI). That's a lot of data to handle securely, but it could enable personalized medicine. Start small—maybe with a pharmacogenomics pilot—before you scale.

What can go wrong: You skip the interoperability and security groundwork, and you end up with an AI that works on your test data but fails in the real world. Then some patient's data gets exposed, and you're in front of the board explaining a HIPAA violation. Trust me, that's a nightmare you don't want.

Comparison: HL7 v2 vs. FHIR for AI Data Exchange

Bottom Line

If you're starting your AI journey, my single best move is to invest in a solid FHIR-based API layer and a clean data governance process before you buy any AI. That means mapping your data to USCDI v3, which as of January 1, 2026, is the baseline for certified health IT (ONC/HHS HTI-1). It's not glamorous, but it's the foundation that makes every AI project possible—and keeps you out of regulatory hot water. Do that, and you'll be ready to harness AI's power without getting burned.

Sources

• ONC/HHS (Report to Congress) - https://healthit.gov/news/onc-outlines-health-it-interoperability-progress-report-congress/
• HL7 International - https://www.hl7.org/fhir/
• HL7 FHIR (Version History) - https://www.hl7.org/fhir/history.html
• eCFR 45 CFR Part 164 Subpart C (Security Rule) - https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
• ONC/HHS (HTI-1 Final Rule) - https://healthit.gov/regulations/hti-rules/hti-1-final-rule/
• Federal Register (2026 HIPAA CMP Adjustment) - https://www.federalregister.gov/documents/2026/01/28/2026-01688