AI policy template for an IME practice
Short version: copy the template below, replace every [bracket], and have the owner physician sign it before any file goes into an AI tool. It is written for an IME practice of 1 to 10 examiners, assigns each duty to a role instead of a committee, and has a 1-page version for solo examiners.
Limits: This site gives templates and a process, not legal advice. We read the rules it cites on 2026-11-12; your state, your requesters' contracts and your counsel decide what your practice must do.
What an IME AI policy has to settle
A policy earns its keep when someone asks a hard question: opposing counsel, a requester's auditor, a board investigator, or your own coordinator at 6 p.m. with a deadline. It has to answer 5 things in writing:
- Which tools may touch file content, on which plan, for which tasks.
- What nobody may do with AI, named plainly.
- How output is checked before it reaches a signed report, and by whom.
- What the examinee is told, and what the report says.
- Where each AI run is recorded, and how long the record is kept.
The template below answers all 5. Its structure follows the 4 functions of the NIST AI Risk Management Framework (govern, map, measure, manage), cut down to what a small practice can run without a governance committee.
The template: AI policy for an IME practice
Select the button to copy the whole policy as plain text, then paste it into your word processor.
[PRACTICE NAME]: policy on artificial intelligence in IME work
Version [1.0]. Effective [DATE]. Policy owner: [NAME], [ROLE]. Next review: [DATE, 6 months after effective date].
1. Scope
This policy covers every use of artificial intelligence (AI) software by anyone who works for [PRACTICE NAME], employed or contracted, on any part of an IME file: referral letters, records, exam notes, drafts, reports, addenda and correspondence. It covers tools we buy and AI features inside software we already use.
2. Principles
2.1 The examining physician forms and signs every opinion. AI output is an index or a draft, never a finding.
2.2 No AI tool receives file content unless it is on the approved tools list.
2.3 Every AI run on a case is logged.
2.4 We tell examinees that we use software, and the report says what the software did.
3. Approved tools list
3.1 [OFFICE MANAGER] keeps the approved tools list (Appendix A). For each tool it records: name, plan or edition, approved tasks, date the business associate agreement (BAA) was signed, the contract clause that bars training on our files, where files are stored and processed, deletion terms, date approved and approver.
3.2 A tool is added only after the BAA is signed by [OWNER], multi-factor sign-in is on for every account, and the tool has passed the closed-file test in section 8.
3.3 A new AI feature inside software already in use is a new tool and needs approval before anyone uses it.
4. Prohibited uses
4.1 Pasting, uploading, dictating or photographing file content into any tool not on the list, including free or personal chatbot accounts, browser extensions and phone apps.
4.2 Asking AI to form or suggest causation, apportionment, an impairment rating, an MMI date, work restrictions or a credibility conclusion.
4.3 Letting AI-generated text reach a signed report without the examining physician reading every sentence.
4.4 Listing a record as reviewed when only AI output about that record was read.
4.5 Using AI to create or change signatures, credentials, dates of service or exam findings.
4.6 Using examinee information to train, tune or test any tool, except under a written agreement signed by [OWNER].
5. Minimum necessary
Upload only what the task needs. Remove documents that belong to another examinee or another claim before upload. Do not upload exam audio unless a dictation tool is on the list for that task.
6. Checking output
6.1 The examining physician opens the source page for every fact the opinion relies on.
6.2 Dates, doses and laterality on handwritten, faxed or poor-quality pages are checked by hand.
6.3 When a tool reports that a record or event is absent, search the file a 2nd way before relying on the absence.
6.4 The person who checks the output initials the log entry. No report is signed while a log entry for that case is open.
7. Examinee notice
7.1 The written notice in Appendix B goes out with the appointment letter, and the short form is read at check-in before the history is taken.
7.2 Staff record in the log that the notice was given.
7.3 If an examinee objects, staff tell [OWNER] the same day. The file is then processed without AI tools, the requester is told if the deadline is affected, and the log records the objection.
8. Closed-file test before first use
Each new tool is tested on at least [3] closed files the examiner already reported on. Staff record every missed event, wrong date and wrong page citation. [OWNER] approves the tool only if each error found would have been caught by the checks in section 6.
9. Report disclosure
Reports use the methods wording in Appendix C, or stricter wording the examining physician chooses. Requester contract terms on AI take priority where they are stricter.
10. Log and retention
Every AI run is logged with the fields in Appendix D, and the log is kept with the case file. This policy, the approved tools list, training records and logs are kept for at least 6 years from creation or from the date last in effect, whichever is later, or longer where state record rules require.
11. Training
Everyone completes training on this policy before first use and once a year after. [OFFICE MANAGER] records the date and the version trained on.
12. Incidents
12.1 A prohibited use, a lost or misdirected AI output, or a wrong fact found in a signed report is an incident. Report it to [PRIVACY CONTACT] the same day.
12.2 [PRIVACY CONTACT] decides whether the incident is a breach that requires notice, and records the decision.
12.3 A wrong fact in a signed report is corrected by addendum, and the requester is told.
13. Requester terms
[OFFICE MANAGER] checks each requester contract and panel agreement for AI terms and adds them to Appendix A. The stricter term wins.
14. Review
[OWNER] reads the log every month for the first 3 months, then every quarter. This policy is reviewed every 6 months and whenever a tool, plan or vendor contract changes.
Approved by: [NAME], [TITLE]. Signature: ________ Date: ________
Appendices: A. Approved tools list. B. Examinee notice. C. Report methods wording. D. AI use log fields.
Solo examiner version (1 page)
If you are the whole practice, this shorter version covers the same ground. Keep it with your BAA.
[YOUR NAME], MD: how I use AI in IME work
1. I use only these AI tools with file content: [TOOL, PLAN, BAA SIGNED DATE]. Nothing from a file goes into any other tool.
2. AI organizes records and drafts from my notes. I form every opinion: causation, apportionment, impairment, MMI and restrictions.
3. I open the source page for every fact my opinion relies on, and I hand-check dates and doses on handwritten pages.
4. I list a record as reviewed only if I read it.
5. Examinees receive a written notice about software with the appointment letter, and I answer their questions at the exam.
6. My reports carry a methods sentence saying software organized the records and I reviewed the records my opinion relies on.
7. I log every AI run with the case number, date, tool, task and my check, and keep the log for at least 6 years.
8. I review this page every 6 months and whenever a tool changes. Signed: ________ Date: ________
How to fill in the brackets
| Placeholder | What to put | Watch out for |
|---|---|---|
| [OWNER] | The physician who owns the practice or the medical director | Someone with authority to sign a BAA and stop a tool |
| [OFFICE MANAGER] | The person who already keeps vendor contracts | In a solo practice this is you; say so |
| [PRIVACY CONTACT] | Your HIPAA privacy officer, or the owner if you have none | Must be reachable the same day |
| [3] closed files | The number of past files each tool is tested on | Pick files with handwriting, duplicates and a long timeline, not the easy ones |
| Review dates | 6 months is our default | Shorten it if your tools change plans often |
| Appendix A | 1 row per tool: name, plan, tasks, BAA date, training clause, storage, deletion, approver | Record the plan, not just the product; BAAs often cover only named plans |
Why each section is there
- Sections 2 and 4 (opinions stay human): the FSMB's April 2024 policy says the physician is ultimately responsible for AI use and that failing to apply human judgment to AI output breaches professional duties.
- Section 4.4 (reviewed means read): IME reports often list records reviewed, and in California workers' comp, Labor Code 4628(c) makes the physician review any record excerpts the physician did not make.
- Section 6 (checking): the FSMB policy says there must be documentation of how AI output was used. The log initials are that documentation.
- Section 7 (notice): AMA Opinion 1.2.6 asks examiners to disclose the third-party relationship before gathering information; the notice adds the software to that same conversation.
- Sections 10 and 11 (retention and training): HIPAA's security rule requires security training for all workforce members (45 CFR 164.308(a)(5)) and keeps required documentation for 6 years (45 CFR 164.316(b)(2)).
Gaps in policies copied from hospital templates
Hospital and clinic AI templates are a fine starting point, but they leave out the parts that make IME work different. When you adapt one, check for these:
- No examinee. They speak of "patients" in a treating relationship and consent to care. An examinee is not consenting to treatment, and the notice must say who the report goes to.
- No requester. They never mention the party who pays for and receives the report, or that party's contract terms on AI.
- No opinion boundary. They cover clinical decision support, not causation or apportionment, which is the core of IME work.
- A committee nobody has. A 3-person office cannot staff an AI governance committee. Assign each duty to a named role instead.
- No addendum rule. A file that comes back with new records gets a new AI run. The policy should treat it like a new file.
Next: put the policy to work with the staff workflow and the log template (Appendix D).