Shashank Shastri
In my experience working with healthcare PMs, this is the strict end of the regulatory spectrum. Patient privacy under HIPAA in the US, GDPR in Europe, similar frameworks in India and Asia all impose constraints that change how AI can be deployed. By 2026, I’ve seen the constraints stay tight while AI vendor maturity has caught up enough that healthcare PMs can deploy AI workflows credibly. I wrote this guide for the practising healthcare PM - whether in payer, provider, life sciences, or health-tech - who wants to use AI without breaching compliance or patient trust.
AI for Healthcare Project Managers: Use Cases & Compliance
The Healthcare PM Operating Context
Healthcare PMs typically operate in one of four contexts:
- Provider organisations: hospitals, health systems running clinical and operational projects.
- Payer organisations: insurance companies running claims, member services, regulatory projects.
- Life sciences: pharma, biotech, medical devices running R&D, clinical trial, regulatory projects.
- Health-tech: companies building software products for any of the above.
Each context has shared constraints (HIPAA-class regulations) and specific ones (clinical trial regulations for pharma, accreditation for providers, HITECH for health-tech).
The PM’s role spans the standard PM activities - planning, execution, risk management, stakeholder management - within these elevated compliance constraints.
The Compliance Landscape PMs Must Navigate
Healthcare PMs work within several regulatory frameworks:
- HIPAA (US): protects PHI; affects how data is handled, stored, transmitted.
- HITECH (US): extends HIPAA into electronic health information.
- GDPR (EU): protects all personal data including health.
- FDA regulations: for medical devices and drug development.
- GxP (Good Practice): GMP, GCP, GLP, GVP for life sciences.
- State and regional regulations: vary widely.
AI use must respect each. The complexity is real but not unique to AI - PMs in healthcare have always operated within these constraints. AI adds new vendor-evaluation and data-flow questions.
AI Use Cases That Work in Healthcare
AI use cases that fit healthcare PM well:
- Status reporting with anonymised or de-identified data.
- Project documentation generation (charters, plans).
- Scheduling and resource allocation at the project level.
- Vendor management for non-clinical vendors.
- Stakeholder communication drafting.
- Risk register synthesis from project data.
- Lessons learned synthesis at closeout.
- Meeting summaries for non-clinical project meetings.
For each, the AI does not need to touch PHI. The data is project-level operational, not patient-level clinical.
AI Use Cases That Are Genuinely Restricted
These use cases require additional compliance care:
- PHI processing: any AI tool handling PHI must have a Business Associate Agreement (BAA) and meet HIPAA requirements.
- Clinical decision support: regulated as medical devices in many cases. PM-level use is fine; software products may need FDA clearance.
- Patient communication: tightly regulated. AI-generated patient communications need careful review.
- Clinical trial data: governed by GxP regulations and trial protocols.
- Provider productivity analysis: can intersect with HR and labor law.
For these use cases, work with compliance counsel before deploying AI tools.
Vendor Selection Criteria
When selecting AI vendors for healthcare project work:
- HIPAA BAA available: confirm in writing.
- SOC 2 Type II certification: minimum standard.
- Data residency guarantees: where is data stored, processed, backed up.
- Data segregation: customer data not used to train shared models.
- Subprocessor list: which third parties touch your data.
- Audit capabilities: can you audit access logs.
- Incident response: process for breaches and how customers are notified.
- Encryption at rest and in transit: standard requirements.
- HITRUST certification: increasingly the gold standard for healthcare AI vendors.
Most general-purpose AI tools (OpenAI Enterprise, Anthropic Claude Enterprise, Microsoft 365 Copilot) now offer healthcare-suitable tiers. Specialised healthcare AI vendors (Abridge, Suki, Notable Health) target clinical workflows specifically.
Patient Data and PHI Handling
Strong practice for healthcare PMs:
- Default to non-PHI: most PM work does not need PHI. Use de-identified or aggregated data.
- Minimum necessary: when PHI must be involved, use minimum necessary for the purpose.
- Tool selection by data class: HIPAA-compliant tools for PHI; general tools for non-PHI.
- Disclosure to AI tools: even with BAAs, document what PHI flows through which tools.
- Internal training: PMs and team members must know what counts as PHI and how to handle it.
- Incident readiness: have a process for accidental PHI disclosure to non-compliant tools.
These practices are operational, not blockers. Healthcare PMs already operate with PHI discipline; AI does not change the principles.
Clinical Project Specifics
For PMs running clinical projects:
- AI handles non-clinical project workflows normally.
- Clinical content (protocols, study designs, patient communications) require clinical SME and regulatory review.
- AI tools that handle clinical text need additional validation (e.g., does the AI accurately summarise a clinical protocol).
- Adverse event tracking remains a regulated process; AI augmentation is possible but heavily reviewed.
- Trial monitoring (CTMS systems) increasingly include AI features for site selection and recruitment forecasting.
The PM’s role is to stay disciplined about which work is in-scope for AI and which requires clinical and regulatory paths.
Regulatory Submission Project Specifics
Submission projects (FDA, EMA, equivalents):
- AI helps with project management, timeline, document tracking.
- Regulatory content (label, summary of clinical evidence) is generated by regulatory teams; AI augmentation possible but tightly reviewed.
- Submission templates (eCTD, IND, NDA) have strict format requirements; AI helps populate but does not replace expert review.
- Communications with regulators are not AI-drafted; they are SME-drafted.
The PM coordinates the cross-functional effort. AI accelerates the coordination layer.
EMR/EHR Implementation Specifics
EHR/EMR implementations are large multi-year projects with their own patterns:
- Stakeholder management across clinical, operational, IT.
- Workflow design and change management.
- Training and adoption.
- Data migration with PHI considerations.
- Integration with existing systems.
AI helps with stakeholder communication, workflow documentation, training material drafting, and project management overhead. The clinical workflow design itself remains expert-driven.
Healthtech Product Project Specifics
For health-tech companies building software products:
- Standard product PM patterns apply (see AI for Product Managers).
- Additional regulatory tracks: FDA SaMD (Software as Medical Device), HIPAA, security frameworks.
- Customer data is often PHI - product teams must respect this even when not in clinical workflows.
- Sales and customer success teams in health-tech have different cycles than non-regulated SaaS - longer, more compliance-heavy.
AI in health-tech product PM follows general AI PM patterns with healthcare compliance overlays.
The Tooling Stack
A working healthcare PM AI tooling stack:
| Layer | Healthcare-suitable choices |
|---|---|
| General LLM | OpenAI Enterprise (BAA), Claude Enterprise (BAA), Microsoft 365 Copilot (BAA) |
| Meeting capture | Otter Enterprise (BAA available), Microsoft Teams Premium |
| Documentation | SharePoint, Microsoft 365 (HIPAA-compliant tier) |
| PM tools | Microsoft Project, Smartsheet, Asana (with appropriate tier) |
| Clinical-specific AI | Abridge, Suki, Nuance DAX (for clinical documentation) |
For most healthcare PMs, Microsoft 365 with Copilot covers a large portion of needs because the Microsoft enterprise stack already has BAAs in place.
Building the Internal AI Policy
Healthcare organisations need clear AI policies. As a healthcare PM, contribute to or follow:
- Approved tool list: which AI tools are approved for which data classes.
- Use case approval: what kinds of AI use are pre-approved vs require review.
- PHI handling: explicit rules.
- Training requirements: what training PMs must complete.
- Incident response: process for AI-related issues.
- Audit and oversight: who reviews AI use periodically.
- External vendor review: process for evaluating new AI vendors.
PMs without a clear AI policy operate at risk. Push for clarity before deploying.
Common Failure Modes
These are the patterns I see most often when healthcare PMs deploy AI without enough discipline. I’d flag the first three as the ones that have created the most pain in teams I’ve advised.
- Pasting PHI into non-compliant AI tools. In my experience this is the most common breach. Train every team member.
- Treating AI summaries of clinical content as authoritative. Clinical content needs clinical review.
- Skipping the BAA. Without a BAA, an AI tool cannot legally handle PHI.
- Vendor sprawl. Each new AI tool needs vendor review. I recommend standardising early.
- AI hallucination in clinical contexts. Higher stakes than other domains. Always validate.
- Overlooking subprocessors. AI vendors use subprocessors. Each must be HIPAA-compliant.
- Pretending AI judgement substitutes for clinical judgement. AI assists, does not decide clinically.
- No incident response plan. When AI-related issues occur, you need a process.
The 90-Day Adoption Plan
Days 1-30: foundation. - Audit current AI use across the team. - Confirm approved tools and BAAs. - Train team on PHI handling with AI. - Pilot AI on non-PHI workflows (status reports, project documentation).
Days 31-60: expansion. - Add 2-3 more AI workflows on non-PHI data. - Establish vendor review process for new AI tools. - Build prompt library for healthcare-specific contexts.
Days 61-90: institutionalisation. - Document the healthcare PM AI playbook. - Train other healthcare PMs. - Measure: time saved, compliance incidents (target zero), stakeholder satisfaction.
By day 90, the healthcare PM has a sustainable AI practice within compliance constraints.
Shashank Shastri is a PMP trainer with over 14 years of experience and co-founder of Oven Story. He is an inspiring product leader who is a master in product strategies and digital innovation. Shashank has guided many aspirants preparing for the PMP examination thereby assisting them to achieve their PMP certification. For leisure, he writes short stories and is currently working on a feature-film script, Migraine.
Questions people ask
Published