Governing Clinical AI Across Organizational Boundaries in Viet Nam: Clinical Handoffs, Outsourced Diagnostics and Patient-Safety Accountability
IMPLEMENTATION INSIGHTS
Governing Clinical AI Across Organizational Boundaries in Viet Nam: Clinical Handoffs, Outsourced Diagnostics and Patient-Safety Accountability
IMPLEMENTATION INSIGHTS
Last reviewed: 8 October 2026
A healthcare organization may carefully evaluate and govern the AI systems used within its own facilities. Yet patient care often involves clinical information, diagnostic services and professional decisions that extend beyond the boundaries of a single organization.
Consider a patient who undergoes diagnostic imaging at an external imaging center. An AI application highlights a potentially important abnormality, and a radiologist reviews the examination before issuing a report to the referring clinic. The report is transmitted electronically, but the patient's treating physician has already finished the working day. The result becomes available in the clinic's information system, although nobody has been clearly assigned to review it or arrange follow-up.
The AI may have identified a relevant finding. The radiologist may have completed the examination, and the imaging center may have transmitted the report successfully. Yet the patient may still experience a delay because responsibility for the next step was not clearly managed between the two organizations.
This illustrates an important challenge in responsible healthcare AI implementation: When AI contributes to care delivered across several organizations, patient safety depends not only on the performance of each participant but also on how clinical information, decisions and responsibilities move between them.
Healthcare organizations may already have procedures for outsourced diagnostics, referrals, consultations and remote care. Introducing AI does not necessarily replace those arrangements, but it can change how information is generated, prioritized, interpreted and communicated.
The central question is therefore not simply whether an external AI system is reliable or whether a technology provider meets its contractual obligations. It is whether the organizations involved can maintain safe clinical care when AI-supported information and related responsibilities cross their institutional boundaries.
Why organizational boundaries create additional patient-safety risks
Healthcare quality and patient-safety systems are generally organized around individual facilities. Each hospital or clinic has its own clinical leadership, workforce, information systems, policies and reporting processes.
Patients, however, may receive care from several organizations during the same episode of illness. A clinic may refer a patient for imaging, send specimens to an external laboratory, request specialist advice from another hospital or arrange remote consultation when particular expertise is unavailable locally.
AI can become involved at different points in these arrangements. An external imaging provider may use AI to identify suspicious findings. A pathology service may use AI-assisted image analysis. A remote specialist may review AI-generated information alongside clinical records. A technology company may operate the platform through which results and notifications are exchanged.
Each participant may have its own governance arrangements, but these arrangements do not automatically create a coordinated approach to patient safety.
One organization may consider its task complete when a report has been issued. Another may assume that urgent findings will be communicated directly. A technology provider may regard successful electronic transmission as completion of its service, even when the receiving clinician has not reviewed the information.
The problem is not necessarily that an individual participant has failed to follow its own procedures. It may be that the procedures do not adequately connect.
Cross-organizational clinical AI governance addresses this gap by examining how accountability, clinical information and patient-safety responsibilities are maintained when AI-enabled care involves independent organizations.
This is different from governing several AI systems within one hospital. It is also different from managing a technology supplier's cybersecurity, commercial obligations or contractual data rights. The focus is on the safety of clinical activities and responsibilities that extend across organizational boundaries.
Different participants have different clinical and legal responsibilities
Before assessing a cross-organizational AI arrangement, healthcare leaders need to understand what each external participant actually does.
An external laboratory performing diagnostic examinations has a different role from a software company providing an AI application. A hospital offering specialist consultation has different responsibilities from a cloud provider hosting the technology.
These distinctions matter because professional duties, organizational responsibilities and applicable legal requirements depend on the nature of the activity.
An external diagnostic provider may be responsible for performing examinations, interpreting findings and issuing reports within its authorized professional scope. The referring healthcare organization must still consider how those results are received, assessed and incorporated into the patient's continuing care.
A technology provider may be responsible for developing, maintaining or operating an AI system, including relevant technical safeguards. However, supplying a clinical AI platform does not, by itself, authorize that company to provide regulated medical examination, diagnosis or treatment services.
Remote specialist support creates another arrangement. One organization may provide professional consultation while another remains responsible for directly examining and treating the patient.
Patient referral is different again. When a patient moves between healthcare organizations, the responsibilities associated with the services being provided may change. The sending and receiving organizations therefore need to understand what information accompanies the referral and how unresolved clinical concerns are communicated.
Organizations should avoid treating all these arrangements as a single category of outsourced AI.
A useful starting question is: Is the external party providing technology, diagnostic services, professional consultation, direct patient care or a combination of these functions?
The answer helps identify which legal and professional responsibilities apply and where additional patient-safety safeguards may be necessary.
What Viet Nam's current healthcare law means
Viet Nam's Law No. 15/2023/QH15 on Medical Examination and Treatment, as amended, provides an important foundation for understanding professional responsibility when clinical care involves several organizations [1].
Article 64 addresses clinical consultation. It recognizes consultations within healthcare organizations, between healthcare organizations in Viet Nam and between domestic and foreign healthcare organizations. Consultations may be conducted directly or remotely. The Law requires consultation results to be documented and retained in the medical record and provides that the practitioner directly examining and treating the patient makes appropriate diagnostic and treatment decisions based on those results [1].
This distinction is relevant when AI-generated information forms part of an external specialist consultation. Such information may contribute to clinical decision-making, but it does not automatically replace the responsibilities assigned by law to the practitioner directly treating the patient.
Article 80 makes another important distinction between remote medical examination and treatment provided directly by a practitioner to a patient and remote support between healthcare organizations [1].
For practitioner-to-patient remote care, activities must remain within the practitioner's authorized scope of practice, while remote treatment is subject to the applicable list of diseases and conditions. The practitioner is responsible for their own diagnosis, treatment decisions and prescriptions.
For remote support between healthcare organizations, Article 80 provides that the practitioner directly examining and treating the patient at the supported facility remains responsible for the results of their own examination and treatment [1].
These provisions should not be interpreted as automatically eliminating the professional, organizational or contractual responsibilities of the supporting organization. The relevant duties must be considered according to the legal role and activities of each participant.
Decree No. 96/2023/NĐ-CP, as amended where applicable, provides more detailed requirements. Article 87 addresses the conditions and procedures for remote medical examination and treatment, while Article 88 addresses remote support between healthcare organizations [2].
Under Article 88, the organization providing remote support must operate within its authorized professional scope. A service contract is required and must address matters including the rights and responsibilities of participating facilities, technical infrastructure, information security, data storage and backup, and service costs.
The Decree also provides that patients must receive information about the remote support service during their care. Organizations providing remote support are responsible for performing the agreed service and submitting annual reports to the relevant management authority in accordance with the applicable provisions [2].
These are legal requirements for arrangements falling within the relevant provisions, not merely optional governance recommendations.
Circular No. 49/2017/TT-BYT on telemedicine activities also remains recorded as in force. Its scope includes remote medical consultation, diagnostic imaging consultation, pathology consultation and other specified activities. Its application must be considered together with the later Law on Medical Examination and Treatment and relevant implementing regulations [3].
Not every externally delivered diagnostic service or technology arrangement is automatically classified as remote medical examination, treatment or support under these provisions. The actual service model must be assessed before determining which requirements apply.
Article 71 of the Law on Medical Examination and Treatment also establishes a broader foundation for preventing medical incidents through identification, reporting, analysis of causes and preventive measures. Circular No. 19/2013/TT-BYT continues to provide a framework for hospital quality management [1, 4].
Together, these provisions support a systems-oriented approach to patient safety. They do not, however, establish a universal clinical AI accountability framework for every cross-organizational service arrangement.
Viet Nam's AI legislation adds another layer of responsibility
Viet Nam's Law No. 134/2025/QH15 on Artificial Intelligence has been effective since 1 March 2026. Article 4 establishes human-centred principles, including that AI should serve people rather than replace human authority and responsibility. It also emphasizes human control, accountability and the ability to intervene in AI-supported activities [5].
Article 6 requires stricter risk management appropriate to essential sectors that directly affect life, health and other protected interests. For healthcare, the Law specifically refers to patient safety, reliability under real-world conditions and protection of health data [5].
Decree No. 142/2026/NĐ-CP, effective since 1 May 2026, provides further requirements concerning AI risk classification, conformity assessment, transparency, incident management and the responsibilities of relevant participants [6].
These requirements may apply differently to AI providers and deployers. A healthcare organization purchasing an AI-enabled service should therefore understand whether it is deploying an AI system, receiving a service that uses AI or participating in another arrangement with different regulatory implications. The actual legal role should be assessed from the activities performed, not simply from the commercial description of the service.
Decision No. 33/2026/QĐ-TTg, effective since 15 August 2026, establishes Viet Nam's current list of high-risk AI systems. Its healthcare-specific entries concern defined AI-assisted surgical and robotic-surgery systems meeting particular conditions [7].
Many other AI applications used in outsourced diagnostics, specialist consultations or referrals may fall outside those healthcare-specific entries. This does not establish that they carry little clinical risk or that organizations can disregard patient-safety responsibilities.
Where AI-enabled software or equipment is regulated as a medical device, the applicable medical-device framework must also be considered separately, including Decree No. 98/2021/NĐ-CP, as amended, and Circular No. 24/2026/TT-BYT where relevant [8, 9].
These legal frameworks should be applied according to the actual technology, service model and responsibilities involved. AI risk classification and medical-device classification are separate regulatory considerations and should not be treated as interchangeable.
A contractual allocation of tasks cannot automatically remove responsibilities established by law. Equally, the participation of several organizations in one clinical process does not mean that every participant has identical duties or legal liability.
The practical objective is to make each participant's responsibilities sufficiently clear that important clinical decisions and patient-safety actions do not become unmanaged between organizations.
Clinical accountability is not the same as contractual completion
A common weakness in cross-organizational arrangements is the assumption that responsibility has been adequately managed because the parties have signed a service agreement.
Contracts are important. In some service models, they are legally required. They can establish service scope, operational responsibilities, communication arrangements, access to information and procedures for handling problems.
However, completing a contractual task does not necessarily mean that all related clinical responsibilities have been fulfilled.
An external imaging provider may have performed an examination, completed professional interpretation and issued a report. Yet the patient's treating clinician may still need to review the result, explain its significance and decide whether further investigation or treatment is necessary.
Conversely, the referring organization should not assume that it must independently repeat every professional activity appropriately performed by the external provider. The external organization remains responsible for the clinical work and professional duties applicable to its role.
The allocation of responsibility depends on the service model, professional scope, organizational licensing, applicable law, agreed arrangements and circumstances of the individual case.
For practical governance, organizations should distinguish responsibility for producing clinical information, communicating important findings, interpreting information in the patient's wider clinical context and arranging subsequent care.
These responsibilities may belong to different professionals or organizations. The objective is not to designate one participant as universally responsible for everything. It is to prevent important responsibilities from remaining unclear or being assumed to belong to someone else.
Outsourced diagnostics: when a report crosses organizational boundaries
Outsourced diagnostic services provide a useful example because diagnostic information may influence immediate treatment, further investigation or referral.
Consider a patient referred by a clinic for an AI-assisted imaging examination. The patient is registered at the external diagnostic center, the examination is performed, AI may contribute to image analysis, a radiologist interprets the findings and the final report is returned to the referring clinic.
The clinic must then decide whether additional assessment, treatment or referral is necessary.
This apparently straightforward process contains several clinically important handoffs. The referring clinic needs to provide sufficient clinical information. The imaging provider must correctly identify the patient and examination. The diagnostic result must reach the appropriate recipient, and important findings must be communicated according to their clinical significance and urgency.
Introducing AI may add further questions. Does the AI produce a preliminary finding or information incorporated into the final professional report? Can an AI-generated flag trigger additional professional review before the report is finalized? Does the receiving clinician understand whether the information has been reviewed by a qualified professional?
An external imaging or pathology provider may use AI as part of its internal workflow while sending only the final professional report to the referring organization. This may be entirely appropriate. The referring clinician does not necessarily need access to every intermediate algorithmic output.
However, the organizations should understand how important AI-supported findings are managed, particularly when they may affect the urgency of communication.
For example, an AI application may flag a possible serious abnormality before the radiologist completes the formal report. The diagnostic provider needs an appropriate process for determining whether immediate professional review or communication is warranted.
The referring organization should understand whether urgent findings will be communicated through the ordinary reporting system or a separate escalation process. The arrangements should also account for weekends, after-hours reporting and situations in which the original referring clinician is unavailable.
The distinction between preliminary AI output, professional interpretation and finalized diagnostic report must remain clear.
AI-generated findings should not be presented as independently confirmed clinical diagnoses unless the relevant evidence, intended use and professional assessment support that conclusion.
The same issue arises when reports are amended. A radiologist may revise a report after additional review or identify a significant discrepancy between the preliminary and final interpretation. The receiving organization needs a reliable way to recognize the amendment and determine whether previous clinical decisions should be reconsidered.
A report may be delivered successfully through an electronic interface while still failing to support safe care if the responsible clinician does not know that an important finding requires attention.
For clinically significant results, organizations should therefore distinguish report transmission, receipt, professional review and necessary follow-up within their agreed processes.
The purpose is not to duplicate every diagnostic activity. It is to ensure that the result produced by one organization can be used safely and appropriately by another.
Referrals and remote consultations require clear professional roles
Patient referral creates another type of organizational boundary.
A patient may be referred because the current healthcare facility lacks a particular diagnostic capability, specialist service or treatment resource. AI may influence the urgency of referral, help identify suspected conditions or provide information included in the referral documentation.
However, forwarding a referral document should not automatically be treated as completion of every related clinical responsibility.
The sending organization should determine what relevant information needs to accompany the patient, including important findings, unresolved concerns and the urgency of the requested service. The receiving organization needs enough information to understand the reason for referral and determine the appropriate response within its own responsibilities.
Where AI-generated information materially influences referral urgency or clinical management, its status should be understandable. A prediction, preliminary finding or automated recommendation should not be mistaken for a confirmed professional diagnosis.
A particularly important question concerns patients who do not complete a recommended referral. Where a clinician identifies a potentially serious concern and recommends urgent specialist assessment, the sending organization should consider what communication and follow-up arrangements are appropriate under its legal and clinical responsibilities.
This does not mean that the sending organization automatically remains responsible for every aspect of subsequent care. The relevant responsibilities depend on the clinical circumstances, the referral arrangement and applicable law.
Remote consultation requires similar attention to professional roles, but the applicable legal arrangements may be different.
Consider a healthcare facility seeking specialist support from a larger hospital. The local practitioner may transmit clinical information, laboratory results or imaging, some of which may have been generated or analyzed with AI assistance.
The remote specialist may provide an opinion based on the available information. The practitioner directly caring for the patient must then determine how that opinion should inform diagnosis and treatment, consistent with the applicable legal framework and professional responsibilities.
The participating organizations should clarify whether the service involves direct patient care, clinical consultation or professional support between healthcare facilities.
They should also identify who verifies the patient's identity, confirms the relevant clinical information, documents the consultation, communicates urgent recommendations and manages subsequent care.
Remote specialists may have limited access to the full clinical record or may be unable to examine the patient directly. AI-generated summaries and risk estimates may be useful, but they can omit information relevant to professional judgment.
Organizations should therefore avoid assuming that remote access to an AI-supported information platform provides the same clinical context as direct patient assessment.
Where foreign healthcare organizations or practitioners participate, additional questions concerning professional authorization, service scope, applicable law and international data transfers may arise. These require assessment according to the actual arrangement.
Clinical information must retain its meaning and traceability
Information can change meaning as it moves between organizations.
An AI-supported diagnostic report may appear complete when viewed in isolation, but its clinical significance depends partly on the information available when it was generated.
An AI model may analyze images without access to the patient's relevant history. A remote specialist may review laboratory results without knowing that the patient's condition has changed. A referring clinic may receive a summary that omits an important limitation recorded during the original examination.
These problems are not unique to AI, but AI can increase the speed and scale at which incomplete or incorrectly contextualized information is processed and communicated.
Cross-organizational governance should therefore consider whether the receiving professional has enough information to interpret the result appropriately.
Relevant context may include the patient's identity, clinical indication, examination date, important prior findings, limitations of the examination and status of the diagnostic interpretation.
Where AI-generated information materially influences a result, additional information may be needed about what the AI output represents, whether professional review occurred and whether any limitations affect its clinical use.
Patient identification is particularly important. An incorrectly associated image, specimen or clinical record can create serious risks when AI-generated findings are transmitted to another organization.
The Law on Medical Examination and Treatment includes requirements concerning medical records, confidentiality and the use of patient information [1]. Circular No. 13/2025/TT-BYT, effective since 21 July 2025, provides guidance on the implementation of electronic medical records [10].
For cross-organizational AI use, healthcare organizations should be able to identify the source and status of clinically important external information. Reports should be attributable to the relevant provider and professional where applicable. Significant amendments should be identifiable, and important consultations and resulting decisions should be documented according to applicable requirements.
This does not mean every intermediate algorithmic output must be copied into the patient's medical record. Documentation should reflect clinical significance, legal requirements and approved organizational processes.
The practical objective is to prevent important AI-supported information from losing its context or becoming indistinguishable from professionally confirmed findings when that distinction matters to patient care.
Patient data protection must support safe information exchange
Cross-organizational care often requires the exchange of sensitive patient information.
Viet Nam's Law No. 91/2025/QH15 on Personal Data Protection and Decree No. 356/2025/NĐ-CP have been effective since 1 January 2026 [11, 12].
When patient information is shared with an external diagnostic provider, remote healthcare organization or technology service, the participating organizations must determine the applicable legal basis, responsibilities and safeguards for processing personal data.
Relevant considerations may include the purposes of processing, the roles of participating parties, access permissions, confidentiality, security, retention and the handling of data-subject rights.
Where consent is legally required, appropriate consent arrangements must be considered. However, not every lawful healthcare data exchange necessarily follows the same consent mechanism. The applicable legal basis, requirements and any relevant exceptions must be examined in context.
Organizations should also determine whether patient information is processed outside Viet Nam, including through foreign-hosted platforms or remote technology services. Such arrangements may create additional obligations under applicable law.
From a patient-safety perspective, the objective is not simply to complete a privacy checklist. Information must be available to authorized professionals when clinically necessary, while inappropriate disclosure, access and secondary use must be prevented.
A technically convenient service with inadequate access control or uncertain data handling may create risks beyond ordinary confidentiality concerns. Conversely, poorly designed restrictions may interfere with timely communication of important clinical information.
Responsible governance needs to protect both the patient's information and the safe, lawful flow of information required for care.
The purpose of this discussion is to highlight the connection between information governance and clinical safety, not to replace a detailed legal or data-protection assessment.
Incidents and changes may involve more than one organization
A patient-safety incident involving AI-supported external services can be difficult to investigate when each organization examines only its own activities.
Consider a delayed diagnosis involving an external imaging provider and a referring clinic. The imaging provider may investigate whether the examination was performed and interpreted appropriately. The clinic may examine whether the report was received and reviewed. The technology provider may determine whether electronic transmission was successful.
Each investigation may identify useful facts, but none may fully explain how the combined process contributed to the delay.
A cross-organizational review should therefore examine the relevant sequence of events. This may include when the examination occurred, when the AI output was generated, when professional interpretation was completed, how the report was transmitted, whether urgent findings were separately communicated and what follow-up occurred.
The participating organizations should determine how relevant information can be exchanged for legitimate patient-safety investigation while respecting legal, confidentiality and data-protection requirements.
They should also clarify how concerns are communicated, who coordinates the review when several parties are involved and how agreed corrective actions will be followed up.
Such arrangements should reflect the legal responsibilities and authority of each participant. They should not be assumed to create a new joint legal entity or automatically transfer statutory responsibility.
Near misses can be equally informative. An incorrectly routed report identified before patient harm occurs may reveal a problem in patient identification. An urgent AI-supported finding sent through an unsuitable communication channel may expose a weakness before a serious delay develops.
Cross-organizational learning should therefore consider both actual patient harm and important vulnerabilities detected before harm occurs.
Changes in technology or workflow can create similar problems even when no incident has occurred.
An external provider may introduce a new AI function, modify its reporting platform or change how urgent findings are communicated. A referring hospital may replace its electronic medical record system or reorganize its outpatient services. A remote consultation service may change its operating hours or specialist coverage.
Each organization may regard these changes as manageable within its own operations, but the shared clinical process may be affected.
For example, a diagnostic provider may begin sending AI-supported notifications through a new interface. If the referring clinic has not adjusted its workflow, important warnings may no longer reach the intended professional.
Organizations should therefore identify which material changes need to be communicated and reviewed before implementation.
This does not mean every technical update requires formal approval from every participating organization. The intensity of coordination should reflect whether the change could materially affect clinical information, professional decisions, communication, follow-up or patient safety.
The same principle applies when an AI-supported service becomes unavailable. Organizations should understand how clinical care will continue if an external technology, reporting system or service is interrupted.
A coordinated contingency arrangement may be more useful than separate technical downtime procedures that do not explain how patient care will continue between organizations.
A practical Cross-Organizational Clinical AI Handoff and Accountability Review
Healthcare organizations in Viet Nam can address these issues through a Cross-Organizational Clinical AI Handoff and Accountability Review.
This is proposed as a practical organizational approach, not a statutory Vietnamese framework or an international certification requirement.
The review should begin with one clearly defined clinical service involving AI and at least two organizations. Examples may include AI-supported external radiology, outsourced pathology, specialist consultation or remote clinical support.
The first task is to understand the service model and the role of each participant. The organization should determine which parties provide clinical care, professional interpretation, technology or information-processing services and identify the relevant legal and professional responsibilities.
The next task is to map the clinically important handoffs. This means identifying what information moves between organizations, who sends it, who receives it, how the transfer occurs and what clinical decision or action may follow.
The review should then clarify responsibility for producing clinical information, communicating urgent findings, interpreting results in the patient's wider clinical context, arranging further care and following up unresolved concerns.
Another important question is whether AI changes the meaning, timing or reliability of the information being transferred. The organizations should understand when an output is preliminary, when professional review is required and whether material AI-related limitations affect clinical interpretation.
Foreseeable failures should also be considered. These may include incorrect patient identification, incomplete clinical information, delayed reporting, unavailable recipients, technical transmission problems, amended reports or uncertainty about which organization should contact the patient.
The participating organizations should then agree on safeguards proportionate to the risks. Depending on the service, these may include communication protocols, escalation arrangements, confirmation of receipt for important results, access to amended reports, coordinated incident review and contingency procedures.
Finally, the organizations should determine how they will monitor the shared service and review their arrangements when material changes or safety signals arise.
The review does not require a large new committee. For a relatively simple service, a documented discussion involving the relevant clinical, quality and operational leaders may be sufficient. More complex or high-consequence arrangements may justify a structured multidisciplinary assessment and formal coordination between participating organizations.
The essential question is whether the organizations can demonstrate a clear and reliable connection between clinical information produced by one party and the decisions or care responsibilities undertaken by another.
Monitoring should reflect the shared clinical service
A cross-organizational service should not be evaluated only through the performance indicators of individual participants.
An external diagnostic provider may report good turnaround times. A technology company may demonstrate high system availability. A referring clinic may document acceptable internal review performance.
These indicators are useful, but they may not establish whether the combined process supports timely and appropriate patient care.
Organizations should therefore consider selected measures that reflect the handoffs most important to the service.
Depending on the arrangement, these may include the time from completion of an examination to availability of the professional report, time from report availability to review by the responsible clinician, unsuccessful or delayed transmissions, urgent findings requiring additional communication and unresolved follow-up responsibilities.
Other useful signals may include incorrect patient associations, incomplete referrals, report amendments, discrepancies in clinical interpretation and near misses involving unclear organizational responsibilities.
These measures should be interpreted in context. A longer turnaround time does not automatically establish unsafe care, and rapid electronic delivery does not necessarily demonstrate effective clinical communication.
The objective is not to create extensive performance reporting for every external service. It is to select enough indicators to understand whether clinically important information and responsibilities are moving reliably between organizations.
Where possible, monitoring should also consider whether particular patient groups or care settings experience more frequent delays or coordination problems.
The participating organizations should agree on how relevant findings will be reviewed and who will be responsible for implementing improvements.
International experience supports a broader approach to clinical safety
International approaches to digital clinical safety increasingly recognize that technology risk extends beyond individual products.
NHS England's clinical risk-management standards DCB0129 and DCB0160 distinguish responsibilities associated with the manufacture of health IT systems from those associated with their deployment and use by healthcare organizations [13].
In June 2026, NHS England published supporting information for its national review of these standards. The review identified several areas requiring further attention, including AI governance, complex system interactions and cross-organizational collaboration [14].
These findings are relevant because they recognize that clinical safety arrangements may need to evolve as healthcare becomes more dependent on interconnected technologies and services involving multiple organizations.
However, the review findings should not be presented as completed new standards or a finalized AI-specific framework for cross-organizational accountability.
Joint Commission's voluntary Responsible Use of AI in Healthcare (RUAIH) Certification, launched on 1 June 2026, emphasizes that responsible AI implementation is an organizational governance issue involving patient safety, risk management, monitoring, transparency and professional education. The certification is designed for healthcare organizations and health systems in the United States rather than for individual AI products [15].
CHAI's Governance Playbooks, released in May 2026, encourage healthcare organizations to integrate responsible AI controls into existing processes, including third-party management and lifecycle governance [16].
WHO's guidance on ethics and governance of AI for health also emphasizes responsibility and accountability among organizations and individuals involved in developing, deploying and using AI [17].
These sources provide useful international perspectives. They do not establish the specific Cross-Organizational Clinical AI Handoff and Accountability Review proposed in this article, nor do they create binding legal requirements for healthcare organizations in Viet Nam.
What healthcare organizations in Viet Nam should prioritize
Healthcare organizations do not need to review every outsourced service with the same level of intensity.
A practical starting point is to identify external services in which AI materially influences clinical information, prioritization, professional interpretation or patient follow-up.
The organization can then select one service with meaningful patient-safety implications and examine where information and responsibility pass between organizations.
The first questions should be practical. Who provides the clinical service? Who verifies the result? Who receives important findings? What happens when a report is delayed or amended? Who contacts the patient when additional care is needed? How will the organizations investigate a problem that involves more than one participant?
Existing service agreements and clinical procedures may already address some of these questions. Where they do, the organization should build on those arrangements rather than create unnecessary parallel documentation.
Where gaps exist, the organizations should agree on safeguards proportionate to clinical risk and the nature of the services involved.
This may require clarification of professional responsibilities, changes to communication procedures, better management of urgent results or improved visibility of unresolved follow-up.
Clinical leadership should remain involved because these decisions affect patient care and professional accountability. Healthcare quality and patient-safety teams can help identify process weaknesses, while information technology personnel and external providers can support reliable technical communication.
Legal, compliance and data-protection expertise may be necessary when the arrangement raises questions about professional licensing, service scope, contractual duties, personal-data processing or international participation.
The objective should be to strengthen the existing clinical service without creating unnecessary administrative burden.
Safe AI-enabled care cannot depend on organizational assumptions
As healthcare organizations increasingly use external diagnostic services, remote specialist support and interconnected digital platforms, AI-related patient-safety risks may arise in activities that no single organization controls entirely.
A diagnostic provider may produce reliable information. A technology company may operate a technically sound system. A referring hospital may maintain appropriate internal clinical procedures.
Yet the shared service can still create patient-safety problems when important information, professional decisions or follow-up responsibilities are not effectively connected.
The challenge is therefore not to make every participant responsible for everything. It is to ensure that each participant understands its role and that clinically important responsibilities do not disappear when care moves across organizational boundaries.
For healthcare leaders, the key question is: When AI-supported clinical information moves from one organization to another, can we demonstrate who is responsible for receiving it, interpreting it, communicating important findings and arranging appropriate patient follow-up?
If the answer is unclear, the participating organizations may need to review their shared clinical arrangements before expanding the service further.
Responsible healthcare AI governance must extend beyond individual technologies and internal organizational policies. It should also consider how healthcare organizations cooperate to deliver safe, effective and accountable care.
Ultimately, patients should not experience avoidable harm simply because clinically important information or responsibility has crossed an organizational boundary.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, patient-safety, medical-device, cybersecurity, personal-data-protection, accreditation or quality-management advice.
The terms cross-organizational clinical AI governance and Cross-Organizational Clinical AI Handoff and Accountability Review are used in this article as practical organizational concepts. They are not defined statutory categories or prescribed documentation requirements under Vietnamese law.
The approach proposed here is not a Ministry of Health framework, statutory approval procedure, Joint Commission standard, CHAI framework, WHO guideline or NHS clinical safety standard.
Applicable responsibilities must be assessed according to the nature of the service, the roles of the participating organizations, the professional activities involved and the relevant legal requirements. These may include medical examination and treatment law, professional licensing and scope of practice, AI risk classification, medical-device regulation, telehealth requirements, personal-data protection, clinical records, contractual obligations and incident reporting.
The existence of a service contract does not automatically remove or transfer professional and statutory responsibilities. Equally, the participation of several organizations does not mean that every party has identical duties or legal liability.
International materials from NHS England, Joint Commission, CHAI and WHO are used as reference points for responsible governance and patient-safety improvement. They do not themselves create binding legal obligations for healthcare organizations in Viet Nam.
References
National Assembly of Viet Nam. Law No. 15/2023/QH15 on Medical Examination and Treatment, as amended. Effective 1 January 2024. Current consolidated text: Office of the National Assembly, Consolidated Document No. 26/VBHN-VPQH dated 26 February 2026.
Government of Viet Nam. Decree No. 96/2023/NĐ-CP Detailing a Number of Articles of the Law on Medical Examination and Treatment, as amended. Issued 30 December 2023; effective 1 January 2024.
Ministry of Health of Viet Nam. Circular No. 49/2017/TT-BYT on Telemedicine Activities. Issued 28 December 2017; effective 15 February 2018; currently recorded as in force.
Ministry of Health of Viet Nam. Circular No. 19/2013/TT-BYT Providing Guidance on Quality Management of Medical Examination and Treatment Services in Hospitals. Issued 12 July 2013; effective 15 September 2013; currently recorded as in force.
National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
Government of Viet Nam. Decree No. 98/2021/NĐ-CP on Medical Device Management, as amended.
Ministry of Health of Viet Nam. Circular No. 24/2026/TT-BYT on Determining Risk Levels and Management Measures for Medical-Device Products and Amending Certain Provisions of Circular No. 05/2022/TT-BYT. Issued 30 June 2026; effective 1 July 2026.
Ministry of Health of Viet Nam. Circular No. 13/2025/TT-BYT Providing Guidance on the Implementation of Electronic Medical Records. Issued 6 June 2025; effective 21 July 2025.
National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
Government of Viet Nam. Decree No. 356/2025/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Personal Data Protection. Issued 31 December 2025; effective 1 January 2026.
NHS England. DCB0129: Clinical Risk Management — Its Application in the Manufacture of Health IT Systems; and DCB0160: Clinical Risk Management — Its Application in the Deployment and Use of Health IT Systems.
NHS England. National Review of Clinical Risk Management Standards DCB0129 and DCB0160: Supporting Information. Published 29 June 2026.
Joint Commission. Responsible Use of AI in Healthcare Certification. Launched 1 June 2026.
Coalition for Health AI (CHAI). AI Governance Playbooks. Released 27 May 2026.
World Health Organization. Ethics and Governance of Artificial Intelligence for Health: WHO Guidance. Published 28 June 2021.