Editor’s note: The following article is not intended to substitute for legal advice. Practices are encouraged to seek input from counsel as needed for this and other matters of compliance.

Some AI vendor contracts limit the vendor's liability to the fees paid over the previous 12 months. Healthcare attorney Tatiana Melnik, JD, asked attendees at the 2026 MGMA Annual Conference to consider what happens after a contract ends. If the vendor retains patient data and a breach surfaces three years after termination, a cap tied to fees paid in the previous year could leave the practice with nothing to recover from the vendor.

“If the issue happens three years after the contract ends, their damage is zero,” Melnik said during the “Privacy and Security Legal Issues in the Age of Artificial Intelligence” session, “while you as the covered entity remain responsible and liable for that misuse. You always carry that burden.”

MGMA’s 2026 polls show how far AI use has outpaced formal practice policies. In August, 83% of medical groups said they use AI in some part of the patient visit, up from 71% a year earlier.¹ In January, 20% had AI governance or a formal AI-use policy, 22% were developing one and 56% had neither.²

Decide who decides

Michael J. Ducsak, CISSP, chief information security officer at Anatomy IT, focused his session on practices without a dedicated IT department. He addressed questions administrators routinely face: Can we use ChatGPT? What about Copilot? Can staff use AI safely? And, as his slides put it, are they already using it?