Building an Organization-Wide Healthcare AI Policy in Viet Nam: Defining Governed AI Tools, Permitted and Prohibited Uses, Approval, Exceptions and Review
PRACTICAL FRAMEWORKS & TOOLSGOVERNANCE & RISK
Building an Organization-Wide Healthcare AI Policy in Viet Nam: Defining Governed AI Tools, Permitted and Prohibited Uses, Approval, Exceptions and Review
PRACTICAL FRAMEWORKS & TOOLS
Last reviewed: 6 October 2026
As healthcare organizations begin using more AI, governance eventually reaches a practical question that committees, risk registers and monitoring dashboards cannot answer on their own: what are the organization's rules for AI?
A hospital may have a sophisticated governance committee but still leave frontline staff uncertain about whether they can use a public generative AI tool to summarize a clinical document. One department may assume that an AI feature included in an existing software subscription needs no further review. Another may start a free vendor pilot without realizing that patient data will leave the organization's environment. Clinicians may understand that AI requires human oversight but remain unclear about which uses are permitted, which require approval and which should not occur at all.
An organization-wide healthcare AI policy is intended to resolve that uncertainty. It should establish organizational boundaries, authority and minimum expectations for AI use without attempting to replace every detailed procedure required for procurement, validation, cybersecurity, clinical safety, incident management, monitoring or change control.
This organizational approach is increasingly reflected in international healthcare governance. Joint Commission's current voluntary Responsible Use of AI in Healthcare (RUAIH) certification assesses whether a healthcare organization has a written organization-wide health AI policy defining criteria for governed AI tools, permitted and prohibited uses, stakeholder review, alignment with existing policies, approval, dissemination and regular review [7]. RUAIH focuses on the responsible use and governance of AI by healthcare organizations rather than certification of individual AI products.
That direction builds on earlier Joint Commission-CHAI guidance, which defined health AI broadly across direct and indirect patient care, care-support services and care-relevant administrative and operational activities. The guidance also called for policies and procedures addressing AI review, implementation and use; ethical standards; safety and risk protocols; data use and privacy; equitable use and access; and alignment with other organizational policies and external regulatory and ethical frameworks [8].
For healthcare organizations in Viet Nam, however, an organization-wide AI policy should not simply reproduce a U.S. certification framework. It needs to operate alongside Viet Nam's AI, personal-data, healthcare, cybersecurity, medical-device, procurement, research and professional requirements.
The central policy question is therefore straightforward: what does our organization allow, require, restrict and prohibit when AI is used in or around healthcare?
An AI policy is not the entire AI governance system
A policy should establish authority, scope, principles, boundaries and mandatory expectations. It should not become a hundred-page document containing every validation methodology, procurement questionnaire, monitoring metric, incident-investigation form and technical security control.
A useful governance hierarchy is simple: policy defines what the organization requires and why; standards establish minimum requirements; procedures or SOPs explain how specific activities are performed; and tools or templates document that the process actually occurred.
For example, an organization-wide policy may require clinically consequential AI to undergo appropriate review before deployment. A separate procedure can explain who performs that review, which evidence is required and how approval is documented. A local-validation standard can specify minimum evaluation expectations, while an intake form captures the information needed to begin the process.
Trying to place all of these layers inside one policy usually creates a document that is difficult to understand and even harder to maintain. The policy should instead function as the top-level governance layer for AI, defining the boundaries within which more detailed governance processes operate.
An organization-wide AI policy is not currently a universal statutory requirement for healthcare organizations in Viet Nam
This distinction needs to remain explicit.
Law No. 134/2025/QH15 on Artificial Intelligence has been effective since 1 March 2026, while Decree No. 142/2026/NĐ-CP has been effective since 1 May 2026 [1,2]. The framework assigns responsibilities to AI providers, deployers and other actors according to system characteristics, risk and use. For high-risk AI, providers have responsibilities relating to risk management, data quality, technical documentation and logs, human supervision and intervention, transparency and incident management, while deployers have operational responsibilities relating to appropriate use, monitoring, risk controls and human intervention within their legal role.
Decision No. 33/2026/QĐ-TTg, effective since 15 August 2026, separately establishes Viet Nam's current List of High-Risk Artificial Intelligence Systems [3].
This legal framework creates important governance obligations, but it should not be presented as prescribing the specific organization-wide healthcare AI policy structure proposed in this article. The framework described here is an organizational mechanism for translating applicable legal requirements, patient-safety responsibilities and governance expectations into rules that staff can understand and apply consistently.
International frameworks such as Joint Commission RUAIH and CHAI's Governance Playbooks can inform that work, but they do not replace Vietnamese law. RUAIH remains a voluntary U.S. certification program [7].
Start by defining what the policy governs
One of the most difficult policy questions is deceptively simple: what counts as AI for the purpose of this policy?
If the definition is too narrow, important AI capabilities remain outside governance. If it is too broad, ordinary software may unnecessarily enter AI-specific processes.
A useful policy should focus on AI-enabled capabilities and uses, not only products explicitly marketed as “AI.” This may include standalone clinical AI, AI embedded in medical equipment, algorithms incorporated into enterprise software, generative AI assistants, clinical copilots, ambient documentation systems, predictive analytics, AI-enabled patient communication, administrative AI, agentic AI and internally developed systems.
Joint Commission-CHAI guidance similarly used a broad concept of health AI spanning direct and indirect patient care, care-support services and care-relevant operational or administrative activities [8]. That broad framing remains useful because AI does not need to diagnose a patient directly to influence healthcare quality or patient safety.
A scheduling algorithm may affect access to care. An AI coding system may change information used downstream. A generative documentation system may alter the medical record. An administrative AI agent may gain access to sensitive information or operational systems.
The policy should therefore define governed AI tools or uses according to their material effects on care, information, decisions, staff work, patients or healthcare operations rather than simply whether a vendor markets the product as AI.
The policy should define what sits outside full AI governance
Not every AI-enabled capability needs the same depth of review. An organization-wide policy should establish criteria for when formal AI governance applies and when a lighter pathway may be appropriate.
A low-consequence capability used to improve the formatting of non-sensitive internal administrative text, for example, may not warrant the same review as AI influencing diagnosis, patient communication or a clinical record. The organization may establish simplified pathways for limited-use cases while maintaining common baseline expectations around approved tools, confidentiality and responsible use.
The important point is that scope decisions should themselves be governed. Individual departments should not simply decide that their own AI is “too low-risk to count.” The organization needs agreed criteria and a route for resolving uncertainty.
This is also why current Joint Commission RUAIH explicitly asks healthcare organizations to define criteria for governed AI tools within their organization-wide policy [7].
Avoid recreating statutory risk classifications inside the policy
Viet Nam already has statutory AI risk classifications. Internal policy terminology should not unintentionally create a competing legal taxonomy.
An organization may use operational pathways such as standard review, enhanced review and comprehensive review, or similar categories, to determine how deeply a use case should be assessed. Staff should understand, however, that these internal pathways are not equivalent to the statutory low-, medium- or high-risk classifications under Vietnamese AI law.
The policy should make clear that statutory classification and internal healthcare risk assessment are related but separate. An AI system that is not legally classified as high-risk may still have substantial clinical consequences and therefore justify strong organizational oversight.
Permitted use should be defined positively, not only through prohibitions
Poor policies often consist almost entirely of statements beginning with “Do not.” Healthcare staff also need to know what responsible AI use actually looks like.
A policy can therefore identify permitted uses where AI has been approved and appropriate safeguards are in place. Depending on the organization, these might include approved clinical decision support within its intended scope, AI-generated documentation subject to defined human review, authorized administrative drafting or summarization, approved quality-analysis applications, research use within appropriate research and data-governance pathways, or AI-assisted patient communication under defined clinical and escalation controls.
Permission should nevertheless remain connected to conditions. A tool may be approved only for particular departments, patient populations, sites or purposes. Generative AI may be allowed to draft clinical documentation but not independently finalize it. A decision-support system may inform professional judgment but not independently initiate treatment. A system approved at one site may still be undergoing validation at another.
The policy should therefore avoid implying that approved tool = unrestricted use. Approval applies to a defined use under defined conditions.
Prohibited uses should address predictable high-risk behaviors
An organization-wide AI policy should define behaviors that the organization does not permit. The goal is not to anticipate every possible misuse, but to establish clear boundaries where risk is unacceptable or where AI use would bypass required governance.
Potential organizational prohibitions may include entering identifiable patient information into an unapproved external AI service; using personal accounts or unauthorized AI tools for clinical work involving sensitive information; allowing AI to perform actions beyond its approved authority; using AI outside an approved clinical purpose where the change could materially alter risk; deliberately bypassing required human review; knowingly placing fabricated AI-generated information into clinical documentation; attempting unauthorized re-identification of protected data; or deploying an unreviewed AI system directly into patient care.
These are organizational examples, not a universal statutory list under Vietnamese law. Prohibited uses should reflect the organization's actual technology, services, legal obligations and risk environment.
Policies should also avoid becoming overly dependent on product names. Technologies change quickly. Rules based on behaviors, data and conditions of use are generally more durable than long blacklists of individual applications.
Some AI uses should be conditional rather than simply permitted or prohibited
Healthcare AI rarely fits neatly into a binary allowed/not-allowed model.
A generative AI tool might be permitted to draft patient education material only after appropriate human review. A clinical model may be used only within the population and workflow for which it has been evaluated. A new AI capability added to an existing information system may be used only after appropriate change-control review. A research tool may be permitted only under the relevant research and data-governance arrangements.
An organization-wide policy can therefore distinguish permitted use, conditional use and prohibited use. These are organizational governance concepts, not statutory classifications.
Conditional use is particularly important in healthcare because safety often depends on context, supervision and workflow rather than on the AI system alone.
Unapproved AI and shadow AI need an explicit policy position
A policy that governs only officially purchased systems will miss an increasingly important risk: staff using AI that the organization has never reviewed.
Generative AI makes this particularly relevant. Clinicians, managers, administrative staff, trainees and students may have access to powerful public AI services without procurement, IT deployment or organizational authorization.
The policy should therefore tell staff what to do with unapproved or unknown AI. At minimum, people should know where to check whether a tool is approved, whether sensitive information may be entered and how to request review of a proposed new use.
The organization should avoid relying solely on prohibition because excessively restrictive policy can drive AI use underground. A functioning intake process is therefore part of effective policy implementation. Staff need a realistic way to ask: “I think this tool could be useful. How do I get it reviewed?”
This connects organization-wide policy with AI intake and triage instead of leaving policy as a passive document.
Approval authority should be explicit
A policy should answer a question that frequently causes confusion: who is allowed to approve AI use?
Approval authority may differ according to consequence and use. Lower-consequence administrative uses may be delegated within established criteria. Clinically consequential AI may require multidisciplinary review. High-risk systems may require involvement of legal, regulatory, technical, clinical and executive functions in addition to the statutory responsibilities of relevant actors.
The policy does not need to reproduce every committee workflow, but it should define decision authority and delegation and make clear what each decision actually authorizes.
Approval for vendor due diligence is not approval for purchase. Approval for offline validation is not approval for patient-facing clinical use. Approval for a controlled pilot is not approval for organization-wide scale.
These distinctions prevent authority from expanding informally as a project progresses.
Approval should attach to the use case, not merely to the product
The same AI platform can be appropriate for one purpose and inappropriate for another.
A generative application approved for internal administrative drafting is not automatically approved to generate discharge instructions. A foundation model incorporated into an approved documentation workflow is not automatically authorized for diagnostic reasoning. An analytics platform used for quality improvement is not automatically approved for autonomous communication with patients.
The policy should therefore state that materially new uses may require new review even when the underlying product has already been approved.
The same applies to vendor updates. An application originally deployed as an informational assistant may later acquire agentic capability, direct patient interaction or access to additional systems.
Product approval should not become a permanent blank cheque.
The policy should preserve professional judgment and define human-review expectations
Human oversight should not appear in a policy only through the statement “A human remains responsible.”
Where AI can materially affect care or clinical documentation, the organization should define what meaningful human review means in practice. Staff may be expected to review AI-generated clinical documentation before authentication, verify patient-specific information before acting, understand important system limitations, maintain independent professional judgment and escalate clinically important disagreement or uncertainty.
For high-risk AI, Viet Nam's AI framework establishes explicit responsibilities concerning human supervision and intervention. Providers must design high-risk systems so that human supervision and intervention remain possible, while deployers must establish and maintain appropriate human oversight and intervention during use in accordance with their legal role [1,2].
Organizational policy can translate these principles into practical staff expectations without suggesting that every AI system requires the same form of human review or that an internal policy itself determines legal liability.
The policy needs a clear position on patient data and confidential information
An AI policy should not simply tell staff to “protect privacy.” People need to know what that means in practice.
Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/NĐ-CP have both been effective since 1 January 2026 [4,5]. Decree No. 356 contains provisions specifically relevant to AI. Personal data used in AI research and development remain subject to personal-data protection requirements; information generated through AI inference must be protected where it can identify or help identify an individual; and automated personal-data processing can trigger notification, explanation and requirements to provide data subjects with options enabling them not to participate in that automated processing under the applicable framework [5].
The organization-wide AI policy should therefore establish a clear baseline: personal, sensitive, confidential or otherwise protected healthcare information may be processed through AI only through approved arrangements consistent with applicable law and organizational data-governance requirements.
Detailed rules concerning consent or other legal conditions, access controls, cross-border processing, applicable impact assessments, security architecture, retention and data sharing belong in specialized policies and procedures rather than being recreated in full inside the AI policy.
This is policy alignment rather than policy duplication.
Data reuse for model training should never be assumed
A related policy question concerns whether data entered into or generated through AI can later be used for model improvement, retraining, analytics, commercialization or development of new products.
Healthcare organizations should not assume that data used during care remain limited to the immediate clinical purpose unless contracts, technical configuration and governance actually establish that boundary.
Joint Commission-CHAI guidance emphasizes the importance of data-use restrictions, including permitted uses, data minimization, controls against re-identification, third-party obligations and audit rights. It also identifies model outputs, local performance data and data monetization as issues that healthcare organizations may need to address contractually [8].
An organization-wide policy can therefore establish the principle that secondary use of patient data, AI outputs or local performance information requires appropriate authorization and governance rather than being assumed as part of ordinary AI use.
Detailed contractual protections can then be implemented through procurement and data-use agreements.
Transparency and patient communication need policy-level principles
Not every AI use requires the same patient communication. An administrative scheduling algorithm and an AI system materially influencing a patient-facing clinical decision are not equivalent.
The policy should establish that the organization assesses whether AI materially affects a patient's care, information, choices, privacy or experience and determines appropriate transparency, communication or consent arrangements in that context.
Under Decree No. 142, transparency responsibilities must be implemented in a manner appropriate to the purpose of use, deployment context and level of risk. Providers and deployers also have obligations, where applicable, to provide information concerning the system's purpose of use, scope of application, conditions of use and limitations [2].
Joint Commission-CHAI guidance similarly recommends mechanisms for educating patients and families about AI, including notification where AI directly affects care when appropriate and consent where relevant [8]. Those recommendations are comparative international guidance, not Vietnamese legal requirements.
The organization-wide policy should establish the principle. Patient scripts, consent documentation and detailed communication procedures belong elsewhere.
The policy should require risk-proportionate review
One of the most important safeguards against unnecessary bureaucracy is proportionality. Every AI use should not require the same committee, evidence package or approval timeline.
CHAI's 2026 Governance Playbooks identify eight domains: AI Policy, Organizational Structures, Organizational Resources, Responsible AI Lifecycle Management and Use, Risk and Impact Assessments, Responsible Data Management and Use, Third Party Management, and Education, Training and Feedback [9]. The playbooks are intended to provide baseline controls that can be integrated into existing organizational processes and adapted to local context.
An organization-wide policy should therefore establish that governance is risk-proportionate.
The depth of review may increase with clinical consequence, autonomy, patient exposure, scale, reversibility, data sensitivity, uncertainty, vulnerability of affected populations, third-party dependence and difficulty detecting failure.
The policy does not need to define every scoring formula. It needs to establish the principle that governance intensity should reflect real-world consequence.
Monitoring requirements belong in the policy; metrics belong elsewhere
Joint Commission-CHAI guidance emphasizes ongoing, risk-based and context-appropriate monitoring and recommends using existing quality, patient-safety and compliance structures where possible [8]. Current RUAIH similarly assesses whether healthcare organizations monitor, evaluate and validate the safety and effectiveness of AI throughout its lifecycle [7].
An organization-wide policy should therefore require approved AI systems to have post-deployment monitoring appropriate to their risk and use.
The policy does not need to specify every performance metric or threshold. Those belong in system-specific monitoring plans.
At policy level, the important questions are who owns monitoring, whether an appropriate monitoring plan must exist before deployment, when findings require escalation and whether continued use depends on acceptable real-world performance.
Incident reporting and safety signals should have a policy route
The policy should establish that AI-related errors, near misses, unexpected behavior and potential safety concerns have a route into organizational learning.
Joint Commission-CHAI guidance recommends using existing safety structures where possible to capture AI-related harm and near misses and support learning [8]. Current RUAIH also assesses internal and external reporting processes for health-AI safety-related events [7].
The AI policy should not reproduce an entire incident-management SOP. It should establish that AI-related safety signals are reported through approved pathways and should not remain hidden within IT tickets or vendor support conversations where healthcare quality or patient safety may be affected.
Formal statutory reporting obligations under Vietnamese AI law operate separately when the relevant legal threshold is reached. Internal organizational reporting should generally begin at a lower threshold to support early learning.
Training should be a policy requirement, not an optional implementation activity
People using or overseeing AI need competencies appropriate to their roles.
Joint Commission-CHAI guidance recommends both general AI literacy and use-case-specific, role-specific education and states that staff should know where to access relevant system information and organizational AI policies [8]. RUAIH now assesses education and training as a core component of responsible organizational AI use [7].
The policy does not need to contain the full training curriculum. It should require appropriate training and competency before particular AI uses and recognize that retraining may be necessary when the system changes, responsibilities change or important safety findings emerge.
Completing a generic annual AI course should not automatically be treated as evidence that someone is competent to use every AI system.
Exceptions need governance, not informal permission
No policy can anticipate every legitimate circumstance. Healthcare organizations therefore need a controlled exception process.
An internal exception might be justified for a controlled evaluation, research activity, time-limited technical circumstance or another legitimate reason. Exceptions should be visible, justified, time-limited and governed.
A useful process should identify who can approve an exception, why it is necessary, which organizational controls are being modified, what compensating safeguards apply, how long the exception remains valid and what further review is required.
The policy should also make clear what an internal exception cannot do. It cannot waive Vietnamese law, remove statutory obligations, bypass research-ethics requirements where they apply or eliminate professional duties.
An exception is authority to deviate from an organizational rule within delegated authority. It is not permission to disregard external requirements.
Time-sensitive situations need a defined expedited internal pathway
Healthcare settings can face circumstances in which the ordinary internal review process cannot be completed within the desired timeframe.
Where an organization permits expedited internal governance review in such circumstances, the policy should define the pathway rather than leave staff to improvise. It may specify who can authorize temporary use, which minimum safeguards remain mandatory, how the decision is documented, when retrospective review occurs and when temporary authorization expires.
An expedited internal pathway should not be described as a general legal emergency-use exemption. It does not waive applicable AI regulation, medical-device requirements, data-protection obligations, research-ethics requirements or professional responsibilities.
Defining the pathway in advance nevertheless strengthens governance by removing a common justification for bypassing internal controls entirely: “There wasn't enough time.”
Research and quality improvement should link to the appropriate governance pathways
AI may be used for research, local validation, quality improvement or service evaluation. The organization-wide AI policy should recognize these activities but should not attempt to determine their research-ethics status by itself.
Instead, the policy should require AI-related activities to enter the appropriate research-governance, ethics, quality-improvement and data-governance pathways according to their purpose and design.
Calling an activity a “pilot,” “validation” or “quality-improvement project” does not by itself decide whether formal research oversight applies.
At policy level, the routing principle can remain simple:
AI activity identified → applicable governance pathway determined → required review or approval obtained before the authorized use begins
Internally developed AI should not receive lighter governance simply because there is no vendor
Healthcare organizations sometimes apply rigorous review to purchased AI while treating internally developed models as innovation projects controlled by trusted colleagues. That creates an inconsistent risk model.
Internally developed AI can create the same clinical, privacy, cybersecurity, fairness, workflow and monitoring concerns as third-party systems. Joint Commission-CHAI guidance expressly envisioned governance covering third-party, internally developed and AI-embedded tools [8].
The policy should therefore make clear that governance follows the capability and use, not the commercial source.
The evidence available may differ between an internal model and a commercial product, but governance should not disappear because there is no vendor.
Embedded AI and vendor updates need policy coverage
Many healthcare organizations will not consciously decide to “buy another AI system.” AI functionality will increasingly arrive inside software and devices already in use.
A vendor may add generative functionality, predictive capabilities or an AI agent through an upgrade. A medical device may receive new algorithmic functionality. An EHR module may begin summarizing, prioritizing or generating clinical information.
The policy should therefore require material new AI functionality to enter appropriate governance and change-control review.
For high-risk AI systems, Viet Nam's lifecycle framework also recognizes that significant changes can affect previous risk, classification or conformity assumptions. Depending on the circumstances, significant changes may require the provider to reassess conformity, while modifications, integrations or changed use by a deployer that create new or higher risk may require coordination with the provider on classification and risk management [1,2].
Not every routine software update requires a new full review. But a material change in capability, intended use or operating conditions should not automatically inherit approval from the previous version.
The policy should define when AI use must pause
Policies often describe how technologies are approved but say little about who can stop them.
An organization-wide AI policy should establish authority for appropriate leaders or governance functions to restrict, suspend or withdraw AI use where necessary.
Potential triggers may include serious safety concerns, unexpected performance deterioration, critical cybersecurity problems, unacceptable data-quality failures, major unreviewed changes, unresolved regulatory concerns or inability to maintain meaningful human oversight.
The detailed process belongs in a procedure, but the policy should establish the principle and decision authority.
Governance becomes fragile when many people can approve technology but nobody is clearly empowered to pause it.
Policy alignment is as important as policy content
A healthcare AI policy should not become an isolated document.
Joint Commission-CHAI guidance recommends alignment with related internal policies and external regulatory and ethical frameworks [8]. Current RUAIH also assesses alignment between the organization-wide AI policy and existing organizational policies [7].
For hospitals in Viet Nam, this integration should include existing healthcare quality-management structures. Circular No. 19/2013/TT-BYT remains recorded as in force and provides an established framework involving organizational quality responsibilities, quality indicators and continuous quality improvement [6].
Relevant internal documents may also include policies or procedures concerning patient safety, medical records, personal-data protection, cybersecurity, procurement, vendor management, research ethics, staff conduct, patient communication, business continuity and incident management.
The AI policy should identify those relationships rather than duplicate their entire content. For example, the AI policy might establish that only approved AI may process patient information; the data-protection framework defines detailed processing requirements; cybersecurity standards define technical safeguards; procurement procedures define vendor due diligence; and AI monitoring procedures define system-specific measures.
That creates an integrated governance architecture rather than several competing sets of rules.
The policy needs an owner
A policy without ownership eventually becomes static.
The organization should assign responsibility for maintaining the AI policy and coordinating updates. This may sit within an AI governance body, clinical governance function, quality and patient-safety structure, digital-health leadership or another appropriate organizational function.
Ownership does not mean that one department controls every AI decision. It means someone is accountable for ensuring that the policy remains current, is periodically reviewed and remains aligned with actual organizational practice.
Joint Commission-CHAI guidance similarly calls for formal governance structures, appropriate expertise and regular updates to organizational leadership on AI use and outcomes [8].
The policy needs scheduled and event-driven review
Annual review alone may not be sufficient in a rapidly changing field.
An organization can establish a regular review cycle while also identifying events that trigger earlier reconsideration. These may include changes in Vietnamese law or regulation, serious AI-related incidents, major changes in organizational AI strategy, introduction of agentic or increasingly autonomous functionality, material vendor changes, recurring policy exceptions or lessons from monitoring.
CHAI's Governance Playbooks similarly treat AI policy as part of a broader governance system that should be integrated into organizational processes and adapted as context and risk evolve [9].
The objective is a policy stable enough to guide everyday decisions but flexible enough to remain relevant.
Staff need access to the policy in a usable form
Publishing an AI policy on an internal portal does not mean it has been implemented.
Staff need the parts relevant to their roles. Clinicians may need concise guidance on approved clinical uses, human-review expectations and safety reporting. Administrative teams may need straightforward rules concerning generative AI and confidential information. Procurement staff need AI-intake requirements. IT teams need change-control expectations. Executives need escalation and oversight rules.
The authoritative policy can remain one document while training, decision aids and role-specific guidance translate it into everyday work. Joint Commission-CHAI guidance similarly states that users should know where to access information on AI systems and organizational AI policies [8].
A policy people cannot find, understand or apply is not a strong control.
Do not measure policy quality by its length
A thirty-page AI policy is not necessarily stronger than a five-page policy. More useful questions are whether staff can identify which AI uses are governed, which tools and uses are permitted, what is prohibited, when approval is required, where new AI should enter intake, who has decision authority, how exceptions are governed, who can suspend unsafe AI, how the policy connects with privacy and patient safety, and whether everyday practice matches what the policy actually says.
That final question matters most. A policy that exists only on paper is not evidence of functioning governance.
A practical Organization-Wide Healthcare AI Policy Framework
Healthcare organizations in Viet Nam can structure an organization-wide AI policy around 14 core elements:
Purpose and principles: why AI is governed and the principles guiding responsible use.
Scope and definitions: which AI capabilities, people, sites and activities fall within the policy.
Governed AI criteria: which uses require formal governance and how uncertain cases are routed.
Permitted, conditional and prohibited uses: organizational boundaries for acceptable AI use.
Approval and decision authority: who may authorize different uses and what approval actually permits.
Data and confidentiality principles: baseline requirements for personal, sensitive and organizational information.
Human oversight and professional judgment: expectations for appropriate human review and intervention.
Transparency and patient communication: principles for determining when patient-facing communication or further assessment is needed.
Risk-proportionate review and lifecycle governance: connections to intake, validation, monitoring, change control and safety reporting.
Training and competency: expectations for role-appropriate education and preparation.
Exceptions and expedited pathways: how justified deviations from internal rules are approved and controlled.
Restriction, suspension and withdrawal: authority to act when continued use is unsafe or inappropriate.
Related policies and procedures: how AI governance connects with existing organizational systems.
Ownership, dissemination and review: responsibility for policy implementation, communication and revision.
This Organization-Wide Healthcare AI Policy Framework is proposed here as a practical organizational structure. It is not an official Vietnamese policy template, a statutory requirement, Joint Commission policy text or a CHAI policy template.
A simple document architecture can prevent policy overload
The organization-wide AI policy can sit at the top of a supporting architecture that may include an AI governance standard, AI intake and triage procedure, risk and impact assessment process, clinical validation standard, monitoring and assurance procedure, AI safety-event procedure, change-control procedure, vendor and third-party standard, generative-AI staff-use guidance, and relevant data and privacy requirements.
This keeps the main policy understandable while allowing specialized controls to evolve more rapidly.
A smaller specialty clinic does not need the same document architecture as a large tertiary hospital group. Governance documentation should remain proportionate to organizational scale, complexity and AI exposure.
What this means for healthcare organizations in Viet Nam
As AI spreads through healthcare, organizations will increasingly face a governance problem that individual project approval cannot solve. Staff need common rules. They need to know whether a tool is approved, whether patient information can be entered, whether AI output requires human review, which uses are prohibited, who approves exceptions and what to do when a new AI capability appears inside software already in use.
Leadership also needs consistency. Without an organization-wide policy, individual departments may develop different assumptions about acceptable AI use. Procurement may apply one standard, clinical teams another, IT another and research teams another. That fragmentation becomes increasingly risky as AI scales.
The purpose of an organization-wide healthcare AI policy is therefore not to slow innovation or turn every interaction with AI into a compliance exercise. It is to create clear boundaries within which responsible innovation can occur.
The practical progression is:
from scattered AI rules → to one organization-wide policy → to role-specific standards and procedures → to consistent decisions → to evidence that the policy actually works in practice
A useful policy should help staff answer ordinary questions before something goes wrong: Can I use this tool? Can I enter this information? Can I rely on this output? Who needs to approve this use? What should I do if the AI behaves unexpectedly? Who has authority to stop it?
When those questions have clear answers, policy becomes more than a document. It becomes part of the organization's infrastructure for responsible healthcare AI, healthcare quality and patient safety.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, procurement, employment, cybersecurity, data-protection, medical-device, research-ethics, accreditation or quality-management advice.
The Organization-Wide Healthcare AI Policy Framework described in this article is a practical organizational governance framework proposed for healthcare organizations in Viet Nam. It is not a policy mandated in this form by Vietnamese law, an official Ministry of Health policy template, a Joint Commission policy or a CHAI template.
Joint Commission RUAIH and Joint Commission-CHAI materials are used as international organizational reference points. RUAIH is currently a voluntary U.S. certification program and does not create legal requirements for healthcare organizations in Viet Nam.
The terms permitted use, conditional use and prohibited use, as used in this article, are organizational policy concepts and should not be confused with statutory AI risk classifications or other legally defined categories.
Internal organizational policy cannot waive or override obligations under Vietnamese law. Applicable requirements depend on the AI system, intended use, legal role of the organization and other actors, patient and data context, deployment environment and other relevant circumstances.
References
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
Government of Viet Nam. Decree No. 356/2025/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Personal Data Protection. Issued 31 December 2025; effective 1 January 2026.
Ministry of Health of Viet Nam. Circular No. 19/2013/TT-BYT Providing Guidance on Management of Quality of Medical Examination and Treatment Services in Hospitals. Issued 12 July 2013; effective 15 September 2013; currently recorded as in force.
Joint Commission. Responsible Use of AI in Healthcare Certification. Launched 1 June 2026.
Joint Commission and Coalition for Health AI (CHAI). Guidance on the Responsible Use of AI in Healthcare (RUAIH). Initial high-level guidance, released 17 September 2025.
Coalition for Health AI. AI Governance Playbooks. Released 27 May 2026.