AHLA's Speaking of Health Law
The American Health Law Association (AHLA) is the largest nonprofit, nonpartisan educational organization devoted to legal issues in the health care field with nearly 14,000 members. As part of its educational mission, AHLA's Speaking of Health Law podcasts offer thoughtful analysis and insightful commentary on the legal and policy issues affecting the health care system. AHLA is committed to ensuring equitable access to our educational content. We are continually improving the user experience for everyone and applying the relevant accessibility standards. If you experience accessibility issues, please contact accessibility@americanhealthlaw.org.
AHLA's Speaking of Health Law
Health Care Corporate Governance: NACD’s New Report and Board Oversight of Technology
Rob Gerberry, Senior Vice President and Chief Legal Officer, Summa Health, speaks with Michael Peregrine, Partner, McDermott Will & Emery, about the proper role of health care organization boards in relationship to technology, including artificial intelligence. They discuss the National Association of Corporate Directors’ (NACD’s) 2024 Blue Ribbon Commission Report, the report's focus on governance oversight of technology, and how boards can implement the report's recommendations.
AHLA's Health Law Daily Podcast Is Here!
AHLA’s popular Health Law Daily email newsletter is now a daily podcast, exclusively for AHLA Premium members. Get all your health law news from the major media outlets on this new podcast! To subscribe and add this private podcast feed to your podcast app, go to americanhealthlaw.org/dailypodcast.
<silence>
Speaker 2:This episode of A HLA speaking of health law is brought to you by A HLA members and donors like you. For more information, visit american health law.org.
Speaker 3:Welcome everyone to another of, in our series of corporate governance podcasts. I'm Rob Berry. I'm the Chief Legal Officer at Summa Health, and a member of the American Health Law Board of Directors. I'd like to welcome you to the latest in our continuing series of key core governance issues affecting healthcare organizations. Today's topic is one of great interest to our membership and our clients, the proper role of the company's board of directors in relationship to new technology, including artificial intelligence. The issue that so many have been dealing with is crafting the best role for governing boards with respect to healthcare's rapidly developing, fast changing, and constantly evolving relationship with technology, medical research, and care delivery. As always, I'm joined by my friend and colleague, Michael Peregrine of McDermott, will and Emory, who's also an HLA fellow and a fellow at the American College of Governance Council . So, Michael, why are we talking about this topic today? Is there a new development? Is there anything our audience may have missed?
Speaker 4:No , Rob. I think that there is a pretty big development in the scheme of things that affects our fellow members. A couple of weeks ago, the National Association of Corporate Directors, which I think a lot of our, our , uh, clients, board members , uh, are part of released , what the 2024 version of what it always calls, its Blue Ribbon Commission report. They pick a topic each year to dive in, and a group of experts go for about six months to develop something. Uh, this year's report is called Technology Leadership in the Boardroom. Uh, and, you know, the NACD is a pretty major policy influence in the corporate governance world. So when it speaks, especially to the, through these Blue Ribbon Commission reports, it's usually a big deal.
Speaker 3:So , Michael, what's so important about the timing of this report? Hasn't there been a avalanche of other reports, guidance, draft statutes, and all the rest working to try to establish some sort of governance framework for ai?
Speaker 4:Well, there's been a lot of noise. There's been a lot of reports, and there's been a lot of effort to draft , uh, statutes and regs and things of that nature. But there really hasn't been anything that's related to corporate governance role. It's frankly, been amazing. Uh, it , this is particularly in the absence of any ai , uh, regulatory framework that's been formally established. I think what you've seen is that a lot of boards have been really uncertain about the role they perform or may perform with respect to AI matters and other technology. And , and I think this uncertainty has really been compounded by a lot of internal , uh, company pushback on, frankly, the value they feel the board can contribute to the development of AI strategies and to confronting AI risks. There's a lot of, you know , uh, concern as to whether the board should have a role in , in this. And so that's why I think what NECD has done is a really big deal.
Speaker 3:So, Michael, as you look at our industry and at your client base, have you really seen a voyage? I know many healthcare organizations have been working to adopt AI oversight programs.
Speaker 4:Well, I think the problem is that, that we , we see a phrase called AI governance, and that gets kind of confusing. And from my world and my perspective, the , the term AI governance is a more of an internal operational framework that works to design and implement policies and procedures and standards that relate to the proper development and use and management of ai. It's a great function, can really work well.
Speaker 3:So specifically though, where are you seeing the problem?
Speaker 4:Well, I think the problem, Rob, is that , well , AI governance is great. It's not an operat , it's an operational function. It's not a, it's a management level function and it's being confused and it really can't be confused or perceives as a substitute , uh, the performance of, you know, traditional board duties by the board of directors. So, and from my perspective , um, we're, we're seeing a lot of people say, well, we've got AI governance in place, what else do we need? And my answer is, well, no, you really don't. It's an enforced , you know , what AI governance does at the management level is terrific, but it's , again, it's not meant to be, nor should it be considered to be a substitute for board oversight.
Speaker 3:So what are you seeing the NACD report doing that prior AI governance might not?
Speaker 4:Well, I think, you know, we, we always look at , with our, our members and , and , and clients are asking general counsel , clients are asking us, alright , how , how , I understand your point, but how do I make the point with the board, with my senior leadership? And I think, you know, if , if we're looking at this at a, from a purely practical perspective , uh, the NACD report is from my perspective, the first substantive statement by , uh, you know, big time governance organization or public policy group that addresses the essentiality of a strong focused board oversight and how that's totally essential to proper corporate application of technology. In other words, this is the first time you've got a really credible third party saying , yes, boards have to be involved in the oversight of technology by the company. Um, because the basic message of the report is a call for, and I'm gonna quote this, Rob, because I think it's important, it's a call for boards to govern technologies with more definition , uh, more strategic focus and more proactive engagement. Uh, that's a message that we, lawyers might have a difficult time sending on our own, but if we point to NACD , uh, a lot of members of the client's board are gonna say, well, I'm a member of NACD and I if they say it, I'm buying in.
Speaker 3:Michael, is there something special about the timing of when they've done this release?
Speaker 4:Yeah, probably a couple of things, including, you know, everything, ai , AI that's going on right now. And, and I think probably also the concept of doing this in a way of getting ahead of any kind of national regulation. But I think what's probably most important is, is to look at what the commission members said about the timing and the , uh, trends and developments that are behind their recommendations. And Rob, I would say as an aside , uh, that the, the , the members of the commission are , are , are not a bunch of slackers. These are top-notch corporate executives, some lawyers involved in technology and a , a wide variety of , uh, corporate industries. It's an amazing group of people. So they , they know their stuff and they identified in the report a couple of things that, that say , move this to the , uh, front burner. And number one is just that the whole confluence of tech trends and developments and how they're just raising the stakes for corporations generally. I think that's a huge deal for the commission. Uh, they also point the corporate strategy timelines as to tech are , are being compressed by the speed of change . And when you think about it, that makes a lot of sense. You and I and a lot of our clients who are listening are , you know , that, that that triggers a bell inside internally. Is the board gonna have enough time to react to something if things are moving so fast? Uh, a third thing is kind of interesting to me. And , and that's just the acknowledgement that corporate competitive advantages, especially that arise through tech or , or shifting, that's gotta be a concern for the board. Uh , another one, which is kind of a red flag, is that innovations appear to be outpacing board member experience with tech innovation. And, and when you've got that issue, the question is, can the board properly, do they have the tools with which to evaluate what's going on? Uh, you know, I think we see everyday , uh, issues and concerns about the question of fo trusted technology and data use. And then that we, that we're still dealing with a patchwork , uh, a government regulation of tech that kind of creates a thread of inertia or even paralysis with respect to tech innovation. So I think these are the kind of , uh, trends and developments that have prompted NAC to come out with a report. Now,
Speaker 3:Michael , I hear the report could be a little long, several hundred pages long, you know , can you summarize its conclusions for our membership?
Speaker 4:It's not that long, but , uh, you know , uh, I'm still, I'm of the age , uh, where I remember Cliff notes getting me through high school and college. There is no cliff notes . I mean, there is an executive summary, but it doesn't work this well. Um, it it , it's important to remember that the , the way the NACD does these , um, blue ribbon reports , uh, is , is pretty useful in terms of read. It's not just a direct narrative. It , it highlights, it's got it's attractive graphics . It's an easy read. It highlights the main goals . Um , so I think you've got about 30 pages of narrative and then a very detailed addendum, a toolkit of about 40 pages, which kind of walks you through , uh, the materials and sample questions and the , uh, and other materials that are , are designed to help boards and people like you and me figure out and how to approach the reports Specific recommendations. I remember last year's report, which was so important, it was on boardroom culture that had, you know , uh, here, here are the 10 steps you, you , you should take to address these recommendations. It's a to-do list, and it's really helpful. So
Speaker 3:The recommendations themselves are how long?
Speaker 4:Well, I think that's about, it's about 30 pages, but it's broke . But , but the, there are 10 recommendations in particular. And then the , uh, report breaks them down into three separate, what they call imperatives. Uh, and , and under the, the first imperative, there are four sub recommendations. Number one is the basic need to strengthen board oversight. And interestingly, Rob, the focus there is on trustworthy technology use , uh, and aligning it to the organization's mission values. It's the , it's the concept that I don't think that gets enough attention. Uh, uh, NACD calls it a focus on not only what you can do with tech, but also what you should do in aligning it with where the company is going in terms of its purpose. And I think also its mission, vision and values and its commitment to ethics and its risk profile. The second recommendation , uh, you know , uh, is something only a lawyer would understand , uh, or appreciate the , the call to upgrade board structures to make it fit for tech governance. And , and what you're looking at there are the , are the traditional board issues, governance issues of , uh, do the , does what's in place right now at the board level in terms of its oversight structure and practices really work to support technology governance and the required pace , uh, or were there changes are needed. And , and in my mind, this is a really a foundational biggie issue that right off the top, we've got a system in place right now on our board to monitor oversight. We try and track the Caremark standards. Is that gonna work? Is that good enough? Uh , when we apply it directly to tech and ai? Uh, the third recommendation , um, kind of is, is intended to zero in more on what the board's role in data oversight is. You know, stuff like ensuring that the data is protected , uh, tracking however the companies is ensuring trusted and ethical data use, and then figuring out the data risks and opportunities. Rob, on this point, I'll make a plug for our last podcast on the , uh, uh, department of Justice's , uh, compliance program guidelines. And you'll remember that a big part , the big changes that they mentioned , uh, in the new ECCP is a fo you know, the , the linking of , uh, data use and data oversight and compliance. The fourth , uh, and a CD recommendation is also a key. And , and again , uh, what a lawyer would love, it's the decision tree. It's the lines of authority's identifying which of the tech tech decisions the board is to be involved with, and which can remain with management. Uh , it also deals with, you know, what's the extent of management to board reporting. So there , uh, under this first , uh, uh, what I would call imperative , uh, there are four recommendations. Several of those are just right up the general counsel's ailing.
Speaker 3:So these recommendations seem to assume a basic level of , uh, technology awareness at the board level. I'm not sure that existed . Every institution as we look at the staffing and composition of some of our boards,
Speaker 4:Well, I think, you know, I think the NACD folks get this. And so , um, that's why they, they call the second imperative, or they categorize it as deepening insight. It's, that's what it's all about. Um , it's under the second imperative. The three recommendations include, all right , let's establish and, and maintain what we believe to be the core level of technology proficient proficiency amongst the board. Uh, which I would probably fail right out of the box. Um, it includes separately evaluating director on board tech proficiency. And in my mind, that's something that, you know, is going to be an interesting task. You're not going to get the totality of the board to, to be tech experts. You, you may get and say there's a baseline level of knowledge that we expect of all board members and tying that to the , uh, board evaluation process, then all of a sudden that gets pretty serious. The , the , the third , um, deepening insight recommendation is let's make sure that that we get appropriate and clear metrics for tech oversight established. What is the , uh, are the kinds of critical tech information, AI information that we need to include in board materials? And I think that's probably Rob, gotta be something that's a , a work in progress over a period of time.
Speaker 3:So Michael, this seems to me like it'd be a heavy lift for many organizations. It seems like many boards don't have this expertise and we've got PAC board agendas. Are you seeing a committee structure, or how are you seeing this being best structured?
Speaker 4:Well, I think this is the, you know, this goes back to Rob something we've talked about in these a HA podcasts over time. And that is the , the whole question of engagement. I , I , I think you're seeing , um, ai, like a freight train coming right down the tracks of , uh, uh, towards , uh, a lot of governing boards. And it's going to certainly have an impact on the composition of boards. Not, not so much in terms of requiring everybody to, to be a AI experts, but basically saying this, this deepening insight, this , uh, commitment to achieving technology proficiency is gonna be a required, you know, this isn't , uh, replacing some other job. This is on top of all the other jobs that you have as a board member. Um, and it's gonna be a heavy lift , but I'm not sure that healthcare boards have any choice given the , uh, pace of change. It's , uh, you know, we'll have a , a , a dial in to answer this question, Rob , but there's a favorite movie where , uh, uh, one of the characters said, you wanna have a parade in my town? You must pay. Um, and, and you know, the , if , if you wanna be a , a member of a board of directors of the , of a healthcare company in this day and age, you're going to have to step up and accept the fact that you're going to have to increase your tech proficiency. Uh, as a matter of course. That's the , that's the price of , uh, of having , uh, participating in the parade.
Speaker 3:So, Michael, by my pitch count, I think we hit on two imperatives. Was there a third?
Speaker 4:There's a third. And you really are on the ball today. Um, the third imperative is focused on what they call developing foresight. That's, you know, looking down the, down the road a little bit, and it includes the need to recognize technology technology's role . It's just a fundamental element of long-term strategy. And I think what that's consistent with what we're seeing in a lot of publications right now from the consultants, that it's impossible to look at the long-term strategy of the healthcare organization without , uh, incorporating the role of technology. And of course, as you and I have talked about over the last couple of years in these podcasts, podcasts , uh, you know, job number two , uh, of a healthcare director , uh, is to monitor the long-term strategy and value proposition of , of the organization. Job number one is oversight of management. So, you know, I think what we're seeing is this third imperative , uh, encourages the development of a culture surrounding board and management technology discussions that includes tech as a fundamental part. When we're talking strategy, we've gotta talk about technology. It's , we can't separate it out. It's gotta be coordinated in . And , and then I think what the , uh, the report does, which , uh, I found reassuring to me is a tech neophyte , which is, I think a charitable way to describe my skillset is , uh, it , it recommends that this culture allow both the board and management to ask candid and , you know, forward looking questions about technology without penalty, without criticism, without shaming, you know, in other words, it's a, it's a fancy way of saying there on this topic, there are no stupid questions. Um , and so I think that's a very welcomed recommendation. Uh , then , then the , the final as recommendation under this third imperative is the whole, which, you know, it's practical, but when you think about it makes a lot of sense and you , and you kind of got to this , um, the whole task of designing board calendars and agendas to make sure there's full engagement on tech. So, you know, when you just as take taking a step back, we've got this report that has , uh, 10 recommendations divided up into three specific imperatives. The end result is this is the way to go in terms of we , uh, uh, a best practices approach to building out a role for the board in the exercise of oversight and decision making . Let's not forget that. And decision making with respect to ai.
Speaker 3:So Michael, that's a lot of helpful background and guidance. Maybe if I could circle back one more time to my earlier point. How do we as corporate secretaries or others that are planning these agendas though, convince the board that they've gotta tackle this heavy lift?
Speaker 4:Well, I think again, it's the concept of would be used to borrow the NECs term. It's an imperative. I think that , uh, most board members know intuitively that they're behind the curve with respect to a AI and their, and their proficiency. And they also know, and not intuitively, they just see it on a daily basis , um, that , uh, AI and other tech developments just , it's just a inescapable and fundamental part of what the institution is doing. So I, I , I think part of our role is to say, yeah, we get it. We're not that , that , um, that the NACD's recommendations are at tall order, but if you're going to be in this field, that you're going to be in this area, there's just really no way around , first of all, having the board with a , a clear defined role on the oversight of technology. And, and the NACD is providing a roadmap for that. There's no time limitation, there's no, this has to be done in a year, but it's a , again, it's a game plan for , for getting the board to be in a much better position to a address all of these tech issues, but you strip it all away. I think the strongest point that our listeners, our general counsel , our colleagues can make is this is the first time , uh, that a major corporate governance organization, a major public policy organization has said, a, the board absolutely has a place at the table with respect to oversight and decision making on ai. And b, here's a way to go about doing it . It's not the only way, but it is a way. And , uh, that's a big deal for any board.
Speaker 3:So, Michael, as we think about that game plan, how would you tell my peers as general counsel , who to partner with on this topic to advance it, and then maybe how to work with your governance , uh, function to, you know , implement the right structure or the right committee?
Speaker 4:Well, you know , I think a lot depends on the different hierarchies that an organization, but from my perspective, the fact that this is all about governance means that the general counsel has a very big seat at the table. I'm not trying to be critical here, but I mean , it , it's a situation where , uh, this, this is not something that's driven by the chief information officer or the chief technology officer. These two have to team together and maybe along with the compliance officer , uh, as , uh, as regulation ramps up at the state and federal level. So I think it's a, it's a , uh, senior members of the management team have to work together to move this forward. But, but there's no question whatsoever that what we have now is that the general counsel has a specific portfolio given his or her role as chief governance advisor of the organization. You know, and , and I , I think that you can kind of define any particular approach to this in my role thinking you either work through an existing committee or maybe a special committee , uh, combining maybe the governance IT and strategic planning committees say, you guys look at this report, give us your recommendations , uh, on, you know, what , how much of it is relevant to us? What else? If you have any new ideas, come back in three months and report to us. But I think it's this combination of , um, uh, a collaborative approach at the , uh, at the board committee level, reviewing the NSCD report, and then that being staffed by , uh, senior corporate executives who all have a stake in it. That's the probably the way I'd, I'd wanna make this work.
Speaker 3:So my takeaways are board do need to find a way to make this work, and they're gonna need to partner with their executive leadership team members to make sure it gets moved forward.
Speaker 4:Yeah, and I think the challenges , and I bet a lot of our listeners are aware of is , is that it's, it's reasonable to expect there's gonna be some pushback , uh, on , on moving forward from some internal, well-meaning, you know, internal constituencies who may feel with some justification that any kind of material board involvement will be a mess. You know, it'll needlessly frustrate innovation and the institution's competitive advantage. Uh , I get that, and I'm sure you're in the same way. I've heard that over the last couple of years from internal tech executives, the researchers, the scientists, and the , uh, you know, the venture capitalists. Um, they're not impressed with the , uh, likelihood that the board board can contribute a lot here. And those are voices that should be heard as boards move forward , uh, to implement a formal oversight structure. But , uh, this, this once NACD came out with this report, you know , that's a train that has left the station. The , in my mind, a a healthcare company board that's involved with AI or should planning on being involved with AI that does not have a commitment to, for the board to be involved in oversight, is really, really , um, uh, playing with fire.
Speaker 3:So a lot of things in our field and in the law are gray . Sounds like this report is pretty clear .
Speaker 4:Well, that's the, that's the value of the report. And given NACD's credibility, it's gonna be hard to argue with that conclusion.
Speaker 3:Great. Well, Michael, thank you for bringing our membership up to date on this important development and for sharing your thoughts with us. We'll be back together next month for our next governance discussion. We'll, we'll do a wrap up on the top 10 governance trends of 2024.
Speaker 4:Well, thanks for the opportunity again, Rob and to our friends at A HLA , and we'll make sure that , uh, our , our topic for next , uh, month doesn't require you to read a hundred page report, even though I'm sure you'll be reading it meticulously over the next couple of days.
Speaker 3:Thanks again.
Speaker 4:Thank you.
Speaker 2:Thank you for listening. If you enjoyed this episode, be sure to subscribe to a HLA speaking of health law wherever you get your podcasts. To learn more about a HLA and the educational resources available to the health law community, visit American health law.org.