Soldier DataSample · invented organization · not client data
AI Readiness Assessment · Final report
Example Community Hospital, Community Benefit
1 Summary
Your team already uses AI in five ways. One is approved. Most of the rest are harmless and save real time. One, summaries of a partner’s client notes, has to stop now and go to privacy review.
We found 16 candidate uses. Of the top eight, three are worth starting now, three pay off but need a sign-off rule first, one waits, and one should be left alone.
2 Ranked inventory top 8 of 16
| Use | Who | Hours a month | Exposure | Call |
|---|---|---|---|---|
| Grant narrative and report first drafts | Community benefit team | 16 | Low | Start |
| Secondary data profiles from published sources | Analyst | 12 | Low | Start |
| Notes from coalition meetings | Coordinator | 8 | Low | Start |
| Synthesis of listening sessions and survey comments | Community benefit team | 20 | Medium | With controls |
| Implementation strategy first drafts | Director | 10 | Medium | With controls |
| Narrative for the community benefit report | Director, finance | 6 | Medium | With controls |
| Translation of community materials | Coordinator | 5 | Medium | Later |
| Summaries of community health worker client notes | Partner organization | 9 | High | Leave alone |
Exposure is what could go wrong: private data, a wrong answer to the public, or a decision about a person. Summaries of community health worker client notes are left alone because they are client records held by a partner. The use found here stops, and privacy reviews what was entered.
3 Data and rules review
- A partner’s client notes have been summarized with AI. Stop now. Privacy and counsel review what was entered before anything else happens.
- An approved AI tool is switched on, and nobody has said what it is for. IT enabled it for two of three staff. Compliance has not said which work may go into it. Get that in writing first.
- A personal chatbot account is in use alongside it. One person uses it for grant drafts. Move that work into the approved tool.
- Listening-session participants were not told about AI. Add a line to the consent script before the next session, and take the themes back to participants.
- Partner data is not covered by hospital policy. The community organization’s client notes are not hospital records. State health-data law may still apply. Counsel decides before any use.
- The assessment is shared work. Agree with the health department and partner hospitals how AI may be used on joint material.
4 Three first projects
01
Approved-use note for the team
One page from compliance and IT: which work may go into the approved tool, and what never does.
- Owner
- Compliance officer
- Estimate
- 2 weeks, staff time
02
Listening-session synthesis pilot
Themes drafted in the approved tool, checked against a sample coded by hand, and taken back to participants.
- Owner
- Director
- Estimate
- Scoped and quoted after the assessment
03
Grant narrative workflow
Built from your own past applications, with a reviewer step before anything is submitted.
- Owner
- Director
- Estimate
- Scoped and quoted after the assessment
5 90-day plan
PolicyCompliance officer
TrainingDirector
PilotDirector
ReviewCompliance officer
DecisionDirector
Week 1Week 13
Decision in weeks 12 to 13: keep the synthesis pilot, widen it, or stop. The board still adopts the assessment and the implementation strategy; nothing here changes that. The review in weeks 10 and 11 gives the director the numbers to decide.
6 An approved-use rule one page · a starting draft for compliance to finish
- Work goes only into the tool IT and compliance have approved. No personal accounts.
- Nothing that identifies a patient, client or participant goes into any AI tool without compliance sign-off.
- Participants are told how their words will be used before a session starts.
- Themes go back to participants before they go into the assessment.
- A named person checks every AI draft before it leaves the team.
7 What we did not look at
- We did not test any tool against your data. The pilot does that.
- We did not open any system that holds patient or client records.
- We did not review the hospital’s privacy policies. We asked how they apply to this team’s work.
- We did not review the partner organization’s systems.
- Hours are staff estimates from interviews, not measurements.