AI Governance for RHTP-Funded Rural Health Organizations

Key Takeaways

·RHTP authorizes $50B over five years and explicitly permits AI tools, but has no AI governance floor — no state application reviewed required practice-level AI accountability. HHS has acknowledged this gap exists and hasn't addressed it.
·Rural-only health systems are twice as likely to have no AI governance whatsoever compared to peers, despite equivalent vendor dependency and the same HIPAA exposure from AI features embedded in vendor-updated software.
·Rural organizations face five compounded algorithmic bias types: historic, representation, measurement, aggregation, and deployment bias. AI trained on urban academic medical center data does not automatically perform on rural populations.
·Four governance elements every rural organization needs before AI deployment: decision classification by consequence level, named executive accountability, local output validation, and board-visible reporting.
·Available governance frameworks were not built for rural settings. HAIRA and the AMA 8-step toolkit are the most feasible starting points for organizations without dedicated governance staff.
·HTI-1 requires certified EHR vendors to disclose AI model attributes to you. A proposed HTI-5 rule would eliminate those requirements — organizations that built vendor evaluation processes around HTI-1 disclosures need backup governance that doesn't depend on them.

The short answer

Rural health organizations implementing AI through RHTP need four governance elements in place before deployment: classify each tool by the consequence level of the decisions it influences, assign named executive accountability for each tool's performance, validate AI output against your local patient population rather than relying on vendor studies alone, and establish board-visible reporting on AI use. RHTP currently has no AI governance floor. No state plan reviewed required practice-level AI accountability. That gap is yours to fill.

What RHTP Requires — and Doesn't — for AI Governance

The Rural Health Transformation Program authorizes $50 billion over five years for rural health system reform and explicitly permits AI tools as part of care delivery modernization. What RHTP does not do is define any governance expectations for those tools.

A review of state RHTP applications found a consistent pattern: applications describe what AI will do in clinical workflows but say nothing about who is accountable when AI-influenced decisions affect patient care. Standard governance language covering project management, cybersecurity, and IT oversight appears throughout, but that language was written for infrastructure, not for clinical AI accountability.

The Bipartisan Policy Center confirmed that RHTP uses incentive scoring rather than mandates for health IT governance, accounting for roughly 4% of workload funding. AI accountability is left to state discretion. Among reviewed state plans, Maine's voluntary Rural AI Hub is the only documented state-level innovation on AI governance.

In December 2025, HHS formally acknowledged in an RFI on AI in clinical care that "rural, critical access and other safety net hospitals" may lack the staff or resources to support AI governance structures and ongoing measurement. This acknowledgment exists. The corresponding program requirement does not.

The Governance Gap in Numbers

·70% of healthcare organizations have AI governance committees, but rural-only systems are twice as likely to have no governance whatsoever — despite equivalent vendor dependency.
·Only 30% of healthcare organizations maintain enterprise-wide AI inventories. Rural organizations are the lowest-performing group.
·Fewer than half of hospitals tested for bias before AI deployment, and this failure was most pronounced among smaller, rural, and non-academic institutions, per ONC data.
·Over $31.5B flowed into equity-focused healthcare AI investment from 2019 to 2022. The 20,000-plus FQHCs, rural health clinics, and free clinics serving 95 million Medicaid-enrolled Americans received essentially none of it.

Why Rural Organizations Face a Compounded Governance Burden

Governance frameworks designed for urban academic medical centers don't transfer cleanly to rural settings. The problem isn't only resource constraints. Rural health organizations face a specific combination of algorithmic and structural disadvantages that standard governance programs weren't built to address.

A 2025 Frontiers in Public Health analysis identified five distinct algorithmic bias types affecting rural populations:

Historic bias

Inequities embedded in historical training data get encoded into AI outputs. If rural populations were systematically undertreated in the datasets an AI learned from, that AI will perpetuate those patterns.

Representation bias

Rural populations are frequently excluded from AI training cohorts entirely. An algorithm with no rural patients in its training data is making predictions about a population it has never seen.

Measurement bias

Proxy variables like smartphone access or travel time to specialty care work differently in rural environments than in urban ones, producing systematic errors in risk stratification.

Aggregation bias

AI models that treat rural populations as homogeneous miss the substantial variation across agricultural, mining, coastal, and tribal rural communities. False assumptions about population similarity degrade performance.

Deployment bias

Academic medical center models applied without local adaptation consistently underperform in rural settings. A Brazilian study found AI models entirely failed to detect disease patterns in rural communities whose environmental and socioeconomic features were absent from training data.

The validation gap compounds this. A 2024 systematic review of 109 studies found that 89.9% used only internal validation with no generalizability testing. The AI tools most likely to be deployed through RHTP funding were evaluated on populations that may not resemble rural patients at all.

A 2025 JAMIA scoping review of 26 AI studies in rural health found that none documented an AI governance framework specifically for rural deployment — two studies mentioned governance as a gap. Generative AI had not been evaluated or deployed in any rural setting reviewed. The research base that normally informs governance practice simply doesn't exist here.

The Four Governance Elements Before Deployment

Rural organizations implementing AI through RHTP need four things in place before any tool touches patient care. These aren't a compliance checklist. They're the minimum needed to answer the question a board member, a surveyor, or a plaintiff's attorney will eventually ask: who decided this AI was safe to use here, and how do you know?

Decision classification by consequence level

Before deploying any AI tool, classify it by the type and consequence level of the decisions it influences, not just by its technical category. A sepsis prediction model that drives triage decisions is fundamentally different from a scheduling optimizer, even if both appear in an AI inventory. For each tool, ask: what decisions does this influence, who acts on those decisions, and what happens to a patient when the AI is wrong? That classification determines what governance intensity the tool requires.

Named executive accountability

Every AI tool in active use needs a named human owner: someone who is accountable for that tool's performance, who is authorized to modify or stop its use, and who would answer to the board if something went wrong. In rural organizations where clinicians often wear multiple governance hats, this person might be the CMO or CNO. What they can't be is unnamed or assumed. Accountability that lives with 'the committee' or 'IT' isn't accountability. It's a gap waiting to surface under pressure.

Local output validation

FDA clearance establishes that a device met regulatory requirements in the manufacturer's testing conditions. It doesn't establish that the device performs on your patients, with your documentation practices, in your clinical environment. RHTP organizations receiving AI tools through state or federal programs should not assume vendor validation data applies to their population. Before go-live on any clinical tool, run at least a targeted review of the tool's performance on cases from your own patient population. Document what you found and what decisions you made based on it.

Board-visible reporting

Your board is accountable for organizational risk, including AI risk. They need to know what AI tools are in clinical use, what decisions those tools influence, and whether the organization has a reasonable governance posture for each one. This doesn't require a full governance dashboard on day one. It does require that someone can answer those questions in a board meeting without having to 'get back to them.' If that answer isn't available today, that's the governance gap to close first.

Frameworks Suited to Resource-Limited Organizations

Most major AI governance frameworks were designed for large, well-resourced health systems. Duke-Margolis convened Mayo, Stanford, Kaiser, and University of Chicago to document current governance practice; the resulting framework explicitly acknowledged it requires technical expertise and tools that under-resourced organizations lack. JMIR Research Protocols confirmed in 2025 that while theoretical frameworks exist in abundance, most lack strategies for regional hospitals and resource-limited settings to actually adopt them.

Two frameworks are more applicable to rural RHTP-funded organizations:

HAIRA Maturity Model

Published in npj Digital Medicine in 2025, HAIRA defines five governance maturity levels across seven domains: organizational structure, problem formulation, external product evaluation, algorithm development, model evaluation, deployment integration, and monitoring. It was explicitly designed because existing frameworks create barriers for smaller healthcare organizations. A rural organization at Level 1 or 2 can use HAIRA to identify achievable targets without enterprise-scale infrastructure. It's the most applicable framework for RHTP-funded organizations starting from a governance baseline of near zero.

AMA 8-Step AI Governance Toolkit

The AMA's 2025 toolkit is built to scale for organizations of all sizes and includes a downloadable model AI policy. The eight steps move from establishing executive accountability through forming a working group, assessing current policies, developing AI policies, defining vendor evaluation processes, updating planning processes, establishing ongoing oversight, and supporting organizational readiness. In rural organizations where clinicians often serve governance roles, the AMA toolkit's structure works with that reality rather than against it.

The American Hospital Association's April 2025 rural technology guidance recommends a staged adoption approach: start with lower clinical-risk AI (revenue cycle optimization, ambient documentation) before advancing to clinical decision support. This sequence gives rural organizations time to build governance capacity before deploying tools that carry direct patient safety implications. North Carolina's RHTP approach, which explicitly funds rural providers to establish health IT governance and partners with Duke for AI safety monitoring, is one model of what state-level support could look like.

NIST AI RMF 1.0, with its four functions (Govern, Map, Measure, Manage), provides a voluntary federal baseline that any governance program should reference, even if full implementation is phased. Twelve percent of U.S. hospitals have formally adopted it; adoption is lower among rural organizations. It doesn't require enterprise resources to use as a reference framework for the four governance elements described above.

Federal Signals Worth Tracking

The federal AI governance landscape is shifting in ways that directly affect RHTP-funded organizations.

HTI-1 (effective January 1, 2025)

ONC's HTI-1 rule requires certified health IT vendors to disclose 31 source attributes for predictive algorithms: development process, fairness safeguards, external validation data, performance metrics, and maintenance schedules. Rural organizations using certified EHRs should be receiving these disclosures from vendors. This is the closest thing to a federal AI transparency floor that exists for rural organizations today. If your EHR vendor hasn't provided this documentation, ask for it by name.

HTI-5 proposed rule (late 2025 — not yet final)

A proposed rule would eliminate the AI model card requirements established by HTI-1. If finalized, organizations that built their vendor evaluation processes around HTI-1 disclosures would lose that baseline. Rural organizations should build governance processes that don't depend solely on vendor-provided documentation, whether or not HTI-5 is finalized. Local validation and contractual transparency requirements are the backup.

HHS RFI on AI in clinical care (December 2025)

HHS explicitly stated in a December 2025 RFI that rural, critical access, and safety-net hospitals may lack staff or resources to support AI governance structures and ongoing measurement. This is a federal acknowledgment that the rural governance gap is real. It has not yet produced program requirements or funding dedicated to governance capacity. Organizations that address this gap proactively are ahead of where federal expectations are heading.

Joint Commission and CHAI guidance (September 2025)

The Joint Commission's RUAIH guidance, released jointly with the Coalition for Health AI in September 2025, establishes seven foundational elements for responsible AI oversight: governance structure, privacy and transparency, data security, continuous monitoring, voluntary reporting, risk and bias assessment, and education and training. This guidance is formally advisory. The Joint Commission's deeming authority under 42 CFR makes it functionally significant even without formal accreditation standards attached. Rural organizations subject to Joint Commission accreditation should treat these seven elements as the governance target.

Frequently Asked Questions

Common questions from rural health leaders navigating AI governance under RHTP and related federal programs.

Does RHTP require AI governance as part of receiving funding?

No. RHTP currently has no AI-specific governance floor. Standard grant terms cover cybersecurity, project management, and general IT oversight, but no state application reviewed required practice-level AI accountability — specifying who is accountable when an AI tool influences a patient care decision. HHS acknowledged in December 2025 that rural and critical access hospitals may lack the resources to support governance structures, but this acknowledgment hasn't produced a corresponding program requirement. The governance responsibility falls to the organization.

What is the minimum viable AI governance for a small critical access hospital?

For a critical access hospital starting from scratch, the minimum viable floor is four things: a list of every AI tool in active clinical use with a named owner for each one, a classification of each tool by the consequence level of the decisions it influences, documentation that each tool has been reviewed against your patient population rather than accepted solely on vendor claims, and a process for reporting AI-related concerns to leadership. That's not a full governance program — it's the foundation that prevents the most serious accountability gaps. The HAIRA Maturity Model Level 1 and the AMA 8-step toolkit are the two most practical starting frameworks for this organizational size.

We received AI tools through RHTP funding. Do we need to validate them ourselves?

Yes, and this is one of the highest-risk assumptions RHTP-funded organizations make. Federal or state program funding, vendor reputation, and FDA clearance (where applicable) all address different questions than whether a tool performs on your patients. FDA clearance establishes substantial equivalence to a predicate device — it doesn't guarantee the tool works on rural populations that may not have been represented in the manufacturer's validation data. RUAIH guidance from the Joint Commission explicitly calls for local validation on your patient population. For RHTP-funded clinical tools, at minimum review a sample of the tool's outputs against your own cases before go-live and document what you found.

Which AI governance frameworks are actually feasible for under-resourced rural organizations?

Most frameworks were designed for large systems and require resources rural organizations don't have. Two are more feasible: the HAIRA Maturity Model, published in npj Digital Medicine in 2025, was explicitly designed because existing frameworks create barriers for smaller organizations — it defines five maturity levels and lets you identify achievable targets at Level 1 or 2. The AMA 8-Step AI Governance Toolkit scales to organizations of all sizes and includes a downloadable model AI policy. The AHA recommends a staged adoption approach: start with lower-risk administrative AI before advancing to clinical decision support. That sequencing lets you build governance capacity before the stakes are highest.

What does HTI-1 require us to do as a rural organization using certified EHR technology?

HTI-1 (effective January 1, 2025) requires your certified EHR vendor to disclose 31 source attributes for any predictive AI embedded in their system: the development process, fairness safeguards, external validation data, performance metrics, and maintenance schedules. As the organization deploying the tool, you aren't required to produce these disclosures — your vendor is. What you can and should do is request this documentation for any AI features running in your environment and use it as input to your own local validation and governance review. If your vendor can't or won't provide it, that's a vendor accountability gap worth addressing before deployment.

How does AI governance connect to Joint Commission accreditation for rural organizations?

The Joint Commission released guidance on responsible AI use in September 2025, establishing seven foundational elements. This guidance is formally advisory — there are no AI-specific accreditation standards tied to it yet. The Joint Commission's deeming authority under 42 CFR makes this guidance functionally significant regardless: JC accreditation is the mechanism most hospitals use to satisfy Medicare Conditions of Participation, which means the direction JC signals tends to matter before it becomes formally required. Reports from health systems that have undergone recent surveys indicate surveyors are asking about AI governance under existing Leadership and Performance Improvement categories. Rural organizations working toward the four governance elements described on this page are building toward the same expectations.

Sources

Brown, C. & Davis, J. "Gaps in AI Research for Rural Health: A Scoping Review." JAMIA, 2025. PMC12262758.
Frontera, F. et al. "Algorithmic Bias in Public Health AI." Frontiers in Public Health, 2025.
Chen, A. et al. "AI in Rural Healthcare Delivery: A Systematic Review." arXiv, 2024. arXiv:2508.11738.
Office of the National Coordinator for Health IT. "Hospital Trends in Use, Evaluation, and Governance of Predictive AI, 2023–2024." ONC Data Brief, 2025.
Kiteworks. "Healthcare AI Governance Gap: Visibility and Control in 2026." 2026.
Serchen, J. et al. "Leveraging AI to Advance Health Equity in the Safety Net." Journal of General Internal Medicine, 2025.
Office of the National Coordinator for Health IT. HTI-1 Final Rule. January 2024.
National Rural Health Association. "Breaking Down HTI-1 and the Future of Health IT." April 2025.
Healthcare Dive. "ASTP/ONC HTI-5 Proposed Rule on AI Model Cards." 2025.
HHS. "Request for Information: Accelerating the Adoption and Use of Artificial Intelligence." Federal Register, December 23, 2025. 2025-23641.
Bipartisan Policy Center. "Advancing Technology Innovation through the Rural Health Transformation Program." 2026.
Centers for Medicare and Medicaid Services. "Rural Health Transformation Program Overview." 2025.
Sittig, D. et al. "HAIRA: A Maturity Model for AI Governance in Healthcare." npj Digital Medicine, 2025.
American Medical Association. "STEPS Forward AI Governance Toolkit." 2025.
American Hospital Association. "Mobilizing Technology and Innovation to Support Rural Health." April 2025.
National Institute of Standards and Technology. AI Risk Management Framework 1.0. 2023.
Duke-Margolis Center for Health Policy. "AI Governance in Health Systems: Aligning Innovation, Accountability, and Trust." October 2024.
The Joint Commission and Coalition for Health AI. "Guidance on the Responsible Use of AI in Healthcare (RUAIH)." September 2025.

What AI Governance Do Rural Health Organizations Need When Implementing AI Through RHTP Funding?