The Hidden Impact of the Texas DIR “AI System Facts” on Emergency Services Districts

Bob Janusaitis
19 hours ago
3 min read

Most Emergency Services Districts (ESDs) haven’t formally adopted artificial intelligence.

At least—that’s what they think.

But a simple document like the “AI System Facts” template tells a very different story—and signals a major shift in how Texas expects public agencies to govern technology.

🧠 This Isn’t Just a Form—It’s a Governance Test

At first glance, the document looks administrative:

What system are you using?
Does it use your data?
Is there human oversight?
Is data shared externally?

But read between the lines, and it’s asking something much bigger:

Do you actually understand how AI is being used in your organization—and can you prove it?

That’s a fundamental shift.

⚖️ The Shift: From “We Don’t Use AI” to “Prove It”

Historically, an ESD could reasonably say:

“We don’t use AI.”

That answer no longer holds up.

Why?

Because this template assumes:

AI may be embedded in vendor systems
Staff may be using AI tools informally
Data may be flowing into external systems without oversight

And now, you’re expected to document all of it.

🔍 What the Document Really Forces You to Do

Each section reveals a hidden risk area for EMS:

🔹 Data Sources & Usage

Are you feeding internal data into AI systems?

👉 Translation for EMS:

ePCR narratives
CAD notes
operational reports

If the answer is yes, you’re dealing with potential ePHI exposure

🔹 Data Sharing

Are outputs or inputs shared outside your organization?

👉 This is where things get serious:

Cloud-based AI tools
Third-party processing
Unknown vendor integrations

This is where HIPAA risk lives

🔹 Human Oversight

Is someone reviewing AI outputs?

👉 In EMS terms:

Are reports verified?
Are summaries accurate?
Are decisions being influenced?

No oversight = operational and liability risk

🔹 Data Retention

Is the AI system storing what you input?

👉 Critical question:

Did that patient narrative just become part of a model?

🚨 The Reality for Most ESDs

Even if your district has never “approved” AI, chances are:

Someone has used ChatGPT or Copilot for a report
A vendor has enabled AI features in the background
Staff are experimenting with tools on personal devices

That’s called shadow AI—and it’s exactly what this document is designed to uncover.

🔐 Why This Matters Under Texas Law

This isn’t happening in a vacuum.

The expectations behind this document align with:

Texas Government Code Chapter 2054
Texas House Bill 3512

And when you layer in:

HIPAA Security Rule requirements
Texas HB 300 (stricter privacy enforcement)

…it becomes clear:

AI is no longer a technology issue—it’s a governance and compliance issue

🧯 What Happens If You Ignore This?

Let’s make it real.

If an incident occurs:

Patient data entered into an AI tool
Data retained or shared externally
No documentation of use or controls

You’re left with:

No inventory
No oversight evidence
No defensible position

That’s where regulatory and legal exposure begins.

📊 The New Expectation: Ongoing AI Inventory

This document is pointing toward a new baseline:

👉 Every ESD should maintain:

A current list of AI systems
Data usage classifications
Risk levels
Oversight controls

Even if the list says:

“No approved AI systems in use”

You still need to show:

How you verified that
How you’re monitoring it
What controls are in place

🚑 What ESD Leaders Should Do Now

You don’t need to overcomplicate this—but you do need to act.

Start with three steps:

1. Identify

What tools are being used (formal and informal)

2. Document

Use a structured inventory approach

3. Control

Establish basic policy and oversight

🧭 Final Thought

The “AI System Facts” document isn’t about paperwork.

It’s about accountability.

It’s about moving from:

“We think we’re fine”

to:

“We can prove we’re in control.”

And in today’s regulatory environment—that’s the difference that matters.

If your agency hasn’t taken a formal look at AI usage, now is the time.

Because whether you’ve approved it or not—AI is already in your organization.

EMSCyber360 can help you navigate this complex regulatory environment.