A hospital that runs a sepsis early-warning model, prioritises a radiology worklist with vendor software, or drafts notes with an ambient documentation assistant is making consequential decisions with AI, and the law treats it accordingly. Health privacy statutes govern the data. Device regulation may govern the software, whether it was bought or built in-house. Human rights law governs the outcome.
Conditionary’s health pack brings together HIPAA’s Privacy, Security and Breach Notification rules; Ontario’s PHIPA, including its audit-log provisions as they come into force; Alberta’s Health Information Act; British Columbia’s Responsible AI Policy Framework for the health sector; Canada’s Medical Devices Regulations; the FDA’s predetermined change control guidance; the EU Medical Device Regulation; and the UK’s Medical Devices Regulations 2002. Manufacturer duties and in-house device duties are kept separate, so a hospital is never treated as a manufacturer by default.
The set-up guide speaks clinical operations: which decisions, which service, which clinician is accountable, which vendor supplies what. Human review measures whether clinicians are genuinely reviewing recommendations or waving them through, which is the question an accreditor asks next.
Decisions the set-up guide asks about
- Inpatient deterioration and sepsis escalation
- Imaging worklist prioritisation
- Ambient clinical documentation
- Bed and resource allocation
- Staff scheduling and hiring
Rules in the pack, among others
- HIPAA Privacy, Security and Breach Notification
- Ontario PHIPA
- Alberta Health Information Act
- BC Health Sector Responsible AI Framework
- Canadian Medical Devices Regulations
- FDA PCCP guidance
- EU MDR, UK MDR 2002
- BC FIPPA and provincial privacy acts
Ready to run: The Board pack gives a quality committee the position on one page, with the entries it rests on behind it. See the reports.
