Why might approval be needed for use of AI in health research?
In summary, Institutional Review Boards (IRBs) and healthcare organizations (HCOs) need to know about, and possibly approve, Artificial Intelligence (AI) you plan to use for your study, especially by the HCO if your research:
- could impact clinical care at the HCO
- uses the HCO's data
Reasons AI might need approval by an HCO
Possible reasons why the use of AI in your study might need approval by an HCO:
Contact CB2 if you plan to use AI in a manner:
- that is used in clinical workflows
- that affects, interacts directly with, or is integrated into, health systems (inc. Banner)
- that is used in, or influences, clinical decision making; including: diagnosis, treatment recommendations, prediction, or any other clinical action; or replaces clinical consultation
- that uses Protected Health Information (PHI), especially if the PHI would be provided to a third party
- where data from a health system (inc. Banner) will be kept by the AI company, or used to improve their products
Overview
In order to guide researchers, the Center for Biomedical Informatics and Biostatistics (CB2) compiled the above possible reasons approval might be needed for use of AI; plus AI information which might be needed, which is summarized directly below, with more details in the accordion sections below this section. However, please see more information about this page below, including a disclaimer, as CB2 nor U of A may not be aware of all the details.
What is AI?
Artificial Intelligence (AI) encompasses augmented intelligence, machine intelligence, machine learning (ML), data mining (DM), natural language processing (NLP), neural networks, text or image generators, chatbots, robotics, cybernetics and and many other techniques for computer software to extract and "learn" from any kind of data (text, images, etc.). It can also make recommendations and predictions; and even perform various actions, based on what it has "learned."
Regardless of How you plan to use AI
It is helpful to include the following information in your IRB protocol:
- Intended use of AI in the study
- What is the intended use in the study
- Where it will be used (at Banner and/or another HCO)
- How it will be used (for clinical care, or for research only)
- Data Handling / Storage for AI
- What HCO data is being used
- Where it will be handled, stored, and shared, inc. if Banner's or other HCO's data will be shared with AI company(-ies)
- Which of the following steps, if relevant, are done:
- validation
- regulatory docs
- approval(s)
- and/or legal agreements
Provide details if AI is being used as listed above
HCOs, including Banner Health, will need to know, and possibly approve, at least some of the information listed on this page. Some of what you might need to specify is in the sections below: Please note [bracketed text like this] indicates options from which to choose based on your specific situation: select the applicable option shown in brackets [], such as [is / is not].
Specify in your protocol if the AI interface [is / is not]:
- used in the HCO (such as Banner) clinical workflows OR:
- integrated into the HCO (such as Banner):
- electronic medical record (EMR), such as, but not limited to, Oracle/Cerner or Epic EMR
- information technology (IT) system(s)
If any of the above is true, the (Banner or other HCO) AI Executive Steering Committee (or similar group at the HCO), will likely need to approve the AI, sometimes at a meeting, and will also need at least some of the information in the other sections on this page.
The following legal agreements may be needed and may already be in place: Please check with the HCO (such as Banner) and the AI software company to confirm if needed and if exist already:
- BAA/DUA (Business Associate Agreement / Data Use Agreement) between the HCO and the AI company
- “Good” compliance with the following applicable regulations, including score (percent compliance), for use of the AI software in healthcare
- HIPPA
- FDA
- Any other applicable federal, state or local regulation(s)
- If submitting information to an HCO for approval AND:
- When a RAP form is submitted
Specify:
- Name of AI system
- AI company with whom you are working
- Person who will work on, if needed, getting a BAA/DUA (Business Associate Agreement / Data Use Agreement) with the AI company
- Info. from UA eIRB:
- Protocol Title
- UA IRB#
- If applicable:
- “Good” compliance with applicable regulations, including score (percent compliance), for use of the AI software in healthcare
- When [met / meeting] with the (Banner or other HCO) AI Executive Steering Committee (or similar group) [did / will] happen or approval [was / will be] obtained
Intended use: state/specify if:
- The study is intended [to / to not] evaluate the utility to:
- support patient understanding
- augment physician consultation
- gauge patient perceptions
- The AI [will / will not]:
- influence decision making
- replace clinical consultation
- All treatment decisions [will / will not] remain entirely between the patient and their treating physician. Therefore, this study [does / does not] evaluate:
- patient perceptions of AI explanations
- the clinical validity of AI recommendations
Regulatory Status: state/specify if:
- The AI interface [is / is not] regulated by the FDA because it [is / is not] used for:
- diagnosis
- treatment recommendation(s)
- prediction
- clinical action(s)
- It [does/ does not] meet criteria for Software as a Medical Device (SaMD)
Prior Research Validation: state/specify if:
- The AI system used in this study [does /does not]
- provide medical advice
- make recommendations
- guide clinical decision-making
- It [does / does not] simply deliver evidence-based educational explanations drawn from reputable medical sources (e.g., NCCN, JAMA) through the Open Evidence Model
- While patients [can / cannot] interact with the system and ask questions, its role [is / is not]:
- limited to summarizing published literature
- diagnosing or advising treatment
Data Handling / Storage: state/specify if:
- The AI system [does / does not] …
- store
- receive or
process
… any participant data
- All participant data [are / will be]
- collected directly in REDCap
- stored in Box Health
- in other storage which is HIPAA-compliant and restricted to authorized research staff
If using PHI, state/specify if:
- We [are / are not] proposing a zero-PHI study design: Inputs [are / are not] limited to structured fields, which are:
- [specify high-level list of inputs]
- [None of / specify which] the following are shared with the AI or AI company:
- names
- record numbers
- addresses, small geographies
- phone numbers, email
- exact dates
- images
- Patients may ask clarifying follow-up questions, [but no / specify which] PHI is transmitted
State/specify if:
There [is / is no] PHI flowing to the third party
and there [is / is no] [Banner / other HCO] data being kept or used to improve products.
Please note:
If Banner (or other HCO whose data is being used to improve product(s)) ever wished to explore a different arrangement in the future, understand that would require separate review and appropriate compensation.
Contact CB2 if you still have questions
About the information on this page
Updated: Spring/Summer 2026
Thank you to the following for the above information: the U of A IIT Review Committee.
Disclaimer
The reasons approval might be needed and other lists on this page may not be comprehensive as CB2 nor U of A may not be aware of all the details. The information on this page, which is based on what the U of A IIT Review Committee needs to be able to appropriately evaluate a study using AI, do not necessarily reflect the information Banner’s, or any other HCO's, AI committee would need for their review. We do not have a list of the criteria Banner or any other HCO uses to evaluate studies using AI: the information on this page has been annotated by CB2, from a Banner example, to inform researchers using AI what Banner or any other HCO might need. Please Contact CB2 if any information on this page might be missing or incorrect, so CB2 can direct you to the appropriate person(s) with proper authority and verify the information.
