A complete AI policy
18 sections, from the governance committee and risk tiers to data rules and incident response. Sent to you as an editable template after the session.
FREE LIVE WEBINAR · THURSDAY, OCTOBER 22 · 1:00 PM ET · 90 MINUTES
AI Governance That Holds Up
Your staff are already using AI. Learn how to govern it with the compliance program you already run, without building a new framework, and watch the Microsoft tools that enforce it, live.
Save my free seat
Free. Can't make it live? Register anyway and we'll send you the recording and the policy template.
- 18-section AI policy template, yours to keep
- Live demo: patient data blocked before it reaches a consumer AI tool
- Built for compliance, privacy and operations leaders
You leave with three things you can use on Monday
A triage system for AI requests
Green for low-risk uses, approved in days. Yellow for tools that touch patient data, approved with conditions. Red for anything that affects care, coverage or claims, reviewed by your committee.
Controls that enforce it
See how Microsoft Purview and Defender find the AI in use and stop patient data from leaving, often on licenses you already pay for.
AI doesn't need new rules to get you fined
The fines don't come from "using AI." They come from the HIPAA failures regulators already penalize, and AI makes them easy to repeat: patient data sent to a vendor with no BAA, tools missing from the risk analysis, and nobody reviewing activity.
Raleigh Orthopaedic Clinic, 2016
- What happened
- Patient X-rays handed to a vendor with no BAA
- Penalty
- $750,000 · HHS OCR
- The AI version
- A nurse pastes a patient note into a free ChatGPT account
Warby Parker, 2025
- What happened
- Risk analysis and security control failures
- Penalty
- $1.5 million · HHS OCR
- The AI version
- AI tools left out of your HIPAA risk analysis
Montefiore Medical Center, 2024
- What happened
- Six months of insider data theft, no working activity review
- Penalty
- $4.75 million · HHS OCR
- The AI version
- Nobody can see what staff send to AI tools
Penalties from HHS Office for Civil Rights resolution agreements and civil money penalties.
Regulators are already asking about AI
- Texas Attorney General, 2024: a first-of-its-kind settlement with a clinical generative AI vendor over accuracy claims.
- US Department of Justice, 2024: compliance program guidance now asks how companies assess and manage AI risk.
- Joint Commission and CHAI, 2025–2026: responsible-AI guidance and a new voluntary certification.
After an incident, the first question will be "show me your controls."
You're not behind. Your peers are still working this out too.
Before the session, we asked the healthcare compliance and operations leaders who registered where their AI governance stands today.
83%
don't have AI governance in place yet
- 42% personally own AI governance in their organization
- 33% say their top issue is having no risk framework for AI
- 33% say their top issue is shadow AI and no written policy
In their words
"Time."
"Getting senior leaders on board."
"I'm concerned about data privacy overlap between AI used for personal use and business use."
"There is no unified AI regulatory framework in healthcare."
This session is built around those answers: a framework you already know, a policy you don't have to write from scratch, and a way to see and stop shadow AI.
What we'll cover in 90 minutes
- 0:00
Where your peers stand
Survey results and the real HIPAA enforcement cases behind the risk
- 0:15
One framework to build on
AI governance mapped onto the OIG's seven elements of an effective compliance program, the standard your program is already measured against
- 0:20
The policy, section by section
All 18 sections of a complete AI policy: committee, risk tiers, vendors and BAAs, data rules, human oversight, patient consent, monitoring and incidents
- 1:00
Live demo
Find the AI in use across your organization, turn it into an inventory, and block patient data from reaching consumer AI tools
- 1:15
Your next step
A self-check: how many of the 18 sections could you show an auditor today? And how we help teams close the gaps
- 1:20
Q&A
Your questions, answered live
You'll learn how to
- Build AI governance on the compliance program you already run, not a new framework
- Approve AI tools in days, not months, with green, yellow and red lanes
- Vet AI vendors before patient data goes in, including BAAs and "no training on your data"
- Put human review, patient consent and fairness rules where they belong in your policy
- See shadow AI and stop patient data from leaving, using Microsoft Purview and Defender
Watch a patient note get blocked, live
A policy in a PDF doesn't stop a paste at 9 p.m. In the demo, Ivan plays a nurse at the end of a shift who pastes a fictional patient note into an AI tool to draft a discharge summary.
-
Illustration · fictional data See it
Every AI app your managed devices talk to, with users, traffic and a risk score. Shadow AI, made visible.
-
Illustration · fictional data Block it
The paste containing a Social Security number, diagnosis codes and a medical record number is stopped. The same note, de-identified, goes through. The rule stops patient data, not AI.
-
Illustration · fictional data Prove it
What compliance sees afterwards: who, when, which site, which rule. Your activity review and your audit evidence.
Shown on Microsoft 365. Some features need specific licenses or add-ons, and we'll tell you which. Not on Microsoft? The policy works on any platform.
The 18-section AI policy, yours after the session
Built on the OIG's seven elements of an effective compliance program, the Joint Commission and CHAI responsible-AI guidance, and the healthcare usage rules of Microsoft, Google, OpenAI and Anthropic. Written for any healthcare organization, with clinical-only parts clearly marked.
Foundation
- §1 Document control
- §2 Purpose and principles
- §3 Scope and definitions
Who decides
- §4 Governance committee and roles
How AI gets in
- §5 Risk tiers and approval path
- §6 Lifecycle and inventory
- §7 Vendor management
- §8 Data rules
- §9 AI security
How AI is used
- §10 Human oversight
- §11 Transparency and consent
- §12 Fairness
- §15 Acceptable use
Staying in control
- §13 Performance monitoring
- §14 Reporting and incidents
- §16 Training
- §17 Regulatory map
- §18 Auditing and enforcement
A starting point for your organization, not legal advice. Have your counsel review it before adoption.
WHEN YOU WANT HELP PUTTING IT IN PLACE
A template is the start. We help you make it real.
The template saves you the writing. The real work is adapting it to your organization, finding out what AI is actually in use, and setting up the controls that enforce it. Demigos does that with your team, in two steps.
-
AI Governance Gap Assessment
3 weeks · a clear picture of where you stand
We review your policies, interview your compliance, IT, privacy and operations leads, and look at your Microsoft environment read-only to see which AI tools are really in use. Then we tell you where you stand and what to fix first.
You get
- A scorecard of all 18 policy sections, rated red, amber or green against the OIG's seven elements
- Evidence of the AI actually in use, from your Microsoft environment and an anonymous staff survey
- A review of your key AI vendors: BAAs, training on your data, and model-change notice
- A draft AI inventory, with your top use cases sorted into green, yellow and red lanes
- Your top 5 risks, with the question an auditor would ask about each
- A 30/90/180-day roadmap and a one-page memo for your board or owners
-
Governance and guardrails setup
We build it with you
We adapt the policy and committee charter to your organization, set up the approval path and inventory, configure Microsoft Purview and Defender to find shadow AI and block patient data from leaving, and train your staff.
No access to patient records. Microsoft discovery is read-only. This is a governance assessment, not legal advice or a certification.
Webinar attendees can book a free 30-minute call to talk through where they stand and whether an assessment makes sense.
Built for the people who own the risk
This is for you if you're a...
- Chief or VP Compliance Officer, Privacy Officer, or Head of Compliance
- COO, CIO, CISO, or revenue cycle leader who's been asked to "figure out AI"
- Leader at a provider, health plan, revenue cycle or risk adjustment firm, MSO, pharma company, medical supplier, or healthtech company
...and you've thought:
- "Staff are using ChatGPT and I can't see it."
- "I don't have time to write a policy from scratch."
- "Our board will ask about AI, and I need an answer."
Not a hospital? No board? The policy says "patients or members" and "board or owners", and marks the clinical-only parts, so it fits any healthcare organization.
Your host
Ivan Dunskyi
Founder & CEO, Demigos
LinkedInIvan has spent 14+ years building software and 6+ years building AI for healthcare: clinical documentation, prior authorization, care gap detection and revenue cycle. His team has delivered 60+ implementations across health systems, revenue cycle organizations and healthtech companies. He has seen AI adopted with governance and without it, and this session is what he wishes every healthcare leader had before the first tool went live.
Ivan leads the AI in Practice program for healthcare executives. The policy structure was reviewed with a US healthcare attorney.
- 14+ years building software
- 6+ years in healthcare AI
- 60+ implementations
What leaders from Ivan's program did next
Play video: Revenue cycle company
Revenue cycle company
The CRO built AI agents that save his team 10–15 hours a week, then rolled out a compliance agent to his compliance team.
Play video: Rural hospital
Rural hospital
The CEO set up an AI governance committee and an AI strategy.
Questions
Is it really free?
Yes. Attending is free, and so is the 18-section policy template.
I can't make October 22. Should I still register?
Yes. Everyone who registers gets the recording and the template, whether or not they attend live.
Why 90 minutes?
The first hour is the substance: the framework and all 18 policy sections. Then the live demo, a short look at how to close your gaps, and open Q&A. Stay for as much as you need.
Does Demigos offer help after the webinar?
Yes. Near the end, Ivan explains how Demigos runs a 3-week AI Governance Gap Assessment and then helps set up the policy and the Microsoft guardrails. Attendees can book a free 30-minute call to see if it fits. The template and everything shown in the session are yours either way.
We're not a hospital. Is this relevant?
Yes. Registrants include revenue cycle and risk adjustment firms, a management services organization, a medical supplier, a pharmaceutical company and consultants. If you handle patient data or touch claims, you have the same exposure. Clinical-only parts are marked.
We don't use Microsoft. Is the demo still useful?
The policy and the approval path work on any platform. The demo uses Microsoft 365 because many US healthcare organizations run on it, and Ivan will point to alternatives for other environments.
Do we need Microsoft 365 E5?
Not for everything. Some controls need E5 or paid add-ons. The session is clear about which features need which license, so you know what you already own.
Is this legal advice?
No. Ivan is a practitioner who builds AI systems for healthcare. The policy structure was reviewed with a US healthcare attorney, but your counsel should confirm how it applies to your organization.
Can I invite colleagues?
Yes, please do. AI governance needs compliance, IT and operations working together. Share this page or forward your confirmation email.
Where does it take place?
Online, on TODO: [platform]. Your joining link arrives by email after you register, with a reminder before the session.
Get the policy. See the controls. 90 minutes.
Thursday, October 22, 2026 · 1:00 PM ET (10:00 AM PT) · 90 minutes · Free · Online
Register once and you'll get the joining link, a reminder, the recording and the 18-section policy template.