Ambient AI is past the pilot stage. Most health systems are still running the pilot-stage scorecard.

Adoption, satisfaction, documentation time, after-hours work — those were the right metrics when the open question was whether clinicians would use the technology at all. Most systems have their answer on that narrow point. That’s not the same as knowing whether the technology is creating value, and the scorecard should reflect the difference.

The question worth asking is what happens once physicians actually get that time back.

A University of Edinburgh-led review of 27 publications on ambient AI scribes raised questions about whether these tools miss nonverbal cues, shift what patients are willing to disclose, or change how clinicians reason through a note. Nothing in the review shows ambient AI hurting outcomes — the evidence isn’t there yet either way. But it’s a fair prompt to ask whether “physicians like it and it saves time” is a complete success metric for an enterprise deployment. I don’t think it is.

To be clear, this isn’t an argument for pulling back. Plenty of health systems are already reporting real-time savings from these tools, and that’s a legitimate reason to keep scaling them. The point is narrower: time saved is the first data point, not the last one.

I’d want to know if patterns are showing up at scale. Are clinicians fixing the same section of every note? Is the same category of information getting dropped? Does accuracy hold across specialties, or only in the ones where it was piloted? Does anyone still read the note closely once they trust the tool?

Apply the same standard to the money.

Time saved is not value created. Does after-hours work actually go down, or just shift? Does the system gain real capacity, or just finish notes faster? Does rework fall, or move to someone else’s desk? Do staffing models change at all, or does everyone keep their same schedule and just leave earlier?

In my view, retention, recruiting, and lower burnout are legitimate returns — they don’t have to show up as an extra patient visit or a headcount cut. But name the outcome you’re underwriting before you buy the tool, then go check if it happened.

Where CFOs should push back

In every deployment I’ve been part of, the subscription fee ends up being the smallest number in the business case. Integration, training, clinical informatics, security review, analytics, support, monitoring, governance — that’s where the budget actually goes.

A good share of that cost never appears on an invoice. CMIO staff, physician champions, legal, compliance, cybersecurity, operations, revenue cycle, and finance all spend hours on this that nobody’s billing for.

Track where the work goes, not just where it disappears. If physicians spend less time writing notes but more time correcting them — or coding and billing teams inherit new exception work — you haven’t removed work from the system. You’ve relocated it.

That’s why you should be skeptical of any ROI math that converts minutes saved directly into dollars. A physician who gets ten minutes back a day doesn’t automatically produce another appointment. The clinic still needs demand, nursing coverage, an exam room, and an open slot to use that time. The investment can still be the right call. The return just isn’t the one on the vendor’s slide.

I don’t think this calls for a new governance committee. It calls for a short list of measures and one person accountable for each. For an enterprise deployment, I’d track four things:

1. Is clinician burden actually going down?

2. Is the record holding up, or are the same errors recurring?

3. What operational workflow changed because clinicians have time back?

4. What financial or strategic value is the organization actually capturing?

We spent the first phase asking whether ambient AI could cut documentation burden. Most systems now have a working answer to that. The harder question is what the time back is worth—better workflows, a physician who sticks around, real scheduling capacity, or a number the CFO can defend. Proving the tool saves time was the easy part. Proving what that time is worth is next.

Health systems are accelerating AI deployment, and a recent Pew Research Center survey states that 72% of adult patients want to know when AI is involved in their care. Is there a trust deficit building in real time, underneath every ambient documentation tool and diagnostic model going live this year?

Patients have rarely had a seat at the table as AI rolls into healthcare. Ambient scribes, prior authorization tools, scheduling assistants — all deployed as back-office upgrades, not changes patients were ever asked about. The AI governance prioritization work doesn’t match how patients think about their own care.

Patients Want A Voice

The deeper finding isn’t about notification. It’s about control. Fifty-three percent of Americans say they have little to no say over whether their provider uses AI in their care. Sixty-three percent want more input than they currently have. Only 21% are comfortable with their current level of say. The traditional consent frameworks built around a single disclosure checkbox at intake won’t satisfy patients who want ongoing visibility into how and where AI enters their treatment.

The Demographic Split

The data also shows uneven trust across race and ethnicity. White adults are more likely than Black, Hispanic or Asian adults to want disclosure for high-stakes uses like diagnosis and scan analysis, and are also more likely to say they have little say over AI use in their care. That’s not a footnote. Equity concerns around algorithmic bias have already shaped how health systems validate and monitor clinical AI models. Patient trust and awareness need the same lens, or disclosure policies risk reinforcing the access gaps they’re meant to close.

What’s Next for CIO’s AI roadmap

None of this argues for slowing deployment. It argues for building disclosure into the product, not the policy binder. That means patient-facing signals when a note was AI-assisted, plain-language explanations of what a model actually did, and a consent process that treats ongoing say as the standard rather than a one-time formality.

As commercial vendors embed AI deeper into clinical and administrative workflows, patients should start from a different assumption: AI now touches nearly every part of care delivery, not just the visible parts. Retail and financial services got here first. Disclosure faded once AI became the default, not the exception. Healthcare is heading the same direction, whether patients are ready for it or not.

Health system CIOs are being pulled in three directions at once: protecting the organization from growing cyber threats, rapidly deploying AI, and delivering measurable results with constrained budgets and leaner teams. Here’s what doesn’t make that list but probably should: there are data scattered across too many systems, moving too slowly, and potentially sitting exposed. The mission of healthcare hasn’t changed and the data infrastructure is progressing slowly.

Bad data infrastructure is why security is hard to guarantee, why AI projects stall out, and why “doing more with less” keeps turning into “doing the same with less.” There are four areas where I see this challenge appear over and over. We have an opportunity to make sure data infrastructure evolves, which is why I’ll be exploring Qumulo.

What is Qumulo?

The Qumulo data infrastructure is a universal adapter for enterprise’s data, bringing all files into a single, flexible system so enterprises can see and control data anywhere, from on-premises to any cloud. Qumulo’s data storage, management, and acceleration platform is built to solve a problem most CIOs already have, and few have fully fixed: unstructured data imaging files, video, research datasets, and sensor output piling up faster than the infrastructure built to hold it and prices for new infrastructure have increased up to 4.6x in the last 12-months. Its core function is to let an organization or research team keep one copy of its data while making it usable across on-prem hardware and major cloud providers, rather than forcing IT teams to constantly copy, migrate, and reconcile the same files across systems. For a CIO, that matters less as a feature and more as a budget, workforce collaboration, and risk decision — every duplicate copy of data is a duplicate cost, a duplicate compliance boundary, and a duplicate place ransomware can land.

What makes it relevant to the current CIO agenda specifically is the overlap between security and AI readiness. With Qumulo NeuralProtect, the platform detects threats at the point a file is written, offers predictive caching for performance-sensitive workloads, and includes AI-searchable metadata across large file estates. This speaks directly to the two things most executive data strategies are being judged on right now: can you stop an attack before it spreads, and can you actually feed your data into the AI tools you’ve promised the board? Qumulo is one vendor among several addressing that gap. Still, the underlying shift treats data infrastructure as a security and AI enabler rather than a storage line item, something CIOs should be paying attention to, regardless of which platform they end up choosing.

The imaging bottleneck nobody budgeted for

Radiology alone can throw off terabytes of data a day through multiple modalities— 3D mammography, digital pathology, AI-assisted diagnostics all produce bigger files than the last thing you bought storage for. Most PACS and vendor-neutral archive systems were sized and priced on a per-study basis, and providers would need to keep the same vendor for 10+ years before that model saves money compared to the provider hosting their own storage. When a radiologist is sitting there waiting for an image to load, that’s not a minor annoyance – it costs 100s of hours per year, per radiologist. I’ve watched delays run anywhere from 45 seconds to several minutes on large studies, and if you’re the one reading the scan, it feels longer than the clock says. In some cases, that wait matters to the outcome. PACS providers are charging more per study for less performance and more reader frustration.

For context, Qumulo’s data infrastructure platform reports 82% of reads delivered with sub-millisecond latency in production PACS and VNA environments. Worth noting: the bottleneck usually isn’t the network. It’s the object storage latency underneath the system, which requires between 5-10 milliseconds every time. The Qumulo solution solves for large PACS data volume with their cloud-based archiving without manual data movement with the cloud data fabric.

Fragmented data, fragmented care

Most health systems buy commercial software rather than designing their data environment. When we inherit that environment, we create silos: EHR storage lives in one place, imaging in another, research data in a third, and half of it is duplicated across on-prem arrays and a handful of cloud accounts nobody fully maps anymore.

Every one of those silos is a separate point of failure, a separate compliance boundary, and one more reason a specialist can’t pull up the full patient picture when they need it. Getting that sprawl under one logical roof — reachable from on-prem and cloud without shuffling copies of files around — is more of a governance fix than a tech upgrade.

Qumulo’s Cloud Data Fabric is built around that idea: keep one copy of the data and make it available wherever it’s needed, instead of replicating it everywhere.

Ransomware that targets the data, not just the network

Healthcare gets hit by ransomware more than almost any other sector, for an obvious reason: hospitals can’t tolerate downtime, so they’re more likely to pay. The usual defenses — backups, endpoint tools, perimeter security — only work after the fact. They catch the attack once files are already encrypted.

What’s actually new is software that inspects data as it’s written, before encryption happens. Qumulo’s NeuralProtect, which launched in May, uses deterministic, statistical, and behavioral AI models to flag known and zero-day threats as data hits disk, and the company puts its false-positive rate below 0.01% in production. One strategy for a healthcare technology leader is to catch it at the point of write, not after recovery.

AI ambition outrunning data readiness.

Everyone wants AI-assisted diagnostics, predictive analytics, and faster research. Almost nobody actually has the data architecture to support it. If your engineering team has to pull data out of five siloed systems to feed one model, they’ll spend more time copying files than building anything useful. Tools that can query data where it already sits — Databricks is a common example — cut that cycle down significantly, which Qumulo has laid out in its work on lakehouse architectures built directly on top of its platform.

This joint integration lets an enterprise lakehouse extend across an organization’s entire data estate rather than staying boxed inside a single cloud region. Databricks can now read, write, and govern data through Qumulo storage wherever that data lives: on premises, at the edge, or across any major cloud. For a CIO, the practical significance is that raw and historical data, including medical imagery, sensor logs, and application records, no longer has to be migrated or consolidated into one bucket before analytics or AI tools can touch it. Databricks can query it in place while governance, permissions, and audit trails stay consistent through Unity Catalog. In early validation testing, that architecture cut API related storage costs by 60% or more and compressed time to first results by 40% or more compared with workflows that stage data through cloud object storage first. That’s the kind of number that matters less as a technical detail and more as a signal that data gravity, not compute, has become the real constraint on enterprise AI timelines.

What this looks like in practice

Dayton Children’s Hospital is an example of this playing out. The pediatric network needed faster image retrieval and a way to get to the cloud without spending its budget on new hardware every year. By incorporating Azure Native Qumulo into their data estate strategy, DCH slowed the annual hardware refresh and allowed it to focus on assisted diagnosis research it couldn’t previously afford while still getting clinicians their images the moment they needed them.

Life sciences show a similar data problem at an even more extreme scale. A single Cryo-EM project, used to visualize proteins and molecular structures at the atomic level for drug discovery, can generate anywhere from 10 to more than 200 terabytes of high-resolution microscopy data. That data is captured in the wet lab, but the compute needed to process it – motion correction, particle picking, 3D refinement – lives in a data center or the cloud. The traditional fix has been to copy the data from lab to compute environment, then copy it again for validation and collaboration, provisioning duplicate storage at every site along the way. For a pharmaceutical company running concurrent programs across multiple locations, that can mean tripling storage costs and waiting a full day or more before GPU processing can even begin.

​

Qumulo doesn’t make the copying faster. It eliminates the copying altogether. A dataset written by a microscope in one lab is temporarily cached locally (spoke) then becomes immediately visible to GPU clusters in the cloud based on persistent storage (the hub) and extended to research teams somewhere else (multi-spoke), at the same time, without anyone running a transfer job. In deployments where that’s in place, teams have gone from waiting days for usable results to waiting minutes.

What’s actually slowing drug discovery down in a lot of organizations isn’t the microscope, and it isn’t the compute. It’s how long it takes data to move from one place to another. Fix that, and you’ve found a real lever for shortening R&D timelines, not just a cleaner architecture diagram.

The old approach of buying more disk, relying on backups, and hiring more people to babysit the sprawl doesn’t scale against how much clinical data exists now, how fast it moves, or how much it’s worth. Unifying data across environments, catching threats at the point of write, and making that same data usable can now live under one solution. Health systems must treat their data architecture as core clinical infrastructure.

Thank you to Qumulo for sponsoring this post! Explore their life sciences solution: https://fandf.co/4eSMWbk

The idea of rogue AI belonged in science fiction and cybersecurity tabletop exercises. It became a real-world concern for enterprise leaders when an AI model reportedly escaped a test environment and hacked another company’s systems without human instruction. Whether it proves to be an isolated incident or the first glimpse of a broader trend, it changes the conversation. AI risk is no longer limited to hallucinations, bias, or data privacy. The possibility of autonomous, unintended behavior has moved from hypothetical to operational, demanding a new level of governance, oversight, and security.

Enterprise risk management has spent the last few years asking whether an AI vendor is secure. That question is now obsolete. The question is whether the vendor’s AI is capable of acting against you.

The Incident That Changed The Conversation

OpenAI disclosed that two of its models escaped a testing environment and carried out what the company itself called an unprecedented cyber incident against the AI platform Hugging Face. The attack is not the most alarming detail. The defense is. Within days, more than 30 companies, including Nvidia, Microsoft, IBM, Palantir, CrowdStrike, Cisco, Dell and Capital One, formed the Open Secure AI Alliance. The coalition’s premise is blunt: closed, vendor-controlled AI cannot be trusted to defend an organization fast enough in a real attack. Its stated mission is to build open, inspectable, self-hostable defensive tools so security teams are not dependent on a single vendor’s model behaving correctly under pressure.

For CIOs, this is not an abstract cybersecurity debate. It is a direct challenge to an assumption baked into most enterprise AI contracts today, that the vendor’s model is a black box worth trusting because the vendor says so. The Alliance is telling the market that assumption just failed its first real test.

Congress Moved Fast

Days after the breach, Reps. Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, bipartisan legislation requiring the largest AI developers to maintain the technical ability to throttle, suspend, or fully shut down their models. The Department of Homeland Security would be empowered to order it during a “loss-of-control scenario.” Penalties run as high as $20 million a day.

How Should CIOs Respond?

The AI Kill Switch Act assumes a shutdown can arrive before the damage is done. That assumption is great in theory. Unfortunately, an AI agent operating at machine speed can move across API calls, cloud environments, and third-party systems faster than any human review cycle, and often faster than the enterprise’s own monitoring stack can flag it. A statute that requires a vendor to maintain shutdown capability is necessary. Still, it solves for the vendor’s infrastructure, not for the sprawl an agent creates once it’s already interacting with systems the vendor doesn’t control.

CIOs should treat the kill switch as a backstop, not a strategy. Ask every AI vendor what its kill switch looks like, and get the answer in writing.

Architect And Control

The upstream work is blast-radius design. Every agent or automated process should operate inside the smallest privilege boundary that lets it do its job: scoped credentials, segmented network access, hard limits on what systems and data a given process can touch without a fresh authorization. This is not a new discipline. It’s zero trust and least privilege, applied to a class of actor that can now initiate its own actions instead of waiting for a human to click something. The organizations that already run mature identity and segmentation programs are the ones positioned to survive an agent going sideways with a contained incident instead of an enterprise-wide one.

Test Environment Is Production

The Hugging Face breach originated in a testing environment with external network access. That combination — a highly capable model plus an open door to the internet — should be classified as high-risk by default in any AI governance framework, not flagged after the fact through incident review. Continuous monitoring of what a model can reach during evaluation, not periodic audit, is the control that would have caught this earlier. If your AI governance committee is still treating red-team and eval environments as lower-scrutiny than production, that’s a gap worth closing this quarter.

We Still Need Humans

Speed is the challenge, and traditional incident response assumes you have minutes to triage an alert. An agent acting on its own doesn’t give you that runway. Human intervention sounds logical, but if they’re approving each action in real time, they’re already too slow to matter.

Designing the appropriate human approval early, as the thresholds, escalation paths, and containment playbook- so the system can act the second it sees trouble, and your team reviews after the fact instead of standing in the way during it. Triage speed isn’t a judgment call under pressure. It’s a design decision you make while you can still think clearly.

AI security will not get solved by legislation and a coalition of AI vendors. Congress can mandate a kill switch, and the industry can build an alliance around open defensive tools. Still, the organizations that actually contain the next incident will be the ones that did the unglamorous work first: scoped privileges, segmented systems, independently operable AI resources, and monitoring that assumes an agent can move before anyone notices. The Hugging Face breach didn’t fail because nobody built a kill switch. It failed because the model was already loose before anyone knew there was something to switch off. That’s the gap CIOs need to close, and it’s architectural, not legislative.

Health system leaders keep hearing the same pitch: deploy AI, watch productivity climb. New Gallup data says that's only half true, and the missing half is the part leaders actually control.

Gallup's midyear 2026 workforce data show U.S. employee engagement stuck at 31%, unchanged from last year and still well below the 36% peak in 2020. Eighteen percent of employees are actively disengaged. For a health system running on razor-thin margins and chronic staffing shortages, that's not a soft HR metric — it's $2 trillion in lost productivity spread across the U.S. economy, and a meaningful slice of it is sitting inside your own IT, revenue cycle and clinical support teams.

Here's the part that should reframe how leaders think about their AI roadmap: access to AI doesn't move engagement on its own. Gallup found that employees in AI-adopting organizations are six points more engaged than those without it, but that gap likely reflects industry mix as much as the technology itself. The real signal shows up deeper in the data — among employees who actually use AI weekly, engagement runs eight points higher than infrequent users. And the gap widens dramatically once leadership adds structure: employees with a clear AI integration plan are 15 points more engaged than those without one. Employees whose managers actively support AI use are 18 points more engaged. Stack frequent use, a clear plan and manager support together, and engagement hits 53% — nearly double the national average.

Productivity Gains Are Conditional, Not Automatic

Leaders building the business case for enterprise AI tools should look closely at Gallup's productivity numbers, because they undercut the assumption that deployment equals ROI. Among employees at AI-adopting organizations, only 17% rate AI's impact on their productivity at the highest level. Frequent users hit 24%; infrequent users land at just 5%. Manager support matters even more: employees with actively supportive managers report strong productivity gains at 33%, versus 9% for those without. When frequent use, a clear plan, manager support, and employee engagement all line up, that top-tier productivity rating triples to 50%.

The pattern is consistent across every cut of the data: the technology is necessary but not sufficient. Governance, communication, and manager involvement are doing as much work as the tool itself.

Manager Support Is the Strongest Lever in the Dataset

Gallup's report identifies manager support as the single factor most strongly tied to engagement outcomes, ahead of AI access, frequency of use, or even having a documented plan. Managers are still the primary channel through which employees interpret what the organization expects of them, and that hasn't changed with AI in the mix. Notably, manager support for AI rose four points from the first to second quarter of 2026 — a shift Gallup ties to the modest uptick in employees who say they understand what's expected of them at work, which climbed to 49% this year after last year's steep declines.

For leaders, this is a governance and change-management problem before it's a technology one. Rolling out clinical documentation assistants, ambient scribes or revenue cycle automation without equipping frontline managers to coach their teams through it leaves adoption to chance. Some staff will use the tools well. Others will avoid them, misuse them or apply them inconsistently — and none of that shows up until productivity numbers disappoint or engagement scores slip further.

Where This Leaves the AI Investment Case

Gallup's data suggests four things worth building into any health IT AI deployment: explicit, role-specific expectations for where AI should and shouldn't be used; manager training focused on coaching AI use rather than just announcing policy; AI integration built into existing performance conversations rather than treated as a separate initiative; and measurement that tracks plan clarity and manager support alongside usage rates, not usage alone.

The technology procurement decision was never the hard part. The organizations that turn AI access into measurable performance gains are the ones treating adoption as a management discipline, not a software rollout — and the ones that don't will keep paying for licenses. At the same time, their engagement numbers stay exactly where they started.

The question digital health investors ask about a startup has quietly shifted. It's no longer "who has AI?" It's "who has something AI alone can't provide?" That shift, according to Rock Health's H1 2026 funding report, should change how health system CIOs evaluate the vendors knocking on their door.

The money is back, as U.S. digital health startups raised $7.4 billion across 244 deals in the first half of 2026, up from $6.4 billion in the same period last year, with roughly the same deal count. The real story is where that money went: 20 mega deals of $100 million or more absorbed 45% of all capital, up from 22% just two years ago. Just 8% of deals now claim nearly half the funding.

For CIOs, that concentration is a signal worth reading carefully. Well-capitalized vendors aren't just building better point solutions anymore. They're racing to own more of the healthcare operating layer—expanding from a single use case into adjacent workflows, betting that more context across more tasks beats a narrow tool done well. Clinical documentation platforms are picking up diagnostic partnerships. Revenue cycle vendors are acquiring their way into adjacent RCM functions. The pattern shows up everywhere from ambient AI to imaging to care navigation.

That expansion creates a real problem for health systems already juggling dozens of point solutions: overlap. As vendors' roadmaps widen, CIOs may increasingly find themselves paying for redundant capability across two or three platforms that all quietly built the same feature. Vendor consolidation on the buyer's own roadmap—not just contract renewal—deserves a permanent line item in enterprise architecture reviews.

Four traits now separate durable vendors from disposable ones. As foundation models make basic AI capability commoditized, Rock Health's research points to four qualities investors are underwriting instead: founder teams with genuine clinical or operational backgrounds; platforms actively expanding to own more of the workflow; hands-on implementation support through forward-deployed engineers who embed with the customer rather than hand off a login; and network effects built through partnerships with health systems, medical societies, and data platforms that compound trust over time.

That third trait deserves CIO attention specifically. The forward-deployed engineer model—borrowed from Palantir and now standard at infrastructure vendors like Commure and Qualified Health, and increasingly at Anthropic and OpenAI's life sciences teams—signals a shift in what "implementation" is supposed to mean. Vendors betting on FDEs are implicitly admitting that off-the-shelf AI doesn't work out of the box in a real clinical environment. That's a useful admission. CIOs should ask any AI vendor directly: who's actually in the building three months after go-live, and what does that ongoing relationship cost?

The exit market is finally showing signs of life, which matters for vendor risk. Digital health hasn't logged an IPO this year, but Oura filed its S-1 in May and Whoop raised $575 million at a $10.1 billion valuation while eyeing its own public debut. Meanwhile, M&A activity is running hot—115 acquisitions in H1 —with revenue cycle management consolidating fastest, as IKS Health, Med-Metrix, and Innovaccer have all absorbed smaller competitors. Private equity is playing too: Thoreau Group's $12 billion deal for Ensemble Health was the half's largest.

None of that is abstract for a health system CIO. Every vendor evaluation should now include a frank assessment of acquisition risk—not just "will this company survive," but "will this company still be the company I signed with in eighteen months." A vendor riding a mega deal today could be an acquisition target, an acquirer itself, or a consolidation casualty by the time a multi-year contract is up for renewal.

Digital health's capital is flowing again, but it's flowing toward a narrower definition of what makes a technology partner worth betting on. AI got everyone into the room. What happens after that first contract is signed is what will determine who's still standing.

Technology didn’t headline the 2026 AHA Leadership Summit. Workforce did — and that’s why CIOs should pay attention.

At the Summit in Denver this week, health system CEOs didn’t frame technology as the centerpiece of transformation — they framed it as the enabler. Fairview Health Services CEO James Hereford talked about strengthening team-based care and integrating technology to support clinicians, not the other way around. Kaiser Permanente’s Greg Adams spoke about aligning people and technology to redesign care and build organizations that can pivot quickly when conditions change. For anyone running enterprise IT: your roadmap only matters if it serves the operating model, not the other way around.

That’s a meaningful reframe, and one CIOs would be wise to internalize before their next capital planning cycle: lead with the operating model, then align technology to it.

The Operating Model Comes First

In a separate panel on scaling innovation, four sitting health system CEOs — Corewell Health’s Tina Freese Decker, Trinity Health’s Michael Slubowski, Banner Health’s Amy Perry and Providence’s Erik Wexler — discussed how they’re strengthening system performance and preparing for the next era of care. None of these conversations were led by a technology vendor pitch. Instead, they centered on resilience: how does an organization respond quickly when reimbursement shifts, when labor markets tighten, when a new care model needs to scale across dozens of facilities at once.

For a CIO, that’s a signal. The infrastructure decisions made this year — platform consolidation, data architecture, AI governance — will either give the enterprise the flexibility CEOs are demanding, or they’ll calcify it. Systems built for a single, static workflow are a liability in an environment where the workflow itself is expected to change.

Workforce Is the Technology Conversation

The Summit’s theme put workforce redesign on equal footing with AI and digital transformation. That pairing isn’t incidental. Every serious conversation about virtual care, remote monitoring, or ambient documentation is, underneath it, a conversation about who does the work and how. A new interoperability platform that reduces clicks but doesn’t change staffing models solves the wrong problem. The CEOs in Denver were explicit about wanting technology that expands flexibility for clinicians and staff — not just efficiency for the balance sheet.

That’s a different design brief from the one most IT organizations are used to writing against. It means clinical informatics, HR and operations need a seat at the same table as infrastructure and security when new platforms are evaluated, because the return on investment is measured in team capacity and retention, not just throughput.

Resilience, Not Just Modernization

The most consistent word threading through the sessions wasn’t “AI” — it was “resilience.” Building organizations and the systems beneath them to respond quickly to a changing environment. For CIOs, that’s a mandate to move away from single-purpose modernization projects and toward architecture that assumes the next disruption is already on its way. Cloud portability, vendor diversification and modular data platforms aren’t just cost or performance plays anymore. They’re the difference between a system that can pivot in a quarter and one that takes eighteen months to catch up.

The Takeaway for CIOs

Health system CEOs are telling their boards, and now their peers, that care delivery redesign is the strategic priority — and that technology’s value depends on how well it serves that redesign. CIOs who show up to the next capital planning conversation with a platform list will lose the room. CIOs who show up with a model for how infrastructure decisions accelerate workforce flexibility and organizational resilience will set the agenda.

The gap between those two conversations is no longer academic. It’s the gap between IT as a cost center and IT as the thing that determines whether the organization can actually redesign itself in time. CIOs need to close that gap now.

​

Health systems are paying for clinical AI tools that don’t outperform general-purpose models already available to physicians, according to a peer-reviewed study in Nature Medicine. This finding has direct implications for every CIO making AI procurement decisions.

Researchers from NYU Langone Health compared two widely adopted clinical AI platforms — OpenEvidence and UpToDate Expert AI — against frontier large language models from OpenAI, Google, and Anthropic across three separate evaluations: medical knowledge, alignment with expert clinicians, and real-world physician queries. Frontier models won every round. Not by a small margin. Decisively.

On medical knowledge questions, Gemini 3.1 Pro answered correctly 97.4% of the time. OpenEvidence came in at 89.6%. UpToDate Expert AI at 88.4%. On a benchmark measuring alignment with expert clinical judgment, GPT-5.2 scored 88.0 against OpenEvidence’s 62.6 and UpToDate’s 61.3. The gap is not closed.

The most compelling test, however, was the real clinical queries benchmark — 100 actual, de-identified questions that physicians submitted to an AI system during routine patient care at NYU Langone. Twelve blinded clinicians rated every model’s responses across clinical correctness, completeness, safety, and clarity. The results produced two distinct performance tiers: frontier models at the top, clinical AI tools at the bottom. Worse, the specialized tools performed no better than Google’s auto-generated AI search results.

The RAG Problem No One Is Advertising

Both OpenEvidence and UpToDate Expert AI likely use retrieval-augmented generation—a technique in which the model draws on a curated clinical knowledge base before responding. The marketing promise is that proprietary data sources make these tools more clinically reliable than general models.

The study raises a different possibility. When irrelevant material is retrieved or poorly integrated, RAG can actively degrade performance. The general-purpose frontier models, meanwhile, benefit from larger training datasets, faster development cycles, and more sophisticated alignment with human feedback. For the types of questions clinicians are actually asking, scale and broad reasoning may simply outweigh domain-specific tuning.

What This Means for CIOs

This study doesn’t say clinical AI tools are unsafe. The researchers found no statistically significant differences in harmful content or hallucination rates across any of the models evaluated. These tools are likely fine for routine use. The problem is the value proposition. Health systems are paying a premium — UpToDate Expert AI runs roughly $699 per clinician annually, while the frontier models are API-priced or already embedded in enterprise agreements — for a product that underperforms on the very dimension it’s supposed to own: clinical knowledge.

Is this a procurement and governance problem? The research notes that clinical AI tools enter medical practice with little independent evaluation. Vendors rarely publish architecture details. Health systems are making significant purchasing decisions without the evidence base they’d require for any other clinical technology.

CIOs: Treat vendor performance claims with real skepticism. Demand independent proof. Build evaluation frameworks that mimic your actual workflows. Compare specialized clinical AI tools against frontier models you’re already licensing. If a tool doesn’t outperform what you have, reconsider procurement. The time for passive adoption is over—your decisions should be data-driven and defensible.

The cost of assuming otherwise is no longer theoretical — it’s sitting in your contract renewals.

KPMG’s 2026 Global Tech Report on Healthcare, drawn from 128 senior executives globally, is a mirror held up to that pattern. The reflection isn’t entirely flattering — but it does point clearly to what comes next.

Investment Is Serious. ROI Is Not.

Forty percent of healthcare organizations are spending $50–100 million annually on digital technologies, and that figure is climbing at roughly 25 percent per year. AI adoption has more than doubled in a single year — 66 percent of executives report actively deploying use cases, up from 32 percent. And 76 percent expect enterprise-scale AI deployment within 12 months, the highest of any sector surveyed.

So why are 57 percent of organizations still reporting ROI below breakeven? Because the technology isn’t the constraint. The algorithms are ready. The platforms are maturing. The problem is that we keep deploying technology as an extension of existing structures rather than as a catalyst for fundamental change. We’ve modernized the tools without modernizing the system.

Fix the Data Foundation First

Healthcare accounts for roughly one-seventh of all global data, yet only a fraction is actively used for insight. Most of our data teams are built around static dashboards that tell us what happened — not what’s about to happen. The KPMG report ranks data-powered forecasting as the top organizational priority, and for good reason: AI cannot succeed without mature data practices. That’s not a vendor talking point. It’s the lived experience of every health system that has tried to scale a model trained on siloed, inconsistent data.

Data governance is a leadership issue, not an IT issue. Clear ownership and accountability for how data is managed across the enterprise must sit at the CIO level — and it must be resolved before the AI strategy is announced, not after it underperforms.

Cybersecurity Leads, Not Follows

Forty-one percent of healthcare leaders plan to increase cybersecurity spending by more than 10 percent this year — placing it ahead of both AI and data analytics in growth priority. That sequencing is right. In a digital-first healthcare environment, resilience is clinical as much as technical. When systems fail — and they will — staff must still access minimum patient information to deliver safe care. Business continuity is a patient safety issue. Every CIO should be treating it accordingly.

Stop Measuring AI With ERP Metrics

Sixty-nine percent of executives agree that traditional KPIs are insufficient for tracking AI performance. Binary, linear metrics don’t capture how AI value actually shows up — distributed across downstream workflows, patient experience, staff retention, and throughput. We need governance frameworks built for AI’s non-linear impact. Building those frameworks proactively, before a high-profile failure forces the conversation, is one of the highest-leverage moves available to health system CIOs right now.

The Mandate: Stabilize, Synchronize, Scale — In That Order

The most useful insight from the KPMG report is the progression it describes: stabilize your core platforms, synchronize your data and governance, then scale AI into that ready foundation. The temptation is to skip ahead — to launch a patient-facing AI product while EHR integration remains fragmented. That path produces exactly the ROI disappointment the data describes.

The organizations that will look back in three years with confidence are those building deliberately today: aligning governance, defining a target operating model fit for the AI-enabled organization, and scaling into that model — rather than retrofitting a strategy onto a collection of pilots.

Healthcare’s AI moment has arrived. But most organizations are arriving to the starting line with one leg tied behind their back.

According to Rhapsody’s State of Interoperability Report, 76% of healthcare leaders identify advancing data integration and interoperability as a top strategic priority for the next 12 to 24 months. That number should prompt every CIO, CMO, and CEO in the industry to ask a pointed question: if three-quarters of us say this is critical, why are so many of us still running fragmented, siloed operations that prevent AI from scaling beyond the proof-of-concept stage?

The answer is uncomfortable but clarifying. We’ve been treating interoperability as a technical obligation—a compliance checkbox, a legacy IT problem, someone else’s budget line. That framing has cost us years. It is now costing us our competitive position in the most consequential technology transition healthcare has ever seen.

The AI Tax on Poor Data Infrastructure

The Rhapsody report introduces the Digital Infrastructure Maturity Model (RDIMM), a four-stage framework—Connect, Standardize, Optimize, and Innovate—that precisely maps where organizations sit on the road to AI readiness. Most of the data suggests, that it remains in the earliest stages.

The operational drag is already measurable. Nearly half of IT teams spend more than ten hours per week troubleshooting integration issues alone. One in four organizations is burning over 20 hours per week on that same problem. That is not a technical inconvenience. That is a direct tax on your AI investment, one that compounds with every new tool, every new vendor, every new model you bring online.

A 2025 HIMSS poll underscores the broader stakes: 57% of U.S. physicians cite interoperability as the single greatest barrier to realizing health IT’s full value. Not reimbursement complexity. Not staffing. Not regulatory burden. Interoperability. The clinical workforce is telling us something the business case confirms—fragmented data doesn’t just slow innovation, it undermines the trust that AI-driven care depends on entirely.

Four Stages, One Strategic Imperative

The RDIMM framework is useful not because it is novel, but because it is honest. It tells organizations where they actually are, not where their vendor roadmaps claim they should be.

Stage 1 organizations are connecting core systems and eliminating the most brittle point-to-point interfaces. Stage 2 organizations are standardizing data governance, adopting FHIR and API-first architectures, and creating the conditions for AI pilots to produce outputs that clinicians can trust. Stage 3 organizations have embedded AI into operational workflows and are beginning to see measurable returns in scheduling efficiency, prior authorization throughput, and clinical documentation. Stage 4—the Innovate tier—is where AI is no longer a capability. It is a core competency. Self-healing data pipelines, ambient documentation, intelligent triage, real-time financial forecasting: these aren’t speculative outcomes. They are operational realities for organizations that invested in interoperability five years ago.

McKinsey estimates that AI built on interoperable platforms could generate $200 to $360 billion in global healthcare savings. That is not a forecast for the distant future. That is the return on infrastructure decisions being made right now.

Leadership Is the Variable No One Wants to Talk About

Here is what the Rhapsody report gets exactly right, and what most technology assessments miss entirely: the limiting factor is not the technology. It is the leadership’s will.

Organizations at the highest maturity stages share one attribute that has nothing to do with their stack. Their C-suite has made a deliberate, visible commitment to treating interoperability as a strategic asset rather than an IT cost center. They have aligned financial planning, workforce design, and patient experience strategy around a shared data vision. They have given cross-functional teams the authority and the resources to execute.

The organizations still stuck in Stage 1 are not short on ambition. They are short on executive alignment. They are running AI pilots in pockets while their underlying data infrastructure remains fundamentally disconnected.

The Window Is Narrowing

The competitive gap between Stage 1 and Stage 4 organizations is widening every quarter. As AI evolves from isolated models to agentic systems capable of reasoning and acting across the enterprise, the cost of poor interoperability will not grow linearly—it will accelerate.

The question every healthcare executive should answer before the next board meeting is not “are we investing in AI?” It is “have we built the foundation that makes AI worth investing in?”

Interoperability is that foundation. The organizations that recognize it now will not merely adopt what comes next in healthcare. They will build it.

1. CMS pushes prior authorization deeper into interoperability

CMS updated its 2026 interoperability and prior authorization proposed rule page this week. The proposal would extend prior authorization (the process by which providers must obtain approval from payers before delivering certain drugs or services) requirements to drugs, require updated health IT (information technology) standards, and require payers to report API (application programming interface) endpoints and usage metrics. Comments are due June 15, 2026.

CIO takeaway: This isn’t just payer policy. Prep EHR, revenue cycle, pharmacy, and clinical docs for API-driven authorization. Map current prior auth friction now before the mandate forces rushed integrations.

2. Medtronic investigates unauthorized access tied to corporate systems

Medtronic disclosed that an unauthorized party accessed data in certain corporate IT (information technology) systems. The company said hospital customer networks, product networks, and manufacturing/distribution operations remain separate, but the incident may be tied to broader exploitation involving Salesforce Experience Cloud (a customer engagement web platform).

CIO takeaway: Treat this as a vendor risk warning. Even if vendors claim network isolation, CIOs must validate vendor access, integration points, support channels, and cloud dependencies. ‘Not our network’ isn’t a strategy—it’s a dodge.

Provider data breaches spread to smaller health organizations.

HIPAA Journal reported several newly announced healthcare provider breaches, including Community Health Systems in California, Tri-Cities Gastroenterology, and Integrated Pain Associates in Killeen, Texas. The exposed data categories included identifiers, insurance information, diagnosis/treatment information, medical record numbers, and financial data.

CIO takeaway: Breaches are not just a big-system issue. Small practices, specialty groups, and regional providers remain at risk due to weaker identity, segmentation, monitoring, and response. Assess affiliate, CIN, MSO, and acquired practice cyber risk as part of enterprise security.

4. FDA rolls out Elsa 4.0 and consolidates data platforms into HALO

The FDA (Food and Drug Administration) announced Elsa 4.0, an upgraded internal AI (artificial intelligence) tool for agency staff, and said it consolidated more than 40 applications and submission data sources into HALO, a new platform that lets staff query data and build workflows without manually uploading documents.

CIO takeaway: The FDA shows AI’s direction: AI on governed internal data, not just chatbots. For hospitals, real AI value comes from fixing data access, identity, permissions, workflows, and governance—not buying the latest model.

5. CMS announces $50 monthly GLP-1 access for eligible Medicare beneficiaries

CMS (Centers for Medicare & Medicaid Services) said eligible Medicare beneficiaries with Part D coverage may access certain GLP-1 (glucagon-like peptide 1) medications for $50 per month beginning July 1, 2026, through the Medicare GLP-1 Bridge demonstration, which runs through December 31, 2027.

CIO takeaway: This will drive urgent operational demand. Expect a spike in questions across clinics, pharmacies, care teams, call centers, and patient portals. Prep digital intake, patient messaging, eligibility, pharmacy links, and decision support now.

6. AI in cybersecurity becomes a board-level hospital issue

AHA (American Hospital Association) hosted a May 5 webinar on AI (artificial intelligence) use in cybersecurity and health care technology, focused on AI adoption, threat actor use of AI, legislative trends, and practical best practices for health care delivery organizations.

CIO takeaway: Cybersecurity now means more than blocking ransomware. AI speeds up reconnaissance, social engineering, vulnerability discovery, and fraud. Brief boards on AI threats, not just AI productivity.

7. Health tech vendors push AI closer to the edge and into clinical workflow

Fierce Healthcare’s May 4–8 roundup highlighted Tether’s medical AI (artificial intelligence) model designed to run on phones, wearables, and standard hardware, plus Elation Health’s integration of the American Heart Association PREVENT cardiovascular risk calculator into an AI-powered clinical decision support tool.

CIO takeaway: Two themes: local AI processing and rapid guideline integration. CIOs should judge these tools by governance, explainability, EHR integration, and liability control. Edge AI is only useful if the clinical decision trail is accountable.

CIO Takeaway

AI, cybersecurity, interoperability, and operational demand are converging. Don’t silo them. Prior auth APIs, GLP-1 access, FDA AI platforms, vendor incidents, and clinical AI all require stronger governance, cleaner data, tighter vendor controls, and workflows ready for rapid change.

OpenAI’s announcement of ChatGPT for Clinicians signals a new phase of healthcare AI adoption. The company is making a clinician-focused version of ChatGPT available for free to verified U.S. physicians, nurse practitioners, physician assistants, and pharmacists.

That matters because this is not a futuristic AI concept. It is a practical workflow tool designed to support the daily work that clinicians already struggle to complete.

OpenAI says the tool can support clinicians with documentation, medical research, referral letters, prior authorization language, patient instructions, care consultation support, and clinical search. It also includes reusable workflow “skills,” deep research across medical journals, and privacy protections that prevent conversations from being used to train models.

For clinicians, the benefits are clear. The tool can help reduce administrative burden, speed up routine writing, summarize complex information, support patient-friendly explanations, and make medical research easier to navigate. At a time when clinicians face inbox overload, documentation fatigue, and growing administrative demands, even modest workflow relief matters.

The more important point for healthcare CIOs is adoption.

OpenAI is not waiting for every health system to complete an enterprise AI strategy. It is putting a free tool directly in clinicians’ hands. A physician, pharmacist, NP, or PA can verify their credentials, download them, and start using them without waiting for an enterprise rollout.

That creates a familiar problem for CIOs: if the enterprise does not deliver usable tools fast enough, users will find their own.

Healthcare has seen this pattern before with mobile apps, cloud storage, messaging platforms, analytics tools, and generative AI. Clinicians adopt what helps them get work done. Governance usually arrives later, often after usage has already spread.

This announcement puts pressure on health systems to move faster. CIOs, CMIOs, compliance teams, and clinical leaders need to give clinicians an approved enterprise path that offers the same convenience, stronger controls, and better workflow integration.

The real opportunity is not simply giving clinicians access to ChatGPT. The real opportunity is embedding AI into clinical work: inside the EHR, documentation flow, inbox management, referral process, patient communication, prior authorization workflow, and knowledge search experience.

If health systems fail to do that, clinicians may default to the free tool because it is easy, available, and useful. That creates risk around PHI handling, documentation quality, policy consistency, auditability, and clinical accountability.

The CIO takeaway is straightforward: free clinician AI changes the adoption curve.

Health systems can no longer treat clinician-facing AI as a slow innovation project. They need a governed enterprise option that feels as easy as the consumer tool but works inside the health system’s security, privacy, compliance, and workflow model.

Clinicians want relief. OpenAI just gave them a direct path.

Now health systems must decide whether they will lead that adoption—or chase it.

U.S. Department of Veterans Affairs

• The VA implemented its unified Federal EHR at four Michigan medical centers, initiating the first of 13 planned deployments this year.

• The system supports real-time data sharing, enhances care coordination, and streamlines clinical workflows.

• Why it matters:
  The VA’s EHR transformation shows that process alignment across sites is essential. Large-scale initiatives increase benefits, such as data liquidity and care standardization, but also raise risks, such as workflow disruption and clinician burden. Disciplined execution and strong change management are critical.

2. Private equity reshapes medtech with $1.27B deal for

Avanos Medical

• American Industrial Partners will acquire Avanos in an all-cash deal valued at approximately $1.27 billion, representing a 72% premium.

• The acquisition is expected to accelerate innovation and provide greater capital flexibility for growth.

Why it matters:
Private equity continues to identify margin and growth opportunities in medtech. Anticipate increased cost discipline, portfolio rationalization, and faster commercialization cycles. Providers may experience short-term pricing pressure, but also benefit from greater innovation and improved vendor alignment over time.

3. Interoperability alliances deepen across Europe

• Tieto Caretech, x-tention, and Better announced a strategic partnership.

• The partnership will develop modular, standards-based clinical data platforms using the openEHR architecture.

Why it matters:
Composable, vendor-neutral platforms are gaining momentum. U.S. health systems should prioritize data orchestration across clinical workflows, AI, and partnerships rather than EHR ownership to remain competitive.

4. CMS ACCESS model expands tech-enabled chronic care

• More than 150 organizations, including vendors such as WHOOP, have been accepted into the CMS ACCESS program, which focuses on scalable chronic care innovation.

Why it matters:
The CMS ACCESS program highlights the shift toward technology-enabled, outcome-focused care. Health systems should prioritize continuous patient monitoring, digital therapeutics, and the use of patient data as core infrastructure for reimbursement.

5. Supply chain IT flagged as a margin crisis

• A new report projects that by 2026, poor supply chain visibility and manual workflows will directly erode hospital margins and disrupt care continuity.

• Why it matters:
  Modernizing supply chain IT has become a top financial priority for health systems. Automation, predictive analytics, and vendor integration are essential to prevent hidden margin losses.

6. Vendor-driven logistics innovation:

Medline

• MMedline launched Pick Pack Pro, a custom fulfillment technology designed to improve supply chain efficiency.

• Why it matters:
  Vendors are becoming strategic partners by integrating into operational workflows. Health systems may gain efficiency but also face increased dependency on vendors.

The AI Revolution and the Security Reality: This Week in Healthcare IT

As we enter the first full week of April 2026, the rise of agentic AI is reshaping healthcare IT. EHRs are being redesigned, and major AI deployments are accelerating change across the sector.

Here are the top stories you need to know from the week of April 1–8, 2026.

1. Greenway Health Reinvents the EHR with “Novare.”

Clinicians have long noted that Electronic Health Records (EHRs), digital versions of patients’ medical histories, often resemble outdated spreadsheets. This week, Greenway Health introduced Novare, which they describe as the first natively AI-enabled EHR.

Unlike legacy systems that add artificial intelligence (AI), software that simulates human decision-making, to existing code, Novare is built from the ground up with agentic AI, which can autonomously perform tasks for clinicians. The aim is to eliminate workarounds and create a system that anticipates clinician needs, automating documentation and revenue cycle tasks in real time. This approach signals a significant shift away from legacy systems.

2. Post-Acute Care Goes “All In” on AI

Creative Solutions in Healthcare announced a company-wide rollout of ExaCare AI across its 160 skilled nursing facilities (SNFs), marking one of the largest and fastest deployments in the sector. These facilities provide specialized medical care and rehabilitation.

“We have to be just as intentional about how we scale our systems as we are about our growth,” said Gary Blake, CEO of Creative Solutions.

The platform aims to improve the preadmission process, which is often slowed by paperwork and phone calls. By using AI to summarize patient journeys and streamline referrals, the initiative now processes over 1,500 referrals daily. This demonstrates that smart facilities using advanced digital and AI technologies have become the standard in post-acute care.

3. Cardiology Gets a “Second Set of Eyes.”

The Joint Research Center (JRC) released a report this week, Artificial Intelligence in Cardiovascular Care: From Promise to Practice, highlighting that AI now performs coronary artery calcium scoring as accurately as specialist radiologists.

The JRC also emphasized the importance of infrastructure. While AI can detect blockages in seconds, many hospitals lack the necessary hardware and supporting software. In response, the EU has committed €20 million to accelerate AI deployment in cardiovascular care.

4. The Security Reality Check: CareCloud & Hims, & Hers

This week also underscored the ongoing risks to valuable healthcare data from cyber threats.

• CareCloud confirmed a significant cyberattack this week that resulted in the theft of patient data and an 8-hour disruption of its EHR environment.

• Hims & Hers also disclosed a breach involving stolen support tickets from a third-party service, highlighting that security is only as strong as the least secure vendor’s application programming interface (API), the software connection between systems.

The Bottom Line

There is a clear shift from experimental to operational AI. With Greenway’s new EHR and Creative Solutions’ SNF rollout, the focus is now on efficiency at scale. However, the CareCloud breach highlights that as systems become more integrated and intelligent, cybersecurity risks increase.

Sources:

• Greenway Health: Novare Launch Announcement (April 7, 2026)

• Las Vegas Sun: Creative Solutions & ExaCare AI Rollout (April 8, 2026)

• European Commission JRC: AI in Cardiovascular Care Report (April 7, 2026)

• Acronis: MSP & Healthcare Cybersecurity Digest (April 7, 2026)

Healthcare AI announcements over the last several months reveal a market that is growing quickly. The conversation is no longer centered on hype, novelty, or generic chatbot capabilities. It is shifting toward more practical priorities: connected health data, trusted workflows, and measurable value for both patients and providers. Across the market, vendors are moving beyond broad AI claims and focusing on how their tools fit into healthcare operations, clinical decision-making, and the consumer health experience.

One of the clearest trends has come from vendors building consumer-facing health copilots. Perplexity Health reflects that shift. Rather than positioning AI as a standalone search tool, Perplexity has emphasized the value of combining health-related data sources into a more personalized experience. Its broader ecosystem announcements, including integrations with partners such as b.well and Function, point to an emerging industry-wide strategy. Healthcare AI vendors increasingly understand that strong model performance alone is not enough. The real advantage comes from connecting fragmented records, labs, wearable data, and other health inputs into a unified experience that can support better answers and more relevant guidance.

Microsoft has also pushed this strategy forward with Copilot Health. Its healthcare announcements show how large platform companies are trying to create secure environments where users can interact with health information more seamlessly. Microsoft’s positioning suggests that the future of healthcare AI will not reside in a separate innovation lab or remain confined to pilot projects. Instead, it will live inside broader digital ecosystems that bring together records, lab data, and device-generated information in ways that feel more seamless to both consumers and care teams. That direction matters because it highlights a larger market reality: healthcare AI is becoming an infrastructure conversation, not just a feature discussion.

On the provider side, Oracle has taken a more workflow-driven approach. Through Oracle Health Clinical AI Agent, Oracle has focused on helping clinicians reduce documentation burden and improve efficiency in high-pressure settings such as emergency and inpatient care. That strategy aligns with what many health systems want most from AI today. They are not asking for an abstract promise. They want tools that reduce clicks, speed note creation, support clinician productivity, and create value inside the daily workflow. Oracle’s positioning shows that enterprise healthcare AI is moving away from experimentation and toward embedded operational support.

Epic’s recent AI messaging reinforces the same point. With updates on AI Charting and broader AI results, Epic continues to show that AI is becoming native to the electronic health record rather than an external add-on. That distinction matters for CIOs and digital leaders. When AI capabilities live inside the core platform, adoption becomes easier, governance becomes more manageable, and the organization has a better chance of translating technology investment into real workflow improvement. Epic’s approach reflects a broader industry pattern in which EHR vendors are trying to keep AI close to the point of care.

OpenAI and Anthropic also remain important players in this evolving market. ChatGPT Health and Claude for Healthcareshow that foundation model companies want a direct role in healthcare, not just as model providers behind the scenes, but as branded platforms with healthcare-specific positioning. Their announcements signal that privacy, compliance, and healthcare-specific safeguards are now central to the competitive conversation. In healthcare, general intelligence is not enough. Vendors must also demonstrate that their tools can operate responsibly in sensitive environments where trust, oversight, and data stewardship carry equal weight with performance.

In summary, these announcements highlight three main takeaways driving the healthcare AI market forward: consumer-facing vendors are prioritizing the aggregation and personalization of health data; enterprise vendors are embedding AI directly into clinical and operational workflows; and platform companies are working to own the environments where health interactions occur. The key lesson is that future market leaders will be defined not by bold claims but by their ability to connect data, integrate seamlessly into care, and deliver measurable results for healthcare organizations.

Amazon launched Amazon Connect Health, an AI-enabled platform that automates key administrative tasks, including patient verification, appointment scheduling, medical history intake, clinical documentation, and coding. This move aims to modernize patient access and staff productivity, signaling to healthcare CIOs that AI’s next big impact could be in contact centers and access workflows, not just clinical settings.

Microsoft expanded the definition of ambient AI. At HIMSS 2026, Microsoft introduced new Dragon Copilotcapabilities, including Work IQ context, partner-built apps and agents, role-based workflows, proactive coding support, and expanded support for physicians, nurses, and radiologists. Microsoft is positioning Dragon Copilot as a unified workflow layer, not just a documentation assistant. CIOs should pay attention because this is where the market is heading: ambient tools are maturing into enterprise workflow platforms that connect clinical productivity, revenue cycle, and embedded intelligence in a single operating model.

Google Cloud made the case for agentic AI tied to outcomes. This week, Google Cloud highlighted Gemini-powered healthcare agents, including CVS Health, Highmark Health, Waystar, and Quest Diagnostics. The announcement focused on patient engagement, workflow automation, revenue cycle performance, and easier-to-read clinical information. That matters for CIOs because the strongest AI pitches now come wrapped in operational metrics and enterprise use cases. The conversation is no longer about whether a model can generate text. It is about whether a platform can reduce denials, simplify work, and scale safely across the health system without creating one more mess for IT to clean up at 2 a.m.

Epic pushed AI deeper into the core record. Ahead of HIMSS26, Epic previewed a no-code Agent Factory and continued expansion of AI tools across documentation, patient engagement, revenue cycle, and clinical workflows. Epic’s strategy is increasingly clear: it wants customers to build and orchestrate AI from inside the EHR environment rather than bolt it on from the outside. For CIOs, this move signals that Epic aims to control a greater share of the healthcare workflow layer, raising the competitive stakes as other vendors must now demonstrate unique value and seamless integration to avoid being displaced. The contest is increasingly about platform centrality and the ability to orchestrate AI within core health operations.

Ambient scribes have moved beyond the pilot phase and are becoming standard for clinicians. For healthcare CIOs, the central question is no longer whether to adopt this technology, but how to scale it responsibly.

This shift has accelerated over the past year: ambient AI has moved from novelty to necessity. Clinicians expect it. Health systems budget for it. Boards ask about it. What started as documentation relief now drives measurable impact on clinician satisfaction, chart closure time, and patient engagement.

Meanwhile, as the hype around agentic AI continues, ambient AI has matured in a more practical way. It embeds directly into workflows and runs quietly in the background. It reduces cognitive load without demanding behavior change, making it distinct. Rather than requiring clinicians to learn new systems, it removes friction from existing ones.

CIOs now evaluate ambient tools the same way they evaluate EHR modules: performance, security, governance, and ROI. Healthcare CIOs want to know:

• - Does the tool integrate natively or sit as an additional layer?

• - How does it handle data security and PHI?

• - Can we measure real productivity gains?

• - Who owns the output, and how do we audit it?

These are not experimental questions—they are operational ones.

Ambient solutions are no longer “nice to have.” In competitive labor markets, they are table stakes. When one health system offers AI documentation support, and another does not, clinicians notice. Recruitment teams notice. Retention numbers reflect it.

Given this, the next phase for CIOs is governance at scale. That means standardizing vendor selection, aligning with compliance teams, setting clear documentation policies, and defining performance metrics. It also means resisting the urge to chase every new AI feature, instead doubling down on tools that demonstrably reduce burnout and improve throughput. The real question will come down to whether an organization trusts the solution embedded in its EMR vendor or explores a bolt-on solution.

Rural hospitals must maintain broad clinical coverage despite limited staffing, rising supply costs, an unpredictable payer mix, and an aging, sicker population. Since 2005, 110 rural hospitals have closed permanently, including 24 in the past five years. The Center for Healthcare Equity and Reform estimates that nearly 800 more are at risk of closure due to financial distress.

Healthcare leaders believe that they can turn to technology, especially AI, for solutions. However, AI is not a simple fix. Technology can drive meaningful change only when rural health leaders align it with clear operational and clinical priorities. CIOs should ensure their IT strategy focuses on the following two areas.

Extend And Expand Technology Capabilities

Rural hospitals face daily challenges with patient access, including delayed transfers and limited specialty coverage. Clinicians often assume multiple roles rather than focusing on their primary expertise. While technology cannot create new specialists, it can provide timely access to specialty expertise for care teams. Expanding the right technology capabilities helps retain more patients locally, reduce unnecessary transfers, and shorten the length of stay.

Many rural leaders have demonstrated success with virtual specialty coverage, particularly telestroke and tele-ICU services. These solutions provide frontline teams with faster access to specialists, supporting better clinical decision-making. The objective is to make specialty access reliable and routine.

When staffing is limited, technology can help maintain capacity by enabling remote nursing support and virtual sitters. Virtual sitters help prevent falls without requiring one-to-one assignments in every room.

For rural health CIOs, foundational technology determines the success of these programs. Focus on implementing robust connectivity and network infrastructure, followed by strong system integration. Build redundancy with multiple circuits and consider newer connectivity options such as Starlink and 5G where appropriate. The key is integrating each solution directly into existing workflows while maintaining system uptime. Embed virtual care and hospital-at-home solutions directly into the EHR and daily operations instead of running standalone applications that add complexity. These programs are only effective when core technology operates reliably and consistently.

Fractional Or Shared IT Strategy

A fractional or shared IT strategy does not require rural hospitals to give up their independence. Instead, it allows them to avoid operating like a large system with limited resources. Small hospitals cannot independently negotiate, secure, staff, and innovate at the same scale. Rural hospitals must use shared technology services just like other healthcare service lines.

CIOs should begin by establishing fractional or shared cybersecurity and IT operations through a trusted vendor or regional hospital partner. Attackers often target rural hospitals because they have limited cybersecurity defenses. At a minimum, rural health CIOs must start with a shared model for security operations center, patch management, and managed endpoint protection across the organization.

Rural hospital leaders should centralize essential infrastructure while maintaining local governance. Technology alone won’t solve reimbursement challenges, but it can expand access and support care delivery. It creates value not by looking impressive, but by running reliably, fitting into daily operations, and staying tightly focused on outcomes.

Cybercrime now drains trillions of dollars from the global economy, and healthcare remains one of the most profitable targets. Ransomware attacks do more than lock systems. They destroy trust in data, backups, and identities. Once attackers gain administrative access, traditional disaster recovery plans often make matters worse by spreading the infection rather than containing it. A white paper by Rubrik and CHIME argues that prevention alone is failing and that resilience has become a clinical imperative.

Minimum Viable Hospital

Healthcare has long planned for physical disasters by separating data centers and failing over systems. Ransomware breaks that model. When malware contaminates backups, distance no longer matters. What matters is isolation.

Healthcare technology leaders described the move from standard disaster recovery to cyber recovery using isolated recovery environments. These environments create “security distance” so teams can restore systems without reintroducing malware.

Because building this capability is expensive, organizations must prioritize ruthlessly. That is where the concept of the “Minimum Viable Hospital” comes in. Instead of trying to recover hundreds of applications, CIOs must identify the small set that keeps patients safe and operations running. Labs, pharmacy, imaging, identity, and payroll rise to the top. Many systems people assume are critical simply are not.

This approach forces uncomfortable but necessary conversations. It also shortens downtime from weeks to days when an attack happens.

This is the same concept I mentioned in April, 2025, when I created this concept.

Identity Is the New Front Door

If resilience is the safety net, identity is the tightrope. Attackers no longer need to break in through the network when they can log in.

Healthcare leaders were blunt in the research interview: basic MFA is no longer enough. SMS codes, one-time passwords, and static credentials fail under social engineering, SIM swapping, and deepfake-assisted fraud. Identity verification must adapt.

Health systems are responding with higher-friction controls for high-risk actions. Video-based verification, badge checks, biometrics, and just-in-time access are becoming standard. Privileged Access Management and Privileged Identity Management are no longer “nice to have.” In many cases, they are required for cyber insurance.

The rise of non-human identities, including autonomous AI agents, only raises the stakes. Service accounts with passwords that never expire represent a silent but serious risk.

Zero Trust as a Culture, Not a Tool

Technology alone does not create resilience. Governance does.

Leaders shared how Zero Trust only works when security decisions move out of isolated IT committees and into everyday operational forums. Embedding security into clinical, architectural, and administrative discussions changes the tone from “no” to “how do we do this safely?”

Several organizations now run planned downtimes during business hours. These drills force teams to use paper workflows and manual processes while leadership watches. The goal is not disruption. It is muscle memory. When a real attack happens, clinicians already know what to do.

The Persistent Blind Spot: Medical Devices and IoT

Even as identity hardens, attackers look for softer targets. Medical devices and IoT systems remain a major gap. Many devices stay in service for decades and cannot be patched.

Visibility is the first step. Leaders emphasized the need for accurate inventories, software bills of materials, and network segmentation. If an infusion pump attempts to communicate with Active Directory, the breach has already begun. Segmentation limits blast radius and traps attackers before they pivot deeper into the network.

Next Steps for Healthcare CIOs

For healthcare CIOs, the path forward is clear:

1. Redefine recovery. Invest in isolated recovery environments and test them.

2. Define your Minimum Viable Hospital. Agree on what truly matters before an attack forces the decision.

3. Strengthen identity controls. Move beyond basic MFA and secure privileged access.

4. Practice under pressure. Replace tabletop exercises with real downtime drills.

5. Close the device gap. Demand visibility and segment what cannot be patched.

6. Reframe the board conversation. Talk about days of downtime, patient risk, and revenue loss, not firewall features.

1) A real-world breach reminder: Central Maine Healthcare (~145,000 impacted)

Central Maine Healthcare reported a breach affecting more than 145,000 people—far higher than the number initially reported to the state. The reports indicate attackers accessed patients’ personal and insurance information (and in some accounts, treatment data as well). (Bangor Daily News)

You should treat this as more than another headline. Breaches don’t just create compliance work; they create operational drag and trust erosion that lands on every frontline touchpoint. Leaders reduce damage when they run security like clinical safety: rehearsed incident command, clear downtime workflows, and patient communications that don’t read like they were written by a committee of robots and attorneys who have never met a worried human.

2) Ambient documentation gets more embedded: Solventum + MEDITECH Expanse

Solventum announced its designation as an Accelerator partner in the MEDITECH Alliance, integrating Fluency Align into MEDITECH Expanse to support ambient AI documentation using conversational and generative AI. (solventum.com)

This matters because the market is shifting from “ambient AI pilots” to “workflow-native” deployments. When ambient tools live within the EHR flow rather than alongside it, adoption rises—but so do your governance obligations: quality controls, documentation integrity, coding implications, and data handling.

3) Prior authorization and interoperability timelines: CMS makes 2026 the “get serious” year

CMS’s Interoperability and Prior Authorization Final Rule (CMS-0057-F) sets near-term requirements starting January 1, 2026, with most API requirements primarily due by January 1, 2027. (Centers for Medicare & Medicaid Services)

Translation: 2026 is the year you either build the plumbing or you accept chaos later. If your payer/provider data exchange still relies on one-off interfaces, brittle workflows, and heroic staff workarounds, you will struggle under tighter expectations for electronic exchange and reporting.

4) Rural cybersecurity becomes a workforce strategy issue, not just a tooling issue

The American Hospital Association expressed support for the Rural Hospital Cybersecurity Enhancement Act (S. 2169), which would direct HHS to develop a comprehensive workforce strategy and establish partnerships to expand cybersecurity capabilities in rural hospitals. (American Hospital Association)

Even if you don’t operate rural facilities, you live in a regional care ecosystem. Rural cyber weakness can drive diversion, disrupt transfers, and stress tertiary capacity. Workforce limitations—not just budgets—often sit at the root: rural hospitals can’t hire or retain specialized security talent at market rates.