Public-health plans to deploy an outbreak-summary model on clinic notes. Which risk action should occur before deployment?

Deploying an outbreak-summary model on clinic notes involves sensitive municipal health data and stakeholder effects on patients, clinicians, and public-health decisions. Conducting an AI impact assessment before deployment evaluates privacy, fairness, clinical misuse, retention, and downstream decision effects so leadership understands harms and required treatments prior to exposure of notes to the model pipeline. Assessing only model performance benchmarks and vendor service levels leaves the deployment risks unaddressed, because benchmark scores and SLAs do not evaluate privacy, fairness, clinical misuse, retention, or stakeholder effects of summarizing live clinic notes. Assessing de-identified research datasets and academic publication risks evaluates the wrong context, because publication risks for de-identified data do not address the privacy, re-identification, fairness, and downstream decision effects of deploying the summarizer on identifiable production clinic notes. Assessing infrastructure scalability plans and cost recovery models focuses on capacity and funding rather than harm, so the deployment would be guided by scaling and cost projections before anyone has evaluated data sensitivity, fairness, and stakeholder impacts. Exam caveat: an impact assessment informs but does not replace required legal bases, BAAs where applicable, or clinical governance approvals. Operational check: require a completed AI impact assessment artifact—covering data classes, stakeholders, fairness, and residual treatments together—as a gated dependency in the deployment checklist before the outbreak-summary model touches production clinic notes.