Soldier DataSample · invented organization · not client data
AI Readiness Assessment · Final report
Example County Health Department
1 Summary
Your staff already use AI in eleven ways. Two are approved. Most of the rest are harmless and save real time. One puts case information at risk and should stop this week.
We found 40 candidate uses. Of the top eight, three are worth starting now, three pay off but need a sign-off rule first, one waits, and one should be left alone.
2 Ranked inventory top 8 of 40
| Use | Who | Hours a month | Exposure | Call |
|---|---|---|---|---|
| Grant narrative and report first drafts | Preparedness, community programs | 30 | Low | Start |
| Board of Health packet summaries | Administration | 10 | Low | Start |
| After-action report first drafts | Preparedness | 12 | Low | Start |
| Synthesis of community listening sessions | Assessment | 16 | Medium | With controls |
| Surveillance summaries from published tables | Epidemiology | 14 | Medium | With controls |
| Redaction for public records requests | Records | 20 | High | With controls |
| Translation of health notices | Communications | 8 | Medium | Later |
| Case note summaries | Communicable disease | 28 | High | Leave alone |
Exposure is what could go wrong: private data, a wrong answer to the public, or a decision about a person. Case note summaries are left alone because they put identifiable health information into a tool. Translation waits until a qualified translator can review each notice.
3 Data and rules review
- No written rule for public chatbots. Nine of ten staff interviewed use one. None could say what is allowed. Write the rule first.
- Case details have gone into a free tool. Three staff described pasting case notes to get a summary. Stop this week, and have the privacy officer run a breach risk assessment on what was entered.
- Staff do not know which programs are covered. The department is a hybrid entity. Name the covered programs in the rule, so nobody has to guess.
- Small numbers are leaving in “aggregate” tables. A table of counts under ten by census tract can identify a person. Apply your suppression rule before a table goes near any tool.
- The records schedule does not mention AI drafts. Prompts and drafts are public records. Decide how long they are kept before the pilot starts, not after a request arrives.
- Nobody owns the question. IT assumes the health officer decides. The health officer assumes IT has it. Name one owner.
4 Three first projects
01
Health-data rule and acceptable-use policy
One page of rules, two of policy, in plain language. Written with the privacy officer, county counsel, IT and the records officer. Issued by the health officer and reported to the Board of Health.
- Owner
- Deputy director
- Estimate
- 3 weeks; your staff, or quoted separately
02
Grant narrative pilot
One approved tool, past applications only, no client data. Measure drafting hours against the last cycle.
- Owner
- Preparedness coordinator
- Estimate
- 6 weeks, one license tier
03
Staff training, two sessions
How to ask clearly, how to check the answer, and what never goes into a tool. A separate hour for the Board.
- Owner
- Training lead
- Estimate
- Two half-days, 40 staff
5 90-day plan
PolicyDeputy director
TrainingTraining lead
PilotPreparedness coordinator
ReviewPrivacy officer
DecisionDirector
Week 1Week 13
Decision in weeks 12 to 13: keep the grant pilot, widen it, or stop. The review in weeks 10 and 11 gives the director the numbers to decide.
6 A health-data rule one page · a starting draft for your privacy officer to finish
- Nothing that identifies a person goes into a public AI tool. That means every identifier on the HIPAA list, and any free-text note.
- Protected health information, and other confidential data such as communicable disease, HIV and STI, WIC and vital records, goes only into a system the privacy officer has approved, under the agreements that data requires.
- The covered programs are listed on the back of this page. If you are not sure, treat the work as covered.
- Counts under ten are suppressed before a table goes into a public tool.
- Prompts and drafts are public records. Keep them under the retention schedule.
- A named person checks every AI draft before it leaves the department.
7 What we did not look at
- We did not test any tool against your data. The pilot does that.
- We did not open any system that holds case, client or patient records. We reviewed the rules for them, and how staff describe using them.
- We did not review programs under substance use confidentiality rules. Those need your counsel first.
- Hours are staff estimates from interviews, not measurements.