The Healthcare Attorney Building Guardrails for Medical AI

By Caroline Reed, JD — 2025-12-01

Caroline Reed spent the first six years of her career inside a federal health agency, reviewing regulatory submissions and advising on enforcement. She left to enter private practice with a clear niche: the intersection of healthcare law and emerging technology. She joined IXO because that niche was becoming urgent.

The convergence of regulatory regimes

"Healthcare AI sits at the convergence of multiple regulatory regimes simultaneously," she says. "FDA oversight of software as a medical device. HIPAA privacy and security requirements. Anti-kickback implications when AI influences clinical decisions that touch reimbursement. State medical practice laws. CMS coverage rules. Most AI developers understand one of these. Very few understand all of them together."

Her IXO work is primarily evaluating AI legal research and compliance tools for accuracy and completeness in healthcare regulatory contexts. She tests whether AI tools correctly identify the applicable regulatory framework for a given AI application, whether they accurately summarize relevant guidance and enforcement history, and whether they flag the state-level variations that the federal-focused training data often misses.

The software as a medical device problem

"The software as a medical device framework is an area where I spend a lot of time. AI tools regularly mischaracterize what requires premarket submission versus what qualifies for enforcement discretion. That's a meaningful compliance gap for companies building clinical AI — and a gap that AI legal tools are perpetuating."

HIPAA blind spots

She also evaluates AI compliance tools in the HIPAA context, with particular focus on whether they correctly handle the business associate analysis that determines when data sharing requires a formal agreement. "The number of healthcare AI deployments with HIPAA exposure that the deploying organization hasn't identified is substantial. AI tools that should be catching these are sometimes missing them."

Read The Healthcare Attorney Building Guardrails for Medical AI on the IXO blog