DPH CIO outlines AI safeguards, Microsoft Copilot rollout and Epic roadmap

San Francisco Department of Public Health Chief Information Officer Eric Raffman and Deputy CIO Jeff Scarfaria briefed the Health Commission on the department’s technology priorities, focusing on artificial intelligence governance, a city Microsoft Copilot roll‑out and continued Epic electronic health record work.

Raffman summarized recent policy and regulatory developments that shape DPH work: the state’s AB 3030 (noted in the briefing as AB 3,030) requires disclosure when healthcare communications are generated by AI and new city ordinance Chapter 22J requires a public inventory of AI systems. He said DPH’s AI policy prioritizes human oversight and “human warranty” — that is, clarity about where humans are responsible for review and clinical decisions.

Generative AI and enterprise tools Raffman said a recent internal pilot tested OpenAI’s ChatGPT for administrative tasks with several hundred users; the pilot excluded clinical data and did not use a business associate agreement. He said the city’s enterprise Microsoft agreement will soon permit a Copilot Chat product for staff, and DPH is finalizing technical and contractual reviews that will enable controlled deployment for employees with Microsoft accounts.

Epic roadmap and low‑risk AI use cases Deputy CIO Jeff Scarfaria described Epic priorities: consolidating specialty systems into the Epic platform, a major laboratory information system (Epic Beaker) project to unify separate labs, and cautious, purpose‑driven adoption of generative AI features. Scarfaria said the department will initially pursue lower‑risk AI deployments, such as automated claims appeals, where patient safety risk is limited, and will phase in clinician‑facing features after evaluation.

Data protection and consent Commissioners asked about patient privacy, HIPAA protections and tracing AI decisions back to inputs. Raffman said DPH will not deploy AI solutions that handle protected health information without a business associate agreement and contractual assurances about data handling. He cited Microsoft Copilot’s enterprise protections — a written commitment that customer prompts are not used to train models and a 30‑day retention limit — as examples of contractual safeguards. Deputy Chief Health Informatics Officer Nita Rutanel added that DPH requires consent and disclosure to patients when AI is used in clinical workflows and that patient experience teams will be involved in how such disclosures are made.

Why it matters: As DPH moves features into production, the commission and staff emphasized transparency, patient consent and staged testing. Raffman and Scarfaria said their teams will prioritize initiatives aligned with departmental strategy and continue to report on AI governance and Epic implementations.

Ending note The commission asked for follow‑up reporting on equity safeguards (bias mitigation and model evaluation) and for more detailed briefings as clinical AI pilots mature.