Everybody in healthcare wants to use AI, but not everybody is ready for it. AI readiness in healthcare has less to do with which model or vendor you pick and more to do with whether your data, workflows, and compliance processes can hold up once automation sits on top of them. The healthcare AI readiness checklist at the end of this post breaks those foundations into specific items you can check today.
Ghazenfer Mansoor, CEO and founder of Technology Rivers, has spent the last decade building health tech products and rescuing healthcare software projects that went off track. His background also includes early engineering roles at two startups and work at the Veterans Health Administration. In a conversation with Mel on the Medcurity Podcast, he laid out what organizations need in place before AI can help them.
Watch the full episode: AI Isn’t Plug and Play: What Healthcare Organizations Need to Know on the Medcurity Podcast
AI Reflects What You Put Into It
The most common misconception is that AI is plug and play: buy the tool, switch it on, and the problems go away. Computer science has an old rule for this, garbage in, garbage out, and it applies to AI too.
“AI is like a mirror. AI is going to reflect what you are putting into it.”
AI reflects your people, your processes, and everything else in your business. It does that work faster and more intelligently, and it saves time, but it can’t produce something you don’t already have. If your workflows aren’t documented, your data is incomplete, and you have no audit logging, AI won’t cover those gaps. It will expose them, and it can cause the project to fail.
AI bias in healthcare works the same way. An AI system can be biased or unethical depending on what goes into it. The way to manage it is a defined process and clear rules about which data the system is allowed to use.
If the output depends on the input, then the first readiness question isn’t about AI at all.
AI Readiness in Healthcare Starts With Data and Workflow Mapping
Preparing your data for AI in healthcare comes first. The second step is workflow: mapping that data to the processes it supports. A useful test is whether your people can explain how a process works from start to finish. If they can’t, or if the process isn’t documented anywhere, it can’t be built correctly in software, with or without AI.
Technology Rivers works through a HIPAA compliance checklist with clients, and now has an AI-specific version of it as part of our HIPAA-compliant application development work.
Scheduling is a good example. An AI scheduling tool may work beautifully for another organization, but if you don’t have a defined scheduling process and can’t map your current data to what the tool needs, you end up with something that doesn’t fit how your team actually works. Any tool, whether it’s a CRM, telehealth software, or a patient care platform, is only as good as the data in it.
AI in healthcare operations is a big opportunity for healthcare services businesses like home care, assisted living, and autism care, where internal tools can automate a lot of day-to-day operations. On the patient side, remote patient monitoring and remote care are where adoption is most visible, improving how doctors and patients communicate. The real payoff isn’t efficiency for its own sake. It’s growth, because every process that runs on its own gives staff more time for patients and the core business.
You Can’t Automate Compliance
One of the challenges in healthcare automation shows up when organizations ask to automate their compliance. That request skips a step.
“You can’t automate the compliance. You can only automate after compliance is embedded in your process.”
Software can enforce every rule correctly and still fail if the database behind it is open to anyone. That’s like having a computer or office files that anyone can walk up to and open. When the process isn’t there, automation creates more chaos, not less.
A related misconception is that encryption alone makes an application HIPAA compliant. Encryption at rest and in transit is the baseline, not the finish line. (For the full picture, see our guide to building HIPAA-compliant applications.) A compliant system also needs:
- Audit logging that records who viewed which data, when, and for how long. A patient list may show limited PHI, but once a user opens a record and sees prescriptions, visits, and medications, access needs to be tracked at that level, because that’s the detail that matters if an incident happens.
- Authentication and access control at both the software and infrastructure levels, including who can reach the database directly.
- Mobile safeguards for lost or unattended phones, such as the ability to remotely wipe PHI, and sessions that don’t stay logged in for days.
- Third-party checks on every tool the software talks to. An app can be compliant on its own and still leak PHI through Google Analytics, Mixpanel, or another integration that was never vetted. Every tool in the chain has to be addressed, not just the app and its cloud host.
AI in compliance automation is a growing area, with tools that can flag potential HIPAA violations and monitor access patterns.
The same discipline applies to the AI tools your team uses every day.
Can You Use AI Tools Like ChatGPT With Patient Data?
By default, you don’t. Treat an AI tool the way you’d treat social media: whatever you put into it, you’ve handed over. If you wouldn’t give a temporary hire unrestricted access to patient data, there’s no reason to give it to an AI tool either.
The safe path is to remove identifying details before data ever reaches the model. That can mean full de-identification under the 18 HIPAA Safe Harbor identifiers, or generalizing records so they stay useful without pointing to a person, such as “women in a certain age range with these symptoms” instead of a specific patient.
Contracts matter here too. Whether your team uses ChatGPT or another tool, you need agreements in place with the vendor. Enterprise versions keep your data within your organization, and it isn’t used to train the model. We cover this in more depth in our guide to building HIPAA-compliant AI healthcare apps.
Training matters too. Office environments have physical rules, the web added new risks, and phones opened things up further. Now every employee has access to ChatGPT, Gemini, and similar tools. Privacy training has to spell out what can and can’t go into them, backed by enforcement such as restricted access or private internal versions that only work with approved data.
Red Flags in Failing Healthcare Software Projects
A large share of Technology Rivers’ work is rescuing projects that stalled with another vendor or an internal team. Three patterns stand out.
The workflow isn’t clear. Teams focus on one or two use cases instead of the full flow for every person who touches the system. What does the patient do from start to finish? The caregiver? The admin staff? Until each role’s path is defined, the right product can’t be built.
The builders are generalists. Developers without healthcare experience often miss the basics, like whether a name or date of birth counts as PHI. The gaps are visible fast. Log in and the session stays active for two days. In Veterans Health Administration privacy training, stepping away for coffee while patient data is on screen, where someone could walk by and see it, is treated as a violation. Software that doesn’t account for that level of detail puts the organization at risk.
Nobody owns the product. Companies often hire “just a developer,” but development is one part of the process. Just as an organization has a compliance officer, a software project needs a product owner who drives it end to end.
When choosing a healthcare AI vendor or development partner, look at process, not promises. These are the questions to ask. Will they sign a BAA if they touch real PHI? Do they keep separate development and staging environments that use anonymized data? What is their data deletion policy? How are third-party integrations handled, and does the cloud host sign a BAA as well? A vendor that can’t answer these clearly is a red flag. You can see how this plays out in practice in our healthcare software portfolio.
Start Small and Keep Humans in the Loop
Comfort with AI builds gradually, so start with workflows that don’t involve PHI, such as internal operations. Once people see the efficiency gains, trust grows and better ideas follow. Most teams today still use AI only to polish emails and content, and there is far more possible beyond that.
Even content shows why context matters. Ask a general AI tool for a blog post and you get something generic, because it doesn’t know your business. Internal knowledge bases change that by limiting the AI to your own documents, so answers become more specific and more accurate. Learning what data the AI needs is part of AI readiness in healthcare, and starting small is how teams learn it safely.
Human oversight stays in the process at every stage. At Technology Rivers, AI-assisted development tools like Bolt, Lovable, and Builder, along with Figma-to-code generation, let the team turn a client’s problem into a working proof of concept with multiple screens in a few hours. Home care and remote patient monitoring prototypes have come together this way. They are close to production ready, not production ready. People still review, adjust, and finish the work.
The Healthcare AI Readiness Checklist
Use this healthcare AI readiness checklist before you sign with an AI vendor or automate a workflow. The items apply to smaller healthcare services businesses too, such as home care agencies, assisted living facilities, and autism care providers. Every item comes from the points covered in this conversation.
Data and workflow
- Every process you plan to automate is documented, and the people who run it can explain it from start to finish
- Your data is mapped to those processes, and you know exactly what data each AI use case needs
- You have defined which data AI tools may use and which they may not
Compliance
- Compliance is built into the process before any automation is added
- Audit logs record who viewed which records, when, and for how long
- Data is encrypted at rest and in transit, and access is restricted by role at both the application and database level
- Mobile devices that hold PHI can be wiped remotely, and sessions time out
- Every third-party tool, including analytics, has been checked for what data it receives
AI tools and PHI
- PHI is de-identified or generalized before it reaches any AI tool
- You have contracts in place with any AI tool your team uses, such as an enterprise version that keeps your data in-house and out of training
- Staff training covers what can and cannot go into ChatGPT, Gemini, and similar tools
Vendors, ownership, and rollout
- Development partners sign BAAs, use separate environments with anonymized data, and have a documented data deletion policy
- One product owner is accountable for the project end to end
- Your first AI project is a low-risk workflow that does not touch PHI
- A person reviews AI output before anyone relies on it
Process First, Then AI
Every point in this conversation traces back to one idea: technology doesn’t fix broken thinking, it amplifies it. Biased output, failed automation, PHI exposure, and stalled projects often start the same way, with AI or software layered onto processes that were never defined. AI readiness in healthcare comes down to getting those foundations in place first. Work through the healthcare AI readiness checklist above, close the gaps it reveals, and AI has a real foundation to build on.
If you’re weighing AI for your organization or aren’t sure your current application is ready for it, contact us to talk it through.
