By the numbers
Global AI-in-healthcare market estimated at ~$52B for 2026 and projected to ~$928B by 2035 (~38% CAGR); market-research estimates vary widely (Towards Healthcare, 2026).
Source: Towards Healthcare
AI-enabled companies captured 54% of the $14.2B US digital health startups raised in 2025 and commanded a 19% average deal-size premium (Rock Health, 2025).
Source: Rock Health
The FDA had authorized more than 1,400 AI-enabled medical devices since 1995 as of its March 2026 data update, the majority in radiology (MedTech Dive citing FDA, 2026).
Source: MedTech Dive / FDA
Radiology accounted for 74.4% (125 of 168) of the AI/ML-enabled medical devices the FDA authorized in 2024, showing how concentrated cleared clinical AI still is in imaging (peer-reviewed analysis, 2025).
Source: Peer-reviewed (PMC/NLM)
Clinicians using an ambient AI documentation tool spent 8.5% less total time in the EHR (and 15%+ less composing notes), with self-reported burnout falling from about 52% to 39% (UChicago Medicine, 2025).
Source: UChicago Medicine
Prior authorization consumes about 13 hours of physician-and-staff time per week, and 26% of physicians say it has led to a serious adverse event — a prime target for administrative AI (AMA survey of 1,000 physicians, 2025).
Source: AMA
Key terms
- Ambient clinical documentation (AI scribe)
- Software that listens to a patient visit with consent and automatically drafts the clinical note for the clinician to review and sign. Examples include Nuance DAX Copilot and Abridge; the clinician, not the AI, remains accountable for the final note.
- Retrieval-augmented generation (RAG)
- A method that grounds a large language model's answers in a trusted, current document set — policies, guidelines, or records — so responses cite real sources instead of the model's memory. It is the main technique for reducing hallucination in clinical and administrative Q&A.
- Software as a Medical Device (SaMD)
- AI software that meets the legal definition of a medical device — for example, it diagnoses or guides treatment — and therefore needs FDA authorization. Most FDA-cleared AI is imaging-related; many documentation and administrative tools are non-device and fall outside FDA clearance.
- HIPAA and Business Associate Agreement (BAA)
- US rules governing protected health information (PHI). Any AI vendor that processes PHI must sign a BAA and meet HIPAA safeguards, and PHI must not be used to train shared models without authorization.
- Human-in-the-loop
- A design where AI drafts or recommends but a qualified person approves before anything reaches the chart, the patient, or a coverage decision. It is the core safeguard against automated clinical or claims errors.
- Revenue-cycle management (RCM) automation
- Applying AI to the administrative money-flow of care — prior authorization, coding, claims, and denials — to cut manual effort and rework. It is one of the highest-volume, lowest-clinical-risk entry points for healthcare AI.
At a glance
| Dimension | Off-the-shelf SaaS point solution | Hyperscaler platform + in-house build | Boutique AI engineering partner |
|---|---|---|---|
| Typical time to production | Days to weeks, narrow scope | 6-18+ months | ~6-week feasibility sprint to ~90-day deployment |
| EHR and workflow integration | Shallow, vendor-defined | Deep, but you build and maintain it | Deep, custom to your workflow |
| HIPAA/BAA and compliance | Vendor BAA, limited control | You own controls end to end | Shared BAA, built to your governance |
| Accuracy evaluation | Vendor's own benchmarks | Your team defines the eval | Eval harness on your data; no guaranteed number |
| Customization | Low | High | High |
| Best fit when | The need is narrow and standard | You have a mature AI/ML organization | You need production speed without a large in-house team |
What to check before you buy
- Get a signed BAA and written PHI data-handling terms: where PHI is processed, how long it is retained, and assurance it will not train shared models without your consent.
- Require an accuracy evaluation on your own data and workflows, and treat any vendor that guarantees a specific accuracy number as a red flag.
- Mandate human-in-the-loop for anything clinical or coverage-related: no auto-publishing to the chart and no automated denials.
- Confirm the EHR integration path (Epic, Oracle Health/Cerner, FHIR APIs) and who owns integration and ongoing maintenance.
- Clarify FDA status: is the tool a cleared Software-as-a-Medical-Device or a non-device documentation/admin aid, and does that match how you intend to use it?
- Run a time-boxed pilot with success metrics tied to outcomes — clinician time saved, denial rate, cycle time — not usage or activity counts.
- Ask for bias and subgroup performance testing plus post-deployment monitoring for model drift.
- Plan data governance, audit logging, clinician training, and change management before scaling beyond the pilot.
Frequently asked questions
What are the highest-ROI AI use cases in healthcare right now?
Administrative and documentation workflows tend to pay back fastest because they are high-volume and lower clinical risk. Ambient AI scribes have cut clinicians' EHR time by roughly 8-15% in health-system studies (UChicago Medicine), and prior authorization — about 13 hours of physician-and-staff time per week per the AMA — is a prime automation target. Diagnostic imaging AI is the most FDA-mature but narrower in scope.
Is healthcare AI regulated by the FDA?
Only when the software meets the definition of a medical device. The FDA had authorized more than 1,400 AI-enabled devices as of March 2026, the vast majority in radiology (74.4% of 2024 authorizations). Many documentation, chatbot, and revenue-cycle tools are non-device and sit outside FDA clearance, but they are still bound by HIPAA and your own safety governance.
Why do so many healthcare AI pilots stall before scaling?
Common causes are production data that looks nothing like the pilot's clean dataset, bolting AI onto an existing workflow instead of redesigning it, shallow EHR integration, weak change management, and success metrics that measure activity instead of outcomes. Defining evaluation and monitoring before the pilot — not after — is what separates production systems from demos.
How do we stay HIPAA-compliant when using LLMs and AI vendors?
Sign a BAA with any vendor that touches PHI, confirm where PHI is processed and retained, and ensure your data is not used to train shared models without authorization. Add access controls, audit logging, and de-identification where possible. RAG architectures that keep PHI inside your controlled systems, rather than sending it to a public model, reduce exposure.
Should we build, buy, or partner?
It depends on scope and internal capacity. Off-the-shelf SaaS is fastest for narrow, standard needs; building on a hyperscaler platform gives the most control if you have a mature AI/ML team; a boutique engineering partner can reach production quickly without a large in-house build. Match the choice to your timeline, integration depth, and compliance needs — and always pilot before committing.
How should we measure AI accuracy without being misled?
Insist on an evaluation harness run against your own data and real workflows, and be skeptical of any vendor that guarantees a specific accuracy figure — credible builders measure and report rather than promise a number. Include subgroup and bias testing so performance holds across your patient population, and keep monitoring for drift after go-live.
This guide is educational and even-handed: CONE RED is one option among several, and no honest firm guarantees a fixed accuracy, compliance, or business outcome. Every statistic above links to a source you can check; figures are current as of publication and may change.