How to bring an AI tool into a small practice safely

AI is already in most practices. In an August 2025 MGMA Stat poll, 71% of practice leaders reported some AI use in patient visits. The rules have not caught up. In MGMA's January 2026 poll, 56% of medical group leaders said they had no AI governance or formal AI policy.

You don't need a committee to fix that. You need a short checklist and one number to watch.

Start with one job and a tool that can't change the chart

Pick one narrow job with a clear finish line. "Check codes before the claim goes out" is a job. "Help with documentation" is not. MGMA suggests a short trial focused on one goal, with results tracked before you expand. Its August 2025 poll also found that practices using AI in 26% or more of visits were more likely to report a positive impact on workload. So keep the job narrow, then use the tool on every visit it fits.

Prefer tools that suggest over tools that act. A read-only tool can be wrong, but a person can catch the mistake before it reaches a claim. In 2024, UCHealth agreed to pay $23 million to resolve allegations that an automatic rule coded certain emergency visits at the top level. The rule keyed off how often vital signs were checked. Someone should read the chart before anything is billed.

Know exactly what leaves your office

Ask the vendor four questions. What fields are sent? Where are they processed? Who else touches them, including the AI company underneath? How long are they kept?

Then ask how patient details are removed. HIPAA's Safe Harbor method for de-identification requires removing 18 kinds of identifiers. The list includes every date element except the year, phone numbers, street addresses, and any other unique number. Removing only a name and record number doesn't meet that standard. A good vendor will tell you what can still slip through.

Also write down what staff may never paste into a free consumer chatbot. MGMA's governance guidance puts PHI and patient identifiers on that list.

Read the BAA for what it covers

If a vendor handles protected health information for you, HIPAA requires written assurances, usually a business associate agreement (BAA). Under 45 CFR 164.504(e), the contract must spell out how the vendor may use the data. The vendor must safeguard it, report breaches, and hold its subcontractors to the same terms.

A BAA says nothing about whether the tool is accurate. Ask whether it is signed, and when it takes effect.

Name the reviewer and measure first

Name one person who checks every output before it touches a note or a claim. The tool doesn't sign the note. Your clinician does.

Ask whether the tool flags in both directions. In March 2026, Aetna agreed to pay $117.7 million to resolve allegations about its chart reviews. The government said Aetna used them to add codes while ignoring results that showed codes were unsupported. You want a tool that shows what the note supports, up or down.

Then record your baseline before you start. MGMA reports that limited tracking makes it hard for many practices "to establish a productivity baseline, let alone measure change." Pull three numbers from the last 90 days:

• Your denial rate and top three denial reasons
• Average days from visit to payment
• After-hours charting, such as notes still unsigned at 6 p.m.

Pick the one this tool should move. The headline number may not be the one you feel. A 2026 JAMA study of 8,581 clinicians linked AI scribes to 16 fewer minutes of documentation per 8 hours of scheduled patient time. After-hours EHR time did not change significantly.

Train, collect feedback, and check at 30 and 90 days

Solo physicians tend to get less training. In the AMA's 2026 physician survey, 55% of solo-practice physicians had any AI training, versus 76% in hospitals. Give each user 30 minutes on what the tool does, what it doesn't, and what to do when it's wrong.

Set up one place to report bad output, like a shared log of the date, what the tool said, and what was wrong. Leave patient names out. The AMA survey lists a designated feedback channel among physicians' top requirements. Send the log to the vendor and expect answers.

At 30 days, check who is using the tool and what goes wrong most often. At 90 days, compare your number to the baseline. Then keep it, change it, or cancel it.

Ask us the same questions. Cortex Lens works inside Practice Fusion and has a narrow job. It checks codes and the problem list before the claim goes out, and it flags in both directions. It is read-only, and a person makes every change. It removes the patient's name and record number in the browser. Our security page lists everything it removes.

If you do only one thing, write down the number you want a tool to move before you sign up. Then check it at 90 days.