Your Practice Software Just Added AI. Did Anyone Read the Update?

Software updates arrive with a list of changes nobody reads and a button that says “Continue.”

Somewhere in last quarter’s release notes for your practice-management or electronic health record system was a line about a new AI assistant. It summarizes visit notes. It drafts patient messages. It suggests codes.

It was turned on when the update finished. Your team found the icon and started using it, because it’s helpful.

At no point did anyone at the practice decide that patient information should be processed by whatever AI model the vendor chose. Here are four things that changed when that button appeared.

Features arrive turned on

Vendors want adoption. The fastest path to adoption is enabling the feature by default and letting users discover it.

That’s fine for a new color scheme. It’s a different matter for a feature that reads clinical notes, generates text that ends up in the record, and sends data to a model the vendor licenses from someone else.

The practice’s consent to the update is not the same as the practice’s decision to use the feature. But from the outside, the two look identical, and the data has been flowing since the day the update ran.

What changed when the vendor added AI

Your relationship with the vendor is governed by a contract and a Business Associate Agreement (BAA). Both were written before the AI feature existed.

Now there’s a new data flow. Patient information leaves the vendor’s core system, goes to an AI service (often a third party), gets processed, and comes back. Questions the original agreement never had to answer are suddenly relevant:

• Is the AI provider covered as a subcontractor under the BAA?
• Is your data used to train or improve the model, and for whom?
• Where does the AI processing happen, and what’s retained afterward?
• Who at the vendor or the AI provider can see it?

Some vendors have updated their agreements and settings to address all of this. Some haven’t. You won’t know which until you ask.

Questions for your vendor

You don’t have to be technical to have this conversation. You have to be specific.

Ask your vendor, and keep the written answers:

• Which AI features are currently enabled in our account?
• Which of them process protected health information?
• Which third parties are involved, and does our BAA cover them?
• Can we turn each feature off individually, and who has the authority to do that?
• Is any of our data used to train models, and how do we confirm it isn’t?
• What changed in the terms of service or privacy policy when this was released?

A vendor serving healthcare should answer all of these without hesitation. Slow or vague answers are information too.

Decide on purpose, then document it

After the answers come in, the practice makes a decision: keep the feature on, turn it off, or turn it on for some roles and not others.

Any of those can be right. What isn’t right is the current state in most practices, where the decision was made by the vendor’s default and nobody noticed.

Write down what you decided and why. Add the feature to your approved AI tools list, or add it to the list of things that are off. Update your data inventory to show that this system now includes an AI processing step. Note the date.

That record is what turns “the software does it” into a governed choice.

Somebody has to read the update

The practical lesson is small and unglamorous: someone at the practice, or at your IT provider, needs to read release notes for the systems that hold patient data.

Not every update, and not every line. The ones that mention AI, data sharing, new integrations, or changes to privacy terms. Those get flagged, evaluated, and decided before the “Continue” button gets pressed.

It’s a fifteen-minute habit per system per quarter. It prevents a category of surprise that’s becoming more common every release.

We help practices review what their clinical and business software is actually doing with patient data, sort out the vendor agreements, and make sure new AI features are a decision instead of a default. It starts with a 10-minute discovery call.

Call us at 405-253-5101 or schedule a discovery call to get on the calendar.