Long-term care providers are being urged to put formal oversight around AI, with a five-part checklist covering strategy, leadership, product review, access controls and staff training. The advice, shared at an industry meeting, offers operators practical steps for using AI without treating governance as an afterthought.
Watch Desk analysis
What happened
A panel at the LeadingAge annual meeting in Philadelphia set out five building blocks for long-term care organisations adopting AI, according to McKnight’s. They are: connect risk management to the organisation’s clinical mission and resident safety; create a cross-functional AI governance committee; review vendors and their subcontractors; restrict tools’ access to the minimum necessary; and train staff on acceptable use and incident response.
The vendor checks should extend to subcontractors and API partners handling sensitive data, the panel advised. Its access-control recommendation is to treat AI tools, bots and assistants as privileged accounts, rather than letting them wander freely through organisational data. Staff training should cover rules for tools such as ambient recording devices and include breach simulations involving multiple departments.
The report also describes RiverSpring Living’s approach. Its CIO, David Finkelstein, said the organisation piloted a voice-powered AI chatbot with about 30 residents and used internal AI coding prompts to map more than 200 network switches across its Bronx campus in three days. He said these deployments were kept away from protected health information and governed by procurement controls. These are examples reported by the organisation, not independent evaluations of the tools’ results.
Why it matters
Long-term care providers may handle sensitive health information while relying on technology for services that need to stay available. That makes decisions about data access, vendors and staff use concrete operational questions, not just paperwork for the compliance cupboard.
The checklist gives leaders a starting point: assign responsibility across clinical, IT, HR, legal and billing teams; check the extended vendor chain; limit permissions; and practise what happens when something goes wrong. It is guidance from a panel, not a guarantee that following five steps will prevent breaches or resolve liability.
Our read
The useful point is that “we bought an AI tool” is not a governance plan. The recommendations are specific enough to put into a procurement or risk-review process, and broad enough to apply before an organisation knows exactly which AI product it will adopt. Start with who is accountable, what information a tool can reach, and which suppliers sit behind it. The technology can be clever; the access rules should be less adventurous.
What to watch
- Whether providers publish or adopt formal AI governance and procurement standards.
- How organisations restrict access to sensitive data across AI vendors and subcontractors.
- Whether reported pilots produce measurable benefits while maintaining safeguards around resident information.
Discussion spark: Should long-term care providers have to document an organisation-wide review before deploying AI, or would that slow down useful tools without meaningfully improving safety?
Sources and evidence
- Source update (5 November 2026, 21:05 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.