Meghan O'Connor, a partner in Quarles & Brady's Health & Life Sciences Practice Group and co-chair of the firm's Artificial Intelligence team, was quoted in a Part B News article published 14 May 2026 on the challenges healthcare organisations face when deploying AI chatbots in patient-facing roles.
The case behind the coverage
The article centred on litigation brought by the state of Pennsylvania against the owner of Character.AI, alleging that the chatbot represented itself as a physician licensed in the state. It is the latest in a growing line of matters testing what happens when conversational AI crosses from information provision into something a patient reasonably reads as clinical advice.
For providers, the case is less about one vendor than about a category of exposure. Chatbots deployed for scheduling, triage or patient questions sit close enough to the practice of medicine that the boundary is easy to blur — and, once blurred, hard to defend retrospectively.
Documentation as evidence of due care
O'Connor's emphasis was on governance that leaves a paper trail.
"Providers should be prepared to document AI governance practices that courts may view as markers of due care, including risk identification, testing, monitoring and human oversight across the AI lifecycle," she told Part B News.
She framed each deployment as an occasion for formal analysis rather than a one-time procurement decision: "Practice management should consider each generative AI use case as risk analyses opportunities, including to demonstrate data flows, whether PHI is used for training or inference, appropriate compensating controls and HIPAA security safeguards, and a functioning governance program."
Two elements of that list carry particular weight in a healthcare context. The first is the training-versus-inference distinction: whether protected health information is merely passed through a model at inference time or retained and used to train it changes the HIPAA analysis materially. The second is human oversight — the record of who reviewed what, and when, is often the difference between a defensible process and an unexplained outcome.
When patients arrive with AI-sourced information
O'Connor has separately addressed the flipside of the issue — not the chatbot a provider deploys, but the one a patient consulted before the appointment. Her guidance there is procedural: correct the misinformation, document the conversation, and treat AI-sourced claims the same way a clinician would treat any patient-reported information that conflicts with clinical judgment.
That framing is deliberately unremarkable, and usefully so. It slots a novel input into an existing clinical workflow rather than requiring a new one.
The unresolved question
O'Connor has characterised the allocation of liability in healthcare AI as one of the most significant open questions in health law at present — one likely to take years of litigation to settle. Where responsibility lands as between model developer, deploying health system, and treating clinician has not been mapped by statute or precedent, and vendor contracts have so far tended to allocate it optimistically rather than clearly.
Until that clarifies, the practical takeaway from her comments is that documentation is the hedge available today. Organisations cannot control how courts will eventually apportion fault. They can control whether, when the question is asked, there is a record showing they identified the risks, tested the system, monitored it in production and kept a human in the loop.
Your membership also unlocks:
