The AMA says physician oversight can’t substitute for adequate evidence and system design. That puts the burden on whoever holds the usage records.

In many hospitals, an AI tool is reading patient records through a shared service account that no one can tie to a person. That gap matters more now. The American Medical Association’s new framework, released October 29, 2026, divides responsibility among developers, physicians, and the health systems that deploy AI tools. Of the three parties, only one controls who and what can reach patient data.

That party is the health system. The framework says healthcare organizations should be accountable for how AI systems are selected, implemented, governed, and monitored in real-world settings. Physicians, in the same document, answer for the clinical judgment they can meaningfully exercise, and the document adds that physician oversight cannot substitute for adequate evidence and system design.

Read those two positions together. If a clinician cannot be expected to catch what was invisible at the bedside, the question of what could have been seen moves upstream, to whoever deployed the tool and whoever holds the records of how it was used. The framework is a policy position, not a statute. But it tells a CISO or a privacy officer which question is coming and who will be asked.

Consider a familiar sequence. AI tools arrive through the side door. A documentation assistant gets connected to the electronic health record by one department. A summarization plug-in is trialed by another. Each works through a shared service account because that is the fastest way to make the integration run, and each is approved in a meeting that produces a policy document and little else.

Source link