When No One Can Say Stop: AI Governance and the Independent Practice

That sentence, from Dan Noyes's recently published governance framework, names a structural problem that most AI compliance conversations never reach. The governance discussion in healthcare has been dominated by documentation requirements, audit trails, and BAA coverage. Noyes shifts the question to something more fundamental: who has the authority to stop an AI system from acting, and what happens when someone inside the organization disagrees with what it is doing?

For health systems, the problem Noyes describes is one of asymmetry. Clinical override exists, but it carries administrative friction. Structured dissent exists, but it is documented unequally. The governance policy says one thing and the workflow architecture does another.

For independent practices, the problem precedes that one entirely.

Most Independent Clinics Have No Stop Rules at All

A stop rule is a defined boundary baked into an AI workflow: this decision requires a human gate before the system proceeds. Not a recommendation. Not a best practice. A structural constraint that prevents autonomous action past a defined threshold without documented human authorization.

In a health system with a mature governance program, stop rules are part of the AI deployment architecture. They are deliberate, reviewed, and enforced at the workflow level. When Noyes argues that these rules must be explicit, he is addressing institutions that have some version of them but have allowed the workflow architecture to quietly erode their force.

In most independent practices, the architecture conversation has never happened. The AI scheduling agent operates without a defined scope of authority. The ambient documentation tool generates legal medical records without a documented human review gate. The billing automation resubmits claims without a threshold above which a human must authorize the action. There are no stop rules because no one has defined where stopping is required.

Read those numbers together. More than half of medical group leaders have no governance structure. And even in organizations that do have one, nearly three quarters of the clinical workforce operating under it are unaware it exists. The stop rules that protect patients and practices are absent at the design level and invisible at the operational level.

Structured Dissent Has Nowhere to Go

Noyes grounds his argument in a peer-reviewed finding that deserves more attention than it receives. A 2024 meta-analysis across 570,776 prescriptions found that physicians overrode AI drug-drug interaction alerts at a rate of 90 percent. The researchers concluded that when override carries friction and compliance does not, the institution shifts decision rights to the machine regardless of what its governance policy states on paper.

That is the asymmetry problem. It is real and well-documented. But it assumes a clinical environment where override is at least possible, where a channel exists for a clinician to say "I disagree with this recommendation" and have that disagreement recorded somewhere.

In most independent practices, that channel does not exist. When a clinician in a 4-provider practice disagrees with an AI recommendation, there is no override record, no feedback pathway, and no pattern analysis across dissent events that might surface a systematic model error before it becomes a harm event. The disagreement disappears. The AI continues operating as if the disagreement never happened.

Clinical Authority Over AI Must Exist Somewhere on Paper

Noyes frames documentation parity as the required operational baseline: the administrative effort required to reject an AI recommendation must match the effort required to follow it. That is the right standard for institutions that already have a governance architecture to enforce it against.

For independent practices, the baseline is further back. The first requirement is simply that clinical authority over AI decisions exists somewhere in a document, a workflow, or a recorded event. Right now, for most independent practices, it does not.

This matters beyond the ethical argument. The 2026 regulatory environment is moving toward explicit oversight requirements for clinical AI. By mid-2025, over 250 healthcare AI bills had been introduced across more than 34 states. The Colorado AI Act mandates disclosure and opt-out mechanisms for AI use in healthcare. OCR enforcement of HIPAA audit controls extends to AI systems processing ePHI autonomously. The practices that have documented clinical authority structures, stop rules, and override records when these requirements become mandatory will answer those questions with evidence. The ones that do not will be building under pressure.

Stop Rules and Structured Dissent Require Governance Infrastructure

Stop rules and structured dissent are not policy documents. They are operational capabilities. A stop rule only functions if it is embedded in the workflow architecture and documented in a compliance record that can be audited. Structured dissent only functions if the override event is captured, timestamped, and reviewed in a systematic way.

Veriphy, at comply.elevarehealth.ai, is the governance infrastructure layer that makes both possible for independent practices. The Agent Workflow Registry defines the scope of authority for every AI agent operating in your practice, including the explicit human review gates that constitute your stop rules. The Coordination Event Log captures AI agent activity and override events in a documented, auditable record. Together they give independent practices what Noyes calls the operational baseline: documented evidence that clinical authority governs AI behavior, not the other way around.

The practices that build this infrastructure now are the ones that will answer the sovereignty test with evidence when the regulatory and payer environment requires it. The window to build it cleanly, before the AI stack grows complex enough to make governance difficult, is shorter than most practice administrators realize.

This article is part of Elevare's ongoing AI Governance Series. For related reading see: Agentic AI Is Coming to Your Clinic. Who's Governing It? and The Clinics That Govern AI Well Will Outperform Those That Don't.