Clinical AI governance software built for hospitals and health systems

Not sure if a specific AI system is covered? Read the TRAIGA compliance guide →

Does TRAIGA apply to hospitals and health systems?

Yes — TRAIGA applies to organizations operating in Texas (effective January 1, 2026). But for a healthcare provider the one affirmative duty it adds is the § 552.051(f) patient disclosure: telling a patient (or their representative) when AI is used in their care, no later than the date service or treatment is first provided (in an emergency, as soon as reasonably possible). Beyond that, TRAIGA is intent-based — it prohibits specific harmful uses, including intentional, unlawful discrimination against a protected class — and it is enforced solely by the Texas Attorney General, after a 60-day cure period, with no private right of action. There is no AI-inventory or registration requirement for private deployers; inventorying and risk-scoring your systems are best practices for defensibility, not TRAIGA mandates. Texas SB 1188 adds related provider duties (see below).

Which clinical AI systems should we govern most closely?

TRAIGA doesn't require you to document or register your AI systems, but the systems closest to patient care carry the most risk: clinical decision support, prior authorization AI, triage and scheduling tools, predictive readmission models, and population health stratification. When a provider uses AI in a patient's treatment, TRAIGA's § 552.051(f) disclosure duty and SB 1188's § 183.005 record-review and patient-disclosure rules apply — and because your providers are the ones using EHR-embedded tools from Epic or Cerner with patients, those duties fall on your organization, not the vendor. A governance record is the practical way to meet them and stay defensible.

What patient disclosures does TRAIGA require for healthcare AI?

This is a real duty. TRAIGA's § 552.051(f) healthcare provision requires healthcare providers to disclose to a patient (or their representative) when AI is used in the patient's treatment or healthcare services — no later than the date service or treatment is first provided and, in an emergency, as soon as reasonably possible. Texas SB 1188 (Health & Safety Code ch. 183, effective September 1, 2025) adds a separate AI duty under § 183.005: a practitioner who uses AI for diagnostic purposes must act within their license scope regardless of the AI, review all AI-created records consistent with medical-records standards set by the Texas Medical Board, and disclose that AI use to patients (§ 183.005(b)). It also requires patient-information EHRs to be stored in the U.S. or a U.S. territory (§ 183.002), and is enforced by the Attorney General with civil penalties up to $5,000 (negligent), $25,000 (knowing or intentional), or $250,000 (PHI used for financial gain), plus possible license suspension or revocation after repeat violations (§§ 183.010–183.011). Risk Meridian helps you draft the patient AI-use notices and keep the review and oversight records these duties call for.

If we don't have to inventory our AI, why keep a governance record?

Because TRAIGA starts on your side, and documentation is how you keep it there. The law presumes you used reasonable care (§ 552.105(c)). If the Attorney General opens an investigation, a civil investigative demand can require a description of your AI system's purpose, the data it uses, its outputs, its known limitations, and your oversight process (§ 552.103). A maintained governance record preserves that reasonable-care presumption, answers the demand directly, and helps you qualify for the affirmative defense (§ 552.105(e)) — which recognizes substantial compliance with the NIST AI RMF and discovery of issues through red-team testing. You don't have to inventory — but you'll want the file if the AG calls.

Is a hospital district treated as a TRAIGA governmental entity?

No. TRAIGA expressly excludes a hospital district from its definition of governmental entity (Bus. & Com. Code § 552.001(3)), so TRAIGA's governmental-entity-only prohibitions — such as social scoring (§ 552.053) and biometric identification (§ 552.054) — do not bind a hospital district under TRAIGA. A hospital district is still a healthcare provider, so the § 552.051(f) patient disclosure duty and SB 1188's record-review and patient-notice rules apply to it, and SB 1964 may reach it on its own terms — confirm that with counsel. A private practice faces the same § 552.051(f) disclosure duty and the general prohibitions, plus the optional best-practice safe-harbor work, with SB 1188 where relevant.

How does Risk Meridian handle vendor-supplied AI in EHR systems?

Risk Meridian's position is that the organization deploying AI — not the vendor — is closest to the patient and carries the disclosure and oversight duties, whether the AI was built in-house or procured from Epic, Oracle Health, or a third-party clinical AI company. Risk Meridian gives you a vendor questionnaire and procurement checklist to collect governance documentation (model cards, validation, bias testing) from your suppliers, so you can document oversight and generate the patient disclosures the law requires.

What does a hospital board AI governance report include?

Risk Meridian's board AI governance report pack includes an executive summary of your AI governance program, a complete inventory of clinical AI systems with their Risk Meridian risk class, a control implementation status summary, an open incident log, and a governance maturity score. It is designed to give hospital boards the evidence to support their oversight discussions as AI-governance expectations continue to develop.

How long does it take to complete a hospital's initial AI inventory?

Most hospitals complete their initial AI system inventory within one to three weeks, depending on the number of systems and the responsiveness of internal stakeholders. Risk Meridian provides a structured intake form, a vendor questionnaire template, and automated reminders to keep the process moving. Many organizations inventory their first ten systems on day one.

How does Risk Meridian handle HIPAA and PHI?

Risk Meridian stores governance metadata about your AI systems — vendors, use-cases, risk scores, controls — not patient records, so no PHI is required to use the platform; that keeps it HIPAA-aware by design. Where a workflow could involve PHI, we can offer a Business Associate Agreement (BAA). Risk Meridian's infrastructure runs on AWS with encryption at rest and in transit, role-based access controls, and audit logging.

Can Risk Meridian handle multi-site health systems with dozens of AI systems?

Yes. Risk Meridian is a fully multi-tenant SaaS platform designed to scale from a single-hospital operator to a large integrated delivery network. Role-based access allows compliance officers, clinical informatics teams, legal counsel, and board members to have appropriately scoped access. You can organize AI systems by facility, service line, or business unit and generate consolidated governance reports across your entire system.