1226: How States Are Bridging the Gap Between AI Policy and Public Health Practice

JOHN SHEEHAN: 

This is Public Health Review Morning Edition for Monday, October 19, 2026. I'm John Sheehan for the Association of State and Territorial Health Officials.

Public health agencies are adopting AI faster than many existing policies can keep up, creating new questions around workforce readiness, equity, oversight, and the use of AI in public health-specific workflows. Today, Greg Papillon, senior director for Public Health Partnerships and Innovation at ASTHO, discusses an analysis of 40 AI policies and action plans across 33 jurisdictions and what they reveal about the current state of AI governance. Greg and Andrea King of the Washington State Department of Health recently authored a blog on the topic.

Greg Papilllon, welcome to the show.

GREG PAPILLON: 

Hey, thanks for having me.

SHEEHAN: 

So, Greg, you reviewed 40 AI policies across 33 jurisdictions and found actually a lot of consistency around how states are approaching AI policy, but there are gaps between policy and practice. Walk us through that.

PAPILLON: 

Yeah, absolutely, and I'll I'll start with a bit of a shout out for my co-author Andrea King. She's with the Washington State Department of Health, and she also leads the the Public Health AI Collaborative. And she and I kind of worked hand in hand on this. What we found as we were compiling ASTHO's own resource library, that we released several weeks ago, was that we uncovered 40 different policies and action plans and different kinds of guidance documents spanning 33 jurisdictions, and what we found was, you know, we have these independently written policies that were landing on pretty similar provisions. Like, I think this is probably not all that surprising because there are pretty well-established guidance documents. Like NIST has an AI risk management framework that's pretty well accepted by state, federal, and local authorities. There was the since-rescinded White House AI Bill of Rights that a lot of folks look to, as well as some kind of EU and World Health Organization's guidelines. So I think a lot of these states and islands were looking at a similar kind of frame of reference. We were looking at jurisdiction-wide governance documents, so these weren't public health-specific. So what we're seeing now is we have agencies, a lot of which don't have health-agency-specific guidelines, are adapting to AI right now under policies that aren't really written for them. So that's one thing that we wanted to look at here.

SHEEHAN: 

And so you surfaced some questions, questions that agencies have and need guidance on versus what's actually in these documents.

PAPILLON: 

Yeah, I think, I mean, there were some areas that we expected to be pretty well covered. When you're building policies like this, it's often from an angle of risk mitigation. So we saw a lot of IT governance angles, so like data protections, security, and kind of the human-in-the-loop priority that you see, and a lot of things like this, but because they weren't public health-specific policies, you have some absence of evaluation criteria and approaches for public health-specific use cases like AI-assisted surveillance or training specifically for epidemiologists on responsible use, things like that, were not unexpectedly missing, but things that health agency leaders will need to factor in. And on that training point, we only saw, I think, it was nine of the 33 jurisdictions required training on AI literacy or readiness, things like that. So, in many cases those were fairly narrow. They were like, focused on executive audiences or technical audiences. So that's another thing. And I think as we see more action-oriented guidance or documents come out to complement the policies that may be more focused in this area of training and workforce readiness, and then another thing that we saw was an approach to consumer-level tools and what kind of data is appropriate for those tools. So a couple of states really focused on only using consumer tools, like we're talking about, like your web-based ChatGPT or Gemini or things like that- the ones that any kind of consumer can go on and use-focusing those on public or low-impact data only, and that limits some health-related work inherently, and that's where some of these things related to having like, an enterprise tool in place is really important. So I mean, this is it's a scope mismatch. It's not a failure of policy. These were never meant to be public health guidance, but it's an important consideration for health leaders.

SHEEHAN: 

And can you talk about the importance of human-in-the-loop and sort of like what it means to have actual human being oversight, especially as it pertains to public health workflows

PAPILLON: 

Yeah, yeah, I think a lot of folks at this point have probably heard this term "human-in-the-loop." This idea of having decisions ultimately made by humans, having a human as that kind of ultimate decision-maker, especially for things, you know, we had Colorado focus on this for things like benefit determinations and adverse actions. Illinois, for example, is like a bit more broad about how it should be applied. I think Pennsylvania had benefits eligibility and health and safety and welfare flagged for specific audit for this type of thing. So where it comes in from a practical standpoint for public health folks is: how do you approach this for things like case management, benefits eligibility, resource allocation? But we at ASTHO, I think, have been pretty careful not to prescribe what meaningful oversight looks like; I think it depends on the use case and on kind of the goals of the jurisdiction. There are natural trade-offs here in terms of how innovative of a use case are you looking at? How practical is it to actually have a human in the loop on things that are more automated versus less? But we're seeing in these policies that states are making a point of writing this into their governance to have a human in the loop and have it not be a fully automated workflow,

SHEEHAN: 

And sort of alluded to the idea that there are formal guidelines, and then there is just sort of the informal use that employees are using these tools for anyway. What kind of guidance would you give to agency leaders and officials who are trying to lay down guidelines for how you can use these tools appropriately?

PAPILLON: 

Yeah, I mean, we've seen uptake in particular around areas of kind of administrative and efficiency use, and I think that tends to be on that end of the spectrum that you described of the more kind of day to day use. And then what we're seeing, I think now and haven't seen as much to date, are some of these more public health-specific uses. But there's also the issue of we've seen the term shadow AI start to bubble up. We've talked about shadow IT for years, but shadow AI, meaning folks using AI tools in ways that aren't approved by their organization. I think there's this unique. It's a fairly unique tension around AI governance that we don't see in other IT governance exercises, where AI tools are just so accessible and can result in such efficiency gains that there's a unique pressure on agency staff to leverage that, especially staff that can be stretched fairly thin. So there's maybe more pressure than we've seen with other technology to even route around formal and approved uses with personal or free tools. So that's kind of a practical consideration for the folks who are designing these governance documents. There's more of a trade-off, a pragmatic trade-off than we might see in other situations. But we're seeing states certainly kind of prohibit free AI tools for certain uses and without prior written approval. And that goes back to this, you know, the consumer-grade tools that anyone can access. You know, several states had this written into their policies, but I think the caveat again is that prohibition alone doesn't fix the underlying pressure on staff to use these tools. So this goes back to the earlier kind of gap we talked about with skills and guidance and needing to kind of get staff to the point where they understand what the risks are and what the benefits are, and actually, this is a this is a good time with another blog we put out a few weeks ago. My colleague Ari Whiteman did a snapshot of Minnesota's journey in evaluating and launching some AI tools and really came away with a number of best practices and lessons learned. And one thing they talked about was investing in staff readiness and training before investing in tools. And I think this is a good example of that because staff who understand the risks and understand the benefits will be at lesser risk of running into those challenges, yeah.

SHEEHAN: 

For a long time, one of the pitfalls of AI was sort of this idea of repeating bias, repeating the biases of its creators, maybe biased inputs into AI, and sort of like eliminating equity across groups. What can agencies do to sort of combat that biased input problem?

PAPILLON: 

Yeah, so equity and bias is, I think, a recognized concern. Most policies name it as a concern. Few have kind of prescribed measures to address it. I think a couple exceptions where Oregon had a formal equity impact assessment in their policy. Connecticut had a similar impact assessment specifically around unlawful discrimination. So these are kind of two outliers, but the acknowledgement is there, and I think this is another area alongside training where, especially for public health, where inequitable access and other areas of kind of health inequity can be a key consideration, where we can step forward and advise on the right way to kind of address some of these concerns, because, to your point, it's really a product of the data that these tools and these models are trained on and built on. So we need to take measures to ensure that it's representative, that it is not kind of exacerbating these inequities.

SHEEHAN: 

Yeah, it feels like that discussion has somewhat gone away in recent months and maybe the past couple of years. For a long time, the worry was that, you know, these inherent biases of the inputs into these models would just like sort of further the biases of, you know, whoever is inputting them, which can have like meaningful impacts on, you know, underrepresented communities, and certainly for public health that's a real big consideration.

PAPILLON: 

Yeah, and it's, I mean, it's not a public health-specific challenge. I mean, there are so many things that are public health issues, but public health may not be the ultimate kind of driver of these things, but they they need to have a seat at the table for these kinds of measures to address risks and ethical considerations like this. Yeah.

SHEEHAN: 

So, what should what would be a big takeaway for agencies to think about as they look at their own you know governance structures and their own policies around AI?

PAPILLON: 

Yeah, I mean, I think the most important thing, and we call this out in the blog, is that agencies don't have to solve this alone. Like, that's why ASTHO is here. We will reconvene. You know, our informatics and data modernization network, who talk about this on a regular basis? We address this in convenings of our state health officials, and everybody is kind of addressing this at once and learning from each other. Some resources that we put out: I mentioned this AI and public health resource library. I think that's a really helpful resource that we've heard from folks. We can also support from a technical assistance standpoint. I mentioned that IDMN Peer Network also shout out Andrea King and the Public Health AI Collaborative again. They've been such great partners, and and there's a there's just kind of a growing ecosystem of thought leadership and thought partnership around AI and public health that we're pretty well tapped into and working really closely with. So I don't think we can rank any particular state approach as best. There are real trade-offs around kind of speed versus control and innovation versus risk. But there's always things that you can look at from your peers,

SHEEHAN: 

Greg Papillon. Thanks so much.

PAPILLON: 

Thanks for having me.

SHEEHAN: 

Greg Papillon is senior director for Public Health Partnerships and Innovation at ASTHO. He recently co-authored, "The Gap Between State and Territorial AI Policies and Public Health Practice," with Andrea King of the Washington State Department of Health. You'll find a link in the show notes.

The Public Health Data Consortium is an innovative partnership that expands public health agency across to real-world data to transform data into meaningful insights that strengthen public health intelligence and address critical population health challenges. Real-world data are health and care information collected during routine medical practice, and include laboratory results, clinical notes, pharmacy records, hospital visit details, billing information, and broader information about patient health and treatment outcomes. Learn more about the consortium at the link in the show notes.

ASTHO's Public Health Performance Management Solutions Showcase, taking place virtually on October 29, offers public health professionals an opportunity to explore solutions that can strengthen and support their agency's performance management efforts. Participants will hear from vendors and public health agencies about how different platforms and systems are being used in real-world settings, while gaining insights into key considerations for selecting and implementing a solution. Learn more at the link in the show notes.

This has been Public Health Review Morning Edition. I'm John Sheehan for the Association of State and Territorial Health Officials.