Five principles, three committees: the AI blueprint inside a hospital
The White House’s nonbinding AI blueprint read like new governance. For health systems, most of it described work existing clinical committees already knew how to do. Extending those committees to algorithms beat building a separate AI bureaucracy.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On October 4, 2022, the White House Office of Science and Technology Policy released the Blueprint for an AI Bill of Rights. It set out five principles for automated systems that affect people’s rights, opportunities or access to critical services. They were safe and effective systems; algorithmic discrimination protections; data privacy; notice and explanation; and human alternatives, consideration and fallback. A technical companion described how to put the principles into practice, with examples from health care, employment, lending and public benefits. The blueprint was explicitly nonbinding and created no legal obligations. Large language models were not yet in wide public use. ChatGPT was released at the end of the following month.
The blueprint drew criticism from several directions: toothless because it was voluntary, too vague to implement, too broad for the range of systems it covered. For health systems, a more useful reading was available. Most of its principles described disciplines clinical medicine already practiced under other names. Drugs and devices are evaluated before use and watched afterward. Quality programs compare outcomes across patient groups. Clinicians can override decision support, and patients are told what is being done to them.
That suggested a governance design. Rather than building a new AI committee from scratch, a health system could assign the principles to the bodies that already owned the matching discipline. Data privacy sits with the existing HIPAA program. The other four principles fall to three functions: validation, equity monitoring, and notice with a human fallback. Each has a natural home and a different set of skills.
Validation: the formulary model
The safe and effective principle asked that automated systems be tested before deployment and monitored afterward in the setting where they are used. By 2022 many health systems ran predictive models embedded in their electronic health records or bought from vendors: sepsis alerts, deterioration scores, readmission risk, no-show prediction. Published studies had shown that some widely used models performed worse in practice than their developers reported.
The closest existing analogue is the pharmacy and therapeutics committee. It decides what goes on the formulary, under what conditions, and when something comes off. A model governance function can work the same way. It approves a model for a defined use, requires local validation on the health system’s own patients before go-live, sets thresholds that trigger review, and has authority to pause or retire. Performance drifts as populations, practices and documentation habits change, so validation is a schedule, not an event.
The function needs data science staff, clinical champions for each model, and access to outcome data. It also needs vendors to cooperate. Contracts and selection reviews should ask for performance evidence, a description of training data and known limitations, support for local testing, and advance notice of model changes. Without those, the committee is reviewing a black box.
The formulary model has a cost. Committees meet monthly, and product teams want to deploy faster than that. A tiered approach helps. Low-risk tools, such as a model that predicts no-shows to send reminders, can be approved by a small subgroup against a checklist. Tools that influence diagnosis or treatment go to the full committee. The tiering itself should be written down, so that a vendor feature switched on in an EHR upgrade does not bypass review because nobody classified it.
Equity monitoring: the quality program’s method
The algorithmic discrimination principle asked that systems be checked for unjustified differences in treatment based on protected characteristics. In health care the concern was concrete. A widely cited 2019 study found that an algorithm used to select patients for care management underestimated the needs of Black patients because it used past health care spending as a proxy for need.
Quality and health equity teams already stratify outcomes by race, ethnicity, sex, age, language and payer. Extending that method to algorithms means two checks. The first compares model performance across groups: does a risk score miss more true cases in one population than another? The second examines inputs: does the model rely on proxies such as cost, zip code or prior use of services that carry historical inequities into the prediction?
Data quality limits both checks. Race, ethnicity and language fields in many records are incomplete or inaccurate, which makes subgroup analysis noisy. Improving that data is slow, unglamorous work. It is also a precondition for knowing whether a model treats patients fairly, and it helps the quality program in other ways.
Notice and fallback: the informatics and patient experience job
The notice and explanation principle and the human alternatives principle belong together in operation. People affected by an automated decision should know a system is involved, understand roughly how, and be able to reach a person who can review or override it.
For clinicians, override exists in principle. Whether it is realistic depends on alert design, time pressure and workflow, which clinical informatics owns. Tracking overrides and the reasons for them shows where a model and clinical judgment disagree, which feeds back into validation. Alert fatigue is a sign that the fallback has turned into a reflex.
For patients, the questions arise in scheduling, triage chat, outreach lists and financial assistance screening. Do patients know an algorithm shaped the outcome, and can they easily reach a person? Patient experience and access teams can write those requirements into design reviews and vendor contracts, and test them by trying to reach a human through each channel.
The three functions need a light coordinating layer: a single inventory of models in use, each with an owner in each function, reviewed by a senior clinical and operational leader. That inventory is the one genuinely new artifact. Everything else extends what the organization already does.
With hindsight
The blueprint itself had a short formal life. Executive Order 14110 in 2023 and OMB’s 2024 AI guidance for agencies set binding federal requirements, and both were rescinded or replaced in 2025. Its ideas moved into rules that do bind health care. The ONC’s HTI-1 rule, finalized at the end of 2023, added transparency requirements for predictive decision support in certified health IT. HHS’s 2024 Section 1557 rule requires covered entities to make reasonable efforts to identify and mitigate discrimination risks in patient care decision support tools. Several states passed laws on AI in health care and insurance. Generative AI then spread quickly into clinical documentation and patient messaging. By 2026, health systems that had extended existing committees to algorithms early have absorbed those tools with less disruption than those that built governance around a single new body.