Patient disclosure and consent
The mapping
| Framework | Where this control sits |
|---|---|
| Joint Commission RUAIH | Focus area 5 — Transparency, education and training |
| CHAI governance playbooks | Playbook 8 — Education, training and feedback |
| NIST AI RMF | GOVERN |
The artifact: Patient disclosure standard
Who signs it: The chief medical officer with privacy and legal
What an assessor actually asks for
A written rule for when patients are told AI is involved, what they are told, how consent is handled where relevant — and the actual wording used.
Why the mapping is not obvious
The September 2025 guidance asks for a mechanism to disclose and educate patients and families, notification when AI directly impacts care, and consent where relevant. “Where relevant” is doing enormous work in that sentence and no external body will define it for you. Write the rule that says which category a tool falls into, and why.
The most common failure
A blanket notice in the privacy policy. It satisfies a lawyer and satisfies nobody else, and it is not what “notification when AI directly impacts their care” describes.
Where this sits in the whole map
This is one control in the RUAIH ↔ CHAI ↔ NIST crosswalk. The artifact itself is specified at Patient disclosure standard.
Written and reviewed by Neel Chauhan, MD MBA, physician-executive and founder of the Healthcare AI Institute. Last reviewed 2026-07-30.
Generated from data/crosswalk.yaml, where the mapping and the commentary for each control are authored individually. Reviewed on each framework revision.
The Institute accepts no vendor sponsorship, holds no vendor equity and takes no referral fees.