Healthcare · AI Governance
Every AI tool you've adopted has changed your HIPAA risk profile. Most practices haven't updated their documentation to match.
Practitioner-grounded | Documentation you can produce in an OCR investigation
For physician-owned practices running scheduling tools, EHR modules, ambient scribes, imaging software, or billing platforms: if those vendors have access to patient data and you don't have an executed Business Associate Agreement, you have the same gap OCR found in more than $1.2 million in healthcare settlements in 2026.
The 3-Week AI Governance Sprint closes it — documented, signed, and ready to produce.
$1.2M+
2026 OCR settlements
3 weeks
Sprint to documentation
4 documents
OCR-ready deliverables
Fixed price
No scope surprises
What OCR Is Finding
More than $1.2 million in healthcare settlements in 2026 — five enforcement actions — all traced back to the same documentation failures. These aren't new requirements. They're gaps created by the speed of AI adoption.
Gap #1
Healthcare practices adopted AI tools quickly — scheduling platforms, EHR add-ons, ambient scribes, imaging AI, billing software. Most practices cannot produce a written list of which tools have access to patient data and under what vendor agreement terms.
Gap #2
A standard vendor subscription agreement is not a HIPAA Business Associate Agreement. The BAA is a separate document that must be specifically requested. Without it, every AI vendor with PHI access is an undocumented business associate relationship under 45 CFR §164.504(e).
Gap #3
HIPAA requires a current risk analysis that reflects your actual technology environment (45 CFR §164.308(a)(1)). A risk analysis from 2020 or 2022 does not cover AI tools adopted in 2023–2026. OCR will ask for the most recent version.
More than $1.2 million in HIPAA settlements in 2026 — five separate enforcement actions — all traced back to these same documentation gaps. The practices that had current documentation resolved faster, at lower cost, than those reconstructing it under pressure.
The Engagement
We work through your AI tool environment, identify every undocumented vendor relationship, and produce four documents. Ryan personally leads every sprint — not a template, not offshore.
Days 1–5
Document every AI tool touching patient data across all your locations — scheduling, EHR modules, imaging, billing, documentation tools, staff-used apps. For each tool: confirm BAA status, identify gaps, prioritize by PHI volume and enforcement risk.
Output:Written AI tool inventory with BAA gap analysis. You see every exposure before we start documentation.
Your time:~60 minutes — kickoff call + tool inventory input
Days 6–12
Produce the four documents OCR requests in any investigation — written for your specific practice and tools, not copied from a hospital template. BAA remediation outreach to every vendor without an executed agreement.
Output:Four completed documents ready for your review. BAA outreach to identified vendors in progress.
Your time:~30 minutes mid-week — clarification call if needed
Days 13–21
Your team reviews all documents. Final documentation package formatted for OCR production. Staff acknowledgment form each employee signs. Handoff call covering how to maintain documentation as you adopt new tools.
Output:Complete documentation package. Staff acknowledgment forms. 30-minute handoff call. You're done.
Your time:~60 minutes — document review + handoff call
What You Have When We're Done
AI Tool Inventory Register
Every tool, every location, every vendor, documented in writing. PHI access scope. Current BAA status. Risk tier by tool category.
Executed BAAs (or documented outreach for missing agreements)
No undocumented business associate relationships. For vendors who require outreach, we initiate — and the outreach itself is documented as evidence of your compliance effort.
HIPAA Risk Analysis Update
Current as of the sprint completion date. Covers AI tools as a distinct category — specifically addresses tools adopted in 2023–2026 that a 2020 or 2022 analysis doesn't cover.
Staff AI Acceptable Use Policy
Signature-ready, written for your practice type, not a generic hospital template. Each employee signs. The signed acknowledgment form is documentation of your training compliance.
BAA Addendum Review
For ambient scribes and documentation tools that include model training clauses. We flag whether patient audio is being used to train AI models — and what your BAA says about it.
Remediation Log
What we found, what we did about it, in writing. A documented remediation effort is what OCR is looking for — it's not about being perfect, it's about being able to show you took action.
These are practitioner documents, not legal opinions. They document your compliance effort — which is exactly what OCR is looking for. A practice with documented effort resolves investigations faster and at lower cost than a practice with no documentation.
Investment
Scope is confirmed after the Week 1 inventory — we don't change the price after we see your environment. What you pay is what you agreed to.
Single Location
$7,500
One location · 1–5 AI tools typical
Multi-Location
$9K–$15K
2–10 locations · scope confirmed in Week 1
Complex Environment
Scoped
10+ locations or 5+ AI tool categories
Price confirmed after discovery call. Scope locked before work begins. 50% upfront, 50% on delivery. Stripe — card or ACH. Net-7.
Who Does This Work
Ryan Dix is a finance and operations practitioner with 15+ years working inside businesses — not advising from the outside. ExxonMobil. Iron Mountain. Three founder ventures. Vision Genesis builds AI systems for owner-operated practices and then delivers the documentation that makes those systems legally defensible.
The AI Governance Sprint was built because every healthcare practice we've worked with had the same gap: AI tools adopted quickly, vendor agreements that weren't BAAs, and no one had stopped to write it down. OCR is now asking.
We're not a compliance software platform. We're not a law firm. We're practitioners who will sit with your practice administrator, document your actual tool environment, and hand you documents you can produce.
Book a discovery call →Common Questions
No. The BAA documentation and risk analysis are compliance documents, not legal opinions. For complex vendor disputes or OCR investigations already in progress, you may want legal counsel. For preventive documentation — which is what this sprint delivers — you don't. We'll tell you honestly if we see something that needs an attorney.
"HIPAA compliant" is a marketing claim, not a legal status. Healthcare practices hold HIPAA compliance — vendors don't. What matters is whether your vendor will execute a Business Associate Agreement. Many will. Some won't. We find out for each tool and document the result either way.
When was it done and does it cover AI tools? Most risk analyses from before 2023 predate the current generation of ambient scribes, EHR AI add-ons, and AI imaging tools. OCR's April 2026 guidance explicitly addressed whether practices are acting on their risk findings — a 2021 risk analysis that doesn't cover 2024 AI tools doesn't satisfy that standard.
Three weeks from kickoff call to final documentation delivery, for most practices. Complex multi-site environments may run 4–5 weeks. Schedule is driven primarily by how quickly we can get vendor responses to BAA requests — some vendors respond in 24 hours, others take 2 weeks.
You have documentation you own and can maintain. We offer an annual review (typically $3,000–$5,000/year) that refreshes the inventory, updates the risk analysis, and flags any regulatory changes. Not required — the sprint deliverables are yours to keep.
Ryan personally reviews every inquiry. Response within 24 hours.
Or email ryan@visiongenesisai.com with your practice name and specialty.