The biggest concern for CIOs may not be the recruiting of a chief AI officer (CAIO). It’s what happens to their responsibilities afterward.

Consider a CAIO who reports directly to the CEO and takes responsibility for enterprise AI strategy, investments, workforce transformation, and business outcomes. The CIO continues to manage infrastructure, applications, cybersecurity, and daily technology operations.

The CIO hasn’t been demoted, at least not officially. The title remains unchanged. But much of the strategic responsibility has moved to another executive.

Companies don’t need to eliminate the CIO position to reduce its influence. They can gradually redefine it as a traditional, infrastructure-focused CTO role while assigning enterprise transformation to the CAIO.

The Data Points To A Changing Leadership Structure

IBM’s 2026 CEO study found that 76% of surveyed organizations have a CAIO, compared with 26% in its separate 2025 research. IBM’s 2025 report, Solving the AI ROI Puzzle, also found that 57% of surveyed CAIOs reported directly to the CEO or board.

These findings don’t mean CIOs are losing their jobs. They do suggest that CEOs increasingly see AI as important enough to warrant dedicated executive leadership.

An October 2026 Thoughtworks survey of 3,200 CIOs offers another perspective. Thirty-five percent said their CAIO operated independently, with equal or greater influence across the organization. Another 29% reported friction or unclear responsibilities between the two positions.

At the same time, 89% said their responsibilities were shifting toward redesigning workflows and workforce models rather than managing infrastructure.

CIOs are being asked to take greater responsibility for business transformation just as companies are hiring another executive to lead it.

There are legitimate reasons to appoint a CAIO. AI initiatives often span multiple departments, require substantial investment, and demand more attention than one executive can provide. The concern for CIOs is whether the company has clearly defined how the two executives will work together.

How The CIO Role Gets Redefined

The change rarely happens overnight. The CAIO begins setting AI priorities, managing the investment portfolio, and presenting progress to the board. The CFO works with the CAIO to establish financial targets. HR looks to the CAIO to determine how automation will affect staffing and job responsibilities.

The CIO continues running the EHR, cloud infrastructure, networks, enterprise applications, and cybersecurity program. The CIO remains responsible for keeping critical systems available, connecting new technologies, and protecting company data.

Those are substantial responsibilities. But if the CIO is no longer involved in deciding how technology will change the business, the position has become primarily operational.

For years, CIOs have worked to move beyond managing IT infrastructure and gain a stronger voice in enterprise strategy. A separate CAIO position could reverse that progress if the CEO transfers transformation responsibilities without reconsidering the CIO’s role.

The CIO might still attend executive meetings and oversee a significant budget. What matters is whether the CIO participates in the decisions that shape the company’s future.

What CIOs Should Look For In A CAIO Job Posting

A CAIO job description can tell CIOs a great deal about how their company intends to divide executive responsibilities.

Reporting structure. If the CAIO reports directly to the CEO, will the CIO have the same access to discussions about business strategy, technology investments, and organizational change?

Responsibilities. Does the CAIO own enterprise transformation, workflow redesign, and technology-driven business outcomes? If so, what strategic responsibilities remain with the CIO?

Budget authority. Who approves AI investments, selects vendors, and decides which initiatives receive funding? An executive who controls investment priorities often has more influence than one responsible for implementing those decisions.

Accountability. Who takes responsibility when an AI initiative fails or creates a security problem?

IBM’s June 2026 technology leadership study found that approximately two-thirds of surveyed CIOs and CTOs were accountable for AI systems they did not fully control.

Thoughtworks also found that 90% of surveyed CIOs expected central IT to be held responsible for security or compliance failures involving AI purchased independently by business departments.

For healthcare CIOs, this deserves particular attention.

AI agents are beginning to operate across clinical applications, patient scheduling, revenue cycle, and administrative workflows. These tools need access to enterprise systems and sensitive information.

If the CAIO authorizes an AI deployment but the CIO remains accountable for security, integration, and system availability, the organization has created a serious management problem.

The executive responsible for managing the risk needs sufficient authority over the decisions that create it.

CIOs Need To Take Some Responsibility

Not every CIO can blame organizational restructuring for losing influence.

Many CIOs have successfully established themselves as business leaders. Others continue to measure their contribution primarily through system uptime, project delivery, vendor management, and IT cost reductions.

Those responsibilities are important, but CEOs increasingly want to know how technology will improve the company’s financial and operational performance.

AI makes that distinction more important.

Consider an AI application that saves employees five hours a week. That sounds like an attractive return on investment, but the savings have little financial value unless the company does something with the additional capacity.

Can the organization reduce overtime? Handle more transactions without additional hiring? Improve collections? See more patients? Reduce administrative costs?

Someone needs to make those operating decisions and establish how the results will be measured.

The CIO who understands how AI affects staffing, workflows, technology costs, and business performance has a strong argument for remaining involved in enterprise strategy.

A CIO who limits the conversation to AI platforms, technical architecture, and vendor selection may find that the CEO looks elsewhere for business leadership.

The CIO doesn’t need to manage every AI project. But the position should remain involved in decisions about how the organization uses technology to operate differently.

What CIOs Should Do Before The CAIO Arrives

The best time to address these questions is before the company hires a CAIO.

Start with the CEO. Understand why the company wants a separate AI executive and which responsibilities that person will assume.

The discussion should address specific decisions:

• Who controls the enterprise AI investment portfolio?

• Who approves AI agents that access company systems and data?

• Who determines which business processes should be redesigned?

• Who reports financial and operational results to the board?

• Who is accountable when an AI initiative creates a security, compliance, or operational problem?

CIOs should also come prepared with their own assessment of where AI can improve business performance.

Identify which workflows offer measurable opportunities, where existing technology or data limitations could delay implementation, and what operational changes are needed to produce a financial return.

For healthcare organizations, that might include reducing revenue cycle expenses, improving patient access, addressing staffing shortages, or lowering administrative costs.

The discussion needs to move beyond implementing AI applications to determining what the organization expects those applications to accomplish.

I would also recommend establishing a written governance agreement among the CIO, CAIO, CFO, CISO, and relevant operating executives.

It should define investment authority, data ownership, security requirements, clinical safety oversight, approval processes for autonomous agents, and responsibility for measuring results.

This doesn’t mean the CAIO should report to

the CIO. Both positions can have distinct responsibilities while sharing accountability for enterprise outcomes.

CIOs should also participate in developing the job description and interviewing candidates. It’s much easier to establish a productive working relationship before the CAIO joins than to negotiate competing responsibilities afterward.

The Bigger Risk Is Losing Strategic Influence

Some CIOs will benefit from having a CAIO as a partner. A dedicated AI executive can help coordinate business adoption, accelerate implementation, and bring additional resources to initiatives that IT cannot manage alone.

In other organizations, the appointment may confirm that the CEO already views the CIO primarily as the person responsible for keeping technology running.

That distinction matters.

CEOs should be clear about what they expect from both executives. Boards should also question any structure that gives one leader authority over AI investments while holding another responsible for the technology and security consequences.

CIOs, meanwhile, need to demonstrate that their contribution extends beyond operating enterprise technology.

The real threat isn’t that the CAIO will replace the CIO. It’s that the CIO will keep the title, the infrastructure, and the operational accountability while someone else takes responsibility for strategy, investment, and business transformation.

By the time that becomes obvious, the company’s leadership structure may have already changed.

Epic’s decision to pause much of its product development and shift engineering resources toward security deserves more attention from healthcare CIOs than another routine vulnerability announcement.

The immediate issue involves potential security weaknesses associated with certain MyChart configurations. According to TechCrunch reporting, Epic's Chief Security Officer said some configurations could allow unauthorized access to patient information without that activity appearing in the normal logs used to detect it. No public evidence shows these weaknesses were exploited or caused a health system breach.

That last point is important. We should not connect an unproven vulnerability to an attack simply because the timing looks interesting.

But CIOs should still ask a harder question.

Over the past several months, multiple health systems have experienced cyber incidents that disrupted patient portals and clinical operations. CIOs shouldn't retroactively blame Epic for these incidents. But Epic’s latest discovery changes the questions CIOs should ask when reviewing them.

Cyber investigations depend heavily on logs. We look for failed authentication attempts, unusual access, privilege escalation, and abnormal activity to reconstruct what happened.

If a vulnerability, under certain configurations, could permit access without generating the expected logging evidence, then saying “we found no evidence of unauthorized access” may not be enough.

The next question is: Were our controls capable of producing the evidence in the first place?

For Epic customers, remediation should therefore go beyond installing whatever fixes Epic provides. CIOs and CISOs should determine whether their MyChart configuration was potentially exposed, validate identity and authentication controls, review configuration changes that differ from Epic’s recommended standards, and determine whether additional forensic review of previous incidents is warranted.

Vendor-Management Lesson.

Health systems evaluate vendors on functionality, roadmap, interoperability, and price without security scoring. Security response capacity now deserves equal weight. When a security exposure is discovered, how quickly can the vendor redirect engineering resources, identify affected customers, communicate exposure, and remediate the problem?

Epic appears willing to slow feature development to answer that question. Healthcare CIOs should now determine whether their other critical technology vendors would do the same. Because after this disclosure, the question is no longer simply whether the logs show evidence of compromise. It is whether we could see the compromise at all.

However, healthcare appears to be moving in the opposite direction.

Recent research from Bain & Company and KLAS Research shows that nearly 95% of surveyed providers and payers rank software and digital technology among their top five strategic priorities, with most anticipating increased spending. However, investment standards are rising.

Organizations with formal return thresholds most commonly expect a return of 3.0 to 3.9 times the original investment. Health systems are focusing spending on areas directly linked to operating performance, such as revenue cycle management, clinical workflow optimization, and AI-enabled documentation.

This is significant as AI is moving beyond the experimentation phase.

CFOs and operating leaders will increasingly require evidence that AI investments improve revenue, reduce costs, increase capacity, or enhance productivity. A successful pilot alone is no longer sufficient.

A key finding is how AI may affect incumbent platforms.

Nearly 80% of acute provider respondents believe generative AI will either increase switching costs or leave them unchanged. The research also indicates that Epic customers prefer EHR-native solutions for functions closely tied to clinical workflows.

This challenges the assumption that AI will automatically commoditize underlying applications.

An EHR is more than an interface; it manages clinical data, workflows, permissions, orders, documentation, and integrations. If the same platform also provides the AI layer for these functions, the vendor relationship may strengthen rather than weaken.

AI may, in fact, reinforce the advantage of incumbent vendors.

That does not mean health systems should automatically buy whatever their existing platform vendor offers. Best-of-breed vendors will continue to win where they solve important problems materially better.

But the burden of proof should be higher.

Every additional AI vendor creates another integration, security review, data flow, identity relationship, support model, and governance process. Those costs grow as AI moves from generating content to taking action.

A vendor may enter through ambient documentation, then expand into coding, clinical intelligence, and workflow automation. Over time, a point solution can become part of the enterprise architecture without anyone explicitly deciding that it should.

That is the real CIO issue.

Health systems need to decide where best-of-breed performance creates enough value to justify added complexity, and where consolidation creates more enterprise value than marginal product differentiation.

They also need to think harder about exit costs. Replacing an AI platform may eventually mean rebuilding workflows, integrations, governance, and employee behavior—not just migrating software.

The choice is not between innovation and consolidation.

It is about being deliberate before architecture gets created one purchase at a time.

AI may change how clinicians and employees interact with technology, but the platforms controlling the data and workflows underneath may become even more important.

For CIOs, the question is no longer which AI product performs best.

It is which vendors deserve to become strategic platforms—and how much authority the organization is willing to give them.

This is the version I’d use for Forbes: fast opening, one argument, minimal setup, and no repeated platform-consolidation points.

With Agentic SOC, Zscaler is following a trend where cybersecurity products both analyze threats and make decisions. These platforms do more than flag suspicious activity. They investigate, decide, and take action.

According to Zscaler, the platform brings together zero-trust telemetry, third-party security data, a context graph, and specialized agents. These agents can triage alerts, investigate root causes, assign verdicts, and take containment actions such as isolating a compromised user, blocking command-and-control traffic, and restricting lateral movement.

Microsoft, Google, Palo Alto Networks, CrowdStrike, SentinelOne, and Splunk are all working toward the same goal. The real competition is not just about who has the best model. It is about which product becomes the main decision and enforcement layer for identity, endpoints, networks, cloud, and business applications.

CISOs and CIOs should consider these points carefully before deciding.

Speed is important, but it is not the only factor to consider.

Security teams face a real challenge with speed. Too many alerts, too many separate tools, and attackers use automation too. AI that gathers evidence, connects activity, and removes false positives is a real improvement because this repetitive work suits automation well.

Automated containment is a separate decision. In a hospital, isolating an identity or blocking a connection is more than just a technical step. The account could belong to a physician, and the connection might support a lab system, pharmacy feed, or imaging platform. Even if an automated response is technically correct, it can still cause clinical problems.

This is not an argument against autonomy. Waiting for multiple approvals during an active attack can also be costly. Instead, it supports matching the level of autonomy to the potential consequences. Low-risk actions on noncritical endpoints can be fully automated. However, turning off a privileged identity or cutting access to a critical system should require a higher level of review, a different escalation process, and a human who can respond quickly.

Five decisions before you deploy

Define the boundary. Spell out what the agent can do alone, what needs approval, and what’s off-limits without executive or clinical sign-off. “Human in the loop” isn’t a policy; it’s a requirement.

Tie authorization to business criticality. Alerts shouldn’t trigger the same response on every asset. Factor in identity type, application criticality, patient-care impact, and available downtime procedures.

Demand explainability and reversibility. The technology and security team needs to see the evidence behind an AI decision and the permissions used to act on it, and you need a tested way to undo a bad containment call fast. The audit trail matters. Getting the system back up matters more.

Test the financial claims. Vendors may promise fewer alerts, lower SIEM costs, and less need for manual triage. Check if these claims are true, and whether decision-makers will actually see lower costs or just a shift in budget from one area to another.

Consider the risk of vendor lock-in. Using a single platform reduces fragmentation, but it also means your security depends on one vendor’s data model and decisions. Make sure you know how to export your data, how other tools can inform decisions, and what happens if the platform fails or makes a large-scale mistake.

The main benefit may be consolidation, not just better defense.

While the industry talks about stopping AI-driven attacks, the bigger business story is platform consolidation. If an agentic SOC can handle most alerts, coordinate responses, and send only the important signals to a SIEM, organizations could eventually retire duplicate tools and reduce data ingestion costs. They could also reconsider how much Tier 1 monitoring stays in-house versus moving to an MDR partner.

Do not expect savings to appear automatically. Vendors may promise consolidation, but sometimes they just add another layer to your technology stack. Each business case should include a clear list of what will be retired and when.

Staffing needs will change as well. Fewer people will handle repetitive alert triage, while more will be needed to set up guardrails, check agent decisions, and manage truly complex incidents. The goal is not an empty SOC, but a security team that spends less time collecting evidence and more time making important decisions.

Agentic security is quickly becoming standard because of the high number of attacks. However, adopting the technology and giving it authority are two separate choices. The decision to hand over authority belongs to you, not the vendor.

Before you deploy, decide what the agent can see, decide, and do, and where a human needs to be involved. Test these boundaries with your clinical workflows and continuity plan, not just with attack scenarios. Vendors will compete on speed, but you should judge them on whether their agents act correctly, transparently, and without causing bigger problems. In some industries, only you can decide the line between acting quickly and acting recklessly.

Today’s most interesting healthcare technology stories aren’t about another chatbot or AI model.

They point to something more consequential: technology is beginning to influence how health systems allocate scarce resources—labor, cash, technology capacity, security access, and clinician attention.

For CIOs, that changes the conversation. The question is moving from “What can AI do?” to “What decisions are we prepared to let technology influence or execute?”

Here are five developments worth watching.

1. Mayo Clinic and Trusted Health Take AI Deeper Into Workforce Management

Mayo Clinic’s CareCast workforce-demand forecasting technology integrats into Trusted Health’s Trusted Works platform. CareCast uses historical staffing, patient-volume trends, and operational data to forecast workforce demand. Trusted Works’ AI agents can then use those forecasts to build schedules, identify coverage gaps, and fill open shifts. (Trusted Health⁠)

Read the Trusted Health announcement⁠

My View: We have spent a lot of time discussing how AI can save clinicians minutes. The larger economic opportunity may be using AI to optimize workforce capacity.

Labor is one of the largest expenses in healthcare. If better forecasting and scheduling can eventually reduce overtime, agency utilization, and staffing gaps while matching resources more closely to patient demand, this becomes a CFO and COO issue—not an HR technology project.

But forecasting is the easy part. AI can predict that you need six nurses Tuesday night. It cannot manufacture six nurses Tuesday night. The ROI comes when organizations are willing and able to change staffing practices based on what the technology tells them.

2. Inova Finds $10.4 Million in Revenue Opportunities Using Payer Analytics

Inova Health System is working with Anomaly Insights to analyze payer behavior across revenue-cycle and managed-care operations. According to the companies, Inova identified $10.4 million in recovered revenue opportunities during the first 90 days, with an estimated $3.8 million in ongoing monthly revenue impact. Those figures come from the collaboration announcement and should be treated as company-reported results. (Yahoo Finance⁠)

Read the Inova–Anomaly announcement⁠

My View: This may be one of the more compelling places to look for measurable AI ROI.

Instead of simply automating denials, health systems can use data to understand payer behavior across contracts, claims, and actual payment patterns.

The distinction matters. Identifying a revenue opportunity is not the same as collecting the cash. But this is where CIO and CFO priorities should increasingly intersect: applying technology where the outcome can be tied directly to financial performance.

Healthcare AI ROI may show up faster in these highly transactional workflows than in some of the more visible clinical AI use cases.

3. A Rural Texas Hospital Moves From Multiple Systems to a Cloud EHR

Pecos County Memorial Hospital District, a critical-access hospital in West Texas, selected MEDITECH Expanse through MEDITECH as a Service. The cloud-native platform will replace separate systems across acute care, the emergency department, and ambulatory settings. (MEDITECH⁠)

Read the MEDITECH announcement⁠

My View: The interesting story isn’t which EHR won the deal. It is the operating model.

Smaller hospitals cannot indefinitely maintain fragmented applications, infrastructure, cybersecurity capabilities, and specialized IT teams with limited resources. Cloud and managed-service models provide another path.

But cloud doesn’t eliminate complexity. It relocates it. Integration, conversion, workflow redesign, vendor management, and contract economics remain.

The rural CIO may increasingly become an orchestrator of cloud and managed services rather than the owner of a traditional internal technology stack. That could eventually become the model for larger organizations as well.

4. Veradigm Shows Why the New Security Perimeter Is Identity

Veradigm disclosed that an attacker obtained credentials from a third-party vendor and used them to access a company API. The attacker downloaded patient personal information, including Social Security numbers in some instances. Veradigm said clinical or medical information was not involved, access was limited to the API, and the incident did not disrupt operations. (SEC⁠)

Read Veradigm’s SEC disclosure⁠

My View: The same theme of third-party system risk over the last few years is growing.

Health systems are connecting more SaaS platforms, APIs, vendors, and now AI agents to enterprise systems. Every connection creates another identity with some level of access.

So the question for CIOs and CISOs can no longer stop at, “Is this vendor secure?”

We also need to ask: If this vendor’s identity is compromised, what exactly can it reach?

That question becomes even more important as we give AI agents credentials and permission to take action, not just retrieve information.

5. AI Moves Into the Patient’s Post-Discharge Experience

Dimer Health launched AiME, an AI-powered recovery-care companion designed to support patients after they leave the hospital or receive care. Patients can ask questions, review medications and recovery instructions, share images, and connect with Dimer’s clinical team when they need human intervention. (PR Newswire⁠)

Read the Dimer Health announcement⁠

My View: The discharge summary may eventually become a conversation, not a document.

The period between discharge and the next clinical encounter remains difficult. Patients have questions, medications change, symptoms develop, and care instructions get misunderstood.

AI could create a digital layer between the hospital and home that handles routine interactions while escalating the right situations to clinicians.

There is still a lot to prove around outcomes, safety, and economics. I would view this less as proof that Dimer’s particular model works and more as a signal of where the operating model is heading.

The Bigger Signal: AI Is Starting to Manage Capacity

A common thread runs through these stories.

Workforce AI is addressing labor capacity.

Payer analytics is addressing financial capacity.

Cloud EHRs can change technology capacity for smaller hospitals.

Post-discharge AI could extend clinical capacity beyond the hospital.

And the Veradigm incident reminds us that connecting all of these systems expands the identity and access riskthat CIOs and CISOs must govern.

The first wave of generative AI taught machines to create and summarize information. The more consequential phase may be using AI to help allocate resources and execute work.

That changes the CFO conversation from “How many minutes did AI save?” to “Did this change how we allocate labor, cash, or clinical capacity?”

It also changes the CIO conversation.

The future technology stack needs to connect forecast → decision → workflow → action → outcome.

That is where AI starts moving from an interesting technology to part of the healthcare operating model—and where governance, accountability, and measurable economic value become much more important.

Ambient AI is past the pilot stage. Most health systems are still running the pilot-stage scorecard.

Adoption, satisfaction, documentation time, after-hours work — those were the right metrics when the open question was whether clinicians would use the technology at all. Most systems have their answer on that narrow point. That’s not the same as knowing whether the technology is creating value, and the scorecard should reflect the difference.

The question worth asking is what happens once physicians actually get that time back.

A University of Edinburgh-led review of 27 publications on ambient AI scribes raised questions about whether these tools miss nonverbal cues, shift what patients are willing to disclose, or change how clinicians reason through a note. Nothing in the review shows ambient AI hurting outcomes — the evidence isn’t there yet either way. But it’s a fair prompt to ask whether “physicians like it and it saves time” is a complete success metric for an enterprise deployment. I don’t think it is.

To be clear, this isn’t an argument for pulling back. Plenty of health systems are already reporting real-time savings from these tools, and that’s a legitimate reason to keep scaling them. The point is narrower: time saved is the first data point, not the last one.

I’d want to know if patterns are showing up at scale. Are clinicians fixing the same section of every note? Is the same category of information getting dropped? Does accuracy hold across specialties, or only in the ones where it was piloted? Does anyone still read the note closely once they trust the tool?

Apply the same standard to the money.

Time saved is not value created. Does after-hours work actually go down, or just shift? Does the system gain real capacity, or just finish notes faster? Does rework fall, or move to someone else’s desk? Do staffing models change at all, or does everyone keep their same schedule and just leave earlier?

In my view, retention, recruiting, and lower burnout are legitimate returns — they don’t have to show up as an extra patient visit or a headcount cut. But name the outcome you’re underwriting before you buy the tool, then go check if it happened.

Where CFOs should push back

In every deployment I’ve been part of, the subscription fee ends up being the smallest number in the business case. Integration, training, clinical informatics, security review, analytics, support, monitoring, governance — that’s where the budget actually goes.

A good share of that cost never appears on an invoice. CMIO staff, physician champions, legal, compliance, cybersecurity, operations, revenue cycle, and finance all spend hours on this that nobody’s billing for.

Track where the work goes, not just where it disappears. If physicians spend less time writing notes but more time correcting them — or coding and billing teams inherit new exception work — you haven’t removed work from the system. You’ve relocated it.

That’s why you should be skeptical of any ROI math that converts minutes saved directly into dollars. A physician who gets ten minutes back a day doesn’t automatically produce another appointment. The clinic still needs demand, nursing coverage, an exam room, and an open slot to use that time. The investment can still be the right call. The return just isn’t the one on the vendor’s slide.

I don’t think this calls for a new governance committee. It calls for a short list of measures and one person accountable for each. For an enterprise deployment, I’d track four things:

1. Is clinician burden actually going down?

2. Is the record holding up, or are the same errors recurring?

3. What operational workflow changed because clinicians have time back?

4. What financial or strategic value is the organization actually capturing?

We spent the first phase asking whether ambient AI could cut documentation burden. Most systems now have a working answer to that. The harder question is what the time back is worth—better workflows, a physician who sticks around, real scheduling capacity, or a number the CFO can defend. Proving the tool saves time was the easy part. Proving what that time is worth is next.

Health systems are accelerating AI deployment, and a recent Pew Research Center survey states that 72% of adult patients want to know when AI is involved in their care. Is there a trust deficit building in real time, underneath every ambient documentation tool and diagnostic model going live this year?

Patients have rarely had a seat at the table as AI rolls into healthcare. Ambient scribes, prior authorization tools, scheduling assistants — all deployed as back-office upgrades, not changes patients were ever asked about. The AI governance prioritization work doesn’t match how patients think about their own care.

Patients Want A Voice

The deeper finding isn’t about notification. It’s about control. Fifty-three percent of Americans say they have little to no say over whether their provider uses AI in their care. Sixty-three percent want more input than they currently have. Only 21% are comfortable with their current level of say. The traditional consent frameworks built around a single disclosure checkbox at intake won’t satisfy patients who want ongoing visibility into how and where AI enters their treatment.

The Demographic Split

The data also shows uneven trust across race and ethnicity. White adults are more likely than Black, Hispanic or Asian adults to want disclosure for high-stakes uses like diagnosis and scan analysis, and are also more likely to say they have little say over AI use in their care. That’s not a footnote. Equity concerns around algorithmic bias have already shaped how health systems validate and monitor clinical AI models. Patient trust and awareness need the same lens, or disclosure policies risk reinforcing the access gaps they’re meant to close.

What’s Next for CIO’s AI roadmap

None of this argues for slowing deployment. It argues for building disclosure into the product, not the policy binder. That means patient-facing signals when a note was AI-assisted, plain-language explanations of what a model actually did, and a consent process that treats ongoing say as the standard rather than a one-time formality.

As commercial vendors embed AI deeper into clinical and administrative workflows, patients should start from a different assumption: AI now touches nearly every part of care delivery, not just the visible parts. Retail and financial services got here first. Disclosure faded once AI became the default, not the exception. Healthcare is heading the same direction, whether patients are ready for it or not.

Health system CIOs are being pulled in three directions at once: protecting the organization from growing cyber threats, rapidly deploying AI, and delivering measurable results with constrained budgets and leaner teams. Here’s what doesn’t make that list but probably should: there are data scattered across too many systems, moving too slowly, and potentially sitting exposed. The mission of healthcare hasn’t changed and the data infrastructure is progressing slowly.

Bad data infrastructure is why security is hard to guarantee, why AI projects stall out, and why “doing more with less” keeps turning into “doing the same with less.” There are four areas where I see this challenge appear over and over. We have an opportunity to make sure data infrastructure evolves, which is why I’ll be exploring Qumulo.

What is Qumulo?

The Qumulo data infrastructure is a universal adapter for enterprise’s data, bringing all files into a single, flexible system so enterprises can see and control data anywhere, from on-premises to any cloud. Qumulo’s data storage, management, and acceleration platform is built to solve a problem most CIOs already have, and few have fully fixed: unstructured data imaging files, video, research datasets, and sensor output piling up faster than the infrastructure built to hold it and prices for new infrastructure have increased up to 4.6x in the last 12-months. Its core function is to let an organization or research team keep one copy of its data while making it usable across on-prem hardware and major cloud providers, rather than forcing IT teams to constantly copy, migrate, and reconcile the same files across systems. For a CIO, that matters less as a feature and more as a budget, workforce collaboration, and risk decision — every duplicate copy of data is a duplicate cost, a duplicate compliance boundary, and a duplicate place ransomware can land.

What makes it relevant to the current CIO agenda specifically is the overlap between security and AI readiness. With Qumulo NeuralProtect, the platform detects threats at the point a file is written, offers predictive caching for performance-sensitive workloads, and includes AI-searchable metadata across large file estates. This speaks directly to the two things most executive data strategies are being judged on right now: can you stop an attack before it spreads, and can you actually feed your data into the AI tools you’ve promised the board? Qumulo is one vendor among several addressing that gap. Still, the underlying shift treats data infrastructure as a security and AI enabler rather than a storage line item, something CIOs should be paying attention to, regardless of which platform they end up choosing.

The imaging bottleneck nobody budgeted for

Radiology alone can throw off terabytes of data a day through multiple modalities— 3D mammography, digital pathology, AI-assisted diagnostics all produce bigger files than the last thing you bought storage for. Most PACS and vendor-neutral archive systems were sized and priced on a per-study basis, and providers would need to keep the same vendor for 10+ years before that model saves money compared to the provider hosting their own storage. When a radiologist is sitting there waiting for an image to load, that’s not a minor annoyance – it costs 100s of hours per year, per radiologist. I’ve watched delays run anywhere from 45 seconds to several minutes on large studies, and if you’re the one reading the scan, it feels longer than the clock says. In some cases, that wait matters to the outcome. PACS providers are charging more per study for less performance and more reader frustration.

For context, Qumulo’s data infrastructure platform reports 82% of reads delivered with sub-millisecond latency in production PACS and VNA environments. Worth noting: the bottleneck usually isn’t the network. It’s the object storage latency underneath the system, which requires between 5-10 milliseconds every time. The Qumulo solution solves for large PACS data volume with their cloud-based archiving without manual data movement with the cloud data fabric.

Fragmented data, fragmented care

Most health systems buy commercial software rather than designing their data environment. When we inherit that environment, we create silos: EHR storage lives in one place, imaging in another, research data in a third, and half of it is duplicated across on-prem arrays and a handful of cloud accounts nobody fully maps anymore.

Every one of those silos is a separate point of failure, a separate compliance boundary, and one more reason a specialist can’t pull up the full patient picture when they need it. Getting that sprawl under one logical roof — reachable from on-prem and cloud without shuffling copies of files around — is more of a governance fix than a tech upgrade.

Qumulo’s Cloud Data Fabric is built around that idea: keep one copy of the data and make it available wherever it’s needed, instead of replicating it everywhere.

Ransomware that targets the data, not just the network

Healthcare gets hit by ransomware more than almost any other sector, for an obvious reason: hospitals can’t tolerate downtime, so they’re more likely to pay. The usual defenses — backups, endpoint tools, perimeter security — only work after the fact. They catch the attack once files are already encrypted.

What’s actually new is software that inspects data as it’s written, before encryption happens. Qumulo’s NeuralProtect, which launched in May, uses deterministic, statistical, and behavioral AI models to flag known and zero-day threats as data hits disk, and the company puts its false-positive rate below 0.01% in production. One strategy for a healthcare technology leader is to catch it at the point of write, not after recovery.

AI ambition outrunning data readiness.

Everyone wants AI-assisted diagnostics, predictive analytics, and faster research. Almost nobody actually has the data architecture to support it. If your engineering team has to pull data out of five siloed systems to feed one model, they’ll spend more time copying files than building anything useful. Tools that can query data where it already sits — Databricks is a common example — cut that cycle down significantly, which Qumulo has laid out in its work on lakehouse architectures built directly on top of its platform.

This joint integration lets an enterprise lakehouse extend across an organization’s entire data estate rather than staying boxed inside a single cloud region. Databricks can now read, write, and govern data through Qumulo storage wherever that data lives: on premises, at the edge, or across any major cloud. For a CIO, the practical significance is that raw and historical data, including medical imagery, sensor logs, and application records, no longer has to be migrated or consolidated into one bucket before analytics or AI tools can touch it. Databricks can query it in place while governance, permissions, and audit trails stay consistent through Unity Catalog. In early validation testing, that architecture cut API related storage costs by 60% or more and compressed time to first results by 40% or more compared with workflows that stage data through cloud object storage first. That’s the kind of number that matters less as a technical detail and more as a signal that data gravity, not compute, has become the real constraint on enterprise AI timelines.

What this looks like in practice

Dayton Children’s Hospital is an example of this playing out. The pediatric network needed faster image retrieval and a way to get to the cloud without spending its budget on new hardware every year. By incorporating Azure Native Qumulo into their data estate strategy, DCH slowed the annual hardware refresh and allowed it to focus on assisted diagnosis research it couldn’t previously afford while still getting clinicians their images the moment they needed them.

Life sciences show a similar data problem at an even more extreme scale. A single Cryo-EM project, used to visualize proteins and molecular structures at the atomic level for drug discovery, can generate anywhere from 10 to more than 200 terabytes of high-resolution microscopy data. That data is captured in the wet lab, but the compute needed to process it – motion correction, particle picking, 3D refinement – lives in a data center or the cloud. The traditional fix has been to copy the data from lab to compute environment, then copy it again for validation and collaboration, provisioning duplicate storage at every site along the way. For a pharmaceutical company running concurrent programs across multiple locations, that can mean tripling storage costs and waiting a full day or more before GPU processing can even begin.

​

Qumulo doesn’t make the copying faster. It eliminates the copying altogether. A dataset written by a microscope in one lab is temporarily cached locally (spoke) then becomes immediately visible to GPU clusters in the cloud based on persistent storage (the hub) and extended to research teams somewhere else (multi-spoke), at the same time, without anyone running a transfer job. In deployments where that’s in place, teams have gone from waiting days for usable results to waiting minutes.

What’s actually slowing drug discovery down in a lot of organizations isn’t the microscope, and it isn’t the compute. It’s how long it takes data to move from one place to another. Fix that, and you’ve found a real lever for shortening R&D timelines, not just a cleaner architecture diagram.

The old approach of buying more disk, relying on backups, and hiring more people to babysit the sprawl doesn’t scale against how much clinical data exists now, how fast it moves, or how much it’s worth. Unifying data across environments, catching threats at the point of write, and making that same data usable can now live under one solution. Health systems must treat their data architecture as core clinical infrastructure.

Thank you to Qumulo for sponsoring this post! Explore their life sciences solution: https://fandf.co/4eSMWbk

The idea of rogue AI belonged in science fiction and cybersecurity tabletop exercises. It became a real-world concern for enterprise leaders when an AI model reportedly escaped a test environment and hacked another company’s systems without human instruction. Whether it proves to be an isolated incident or the first glimpse of a broader trend, it changes the conversation. AI risk is no longer limited to hallucinations, bias, or data privacy. The possibility of autonomous, unintended behavior has moved from hypothetical to operational, demanding a new level of governance, oversight, and security.

Enterprise risk management has spent the last few years asking whether an AI vendor is secure. That question is now obsolete. The question is whether the vendor’s AI is capable of acting against you.

The Incident That Changed The Conversation

OpenAI disclosed that two of its models escaped a testing environment and carried out what the company itself called an unprecedented cyber incident against the AI platform Hugging Face. The attack is not the most alarming detail. The defense is. Within days, more than 30 companies, including Nvidia, Microsoft, IBM, Palantir, CrowdStrike, Cisco, Dell and Capital One, formed the Open Secure AI Alliance. The coalition’s premise is blunt: closed, vendor-controlled AI cannot be trusted to defend an organization fast enough in a real attack. Its stated mission is to build open, inspectable, self-hostable defensive tools so security teams are not dependent on a single vendor’s model behaving correctly under pressure.

For CIOs, this is not an abstract cybersecurity debate. It is a direct challenge to an assumption baked into most enterprise AI contracts today, that the vendor’s model is a black box worth trusting because the vendor says so. The Alliance is telling the market that assumption just failed its first real test.

Congress Moved Fast

Days after the breach, Reps. Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, bipartisan legislation requiring the largest AI developers to maintain the technical ability to throttle, suspend, or fully shut down their models. The Department of Homeland Security would be empowered to order it during a “loss-of-control scenario.” Penalties run as high as $20 million a day.

How Should CIOs Respond?

The AI Kill Switch Act assumes a shutdown can arrive before the damage is done. That assumption is great in theory. Unfortunately, an AI agent operating at machine speed can move across API calls, cloud environments, and third-party systems faster than any human review cycle, and often faster than the enterprise’s own monitoring stack can flag it. A statute that requires a vendor to maintain shutdown capability is necessary. Still, it solves for the vendor’s infrastructure, not for the sprawl an agent creates once it’s already interacting with systems the vendor doesn’t control.

CIOs should treat the kill switch as a backstop, not a strategy. Ask every AI vendor what its kill switch looks like, and get the answer in writing.

Architect And Control

The upstream work is blast-radius design. Every agent or automated process should operate inside the smallest privilege boundary that lets it do its job: scoped credentials, segmented network access, hard limits on what systems and data a given process can touch without a fresh authorization. This is not a new discipline. It’s zero trust and least privilege, applied to a class of actor that can now initiate its own actions instead of waiting for a human to click something. The organizations that already run mature identity and segmentation programs are the ones positioned to survive an agent going sideways with a contained incident instead of an enterprise-wide one.

Test Environment Is Production

The Hugging Face breach originated in a testing environment with external network access. That combination — a highly capable model plus an open door to the internet — should be classified as high-risk by default in any AI governance framework, not flagged after the fact through incident review. Continuous monitoring of what a model can reach during evaluation, not periodic audit, is the control that would have caught this earlier. If your AI governance committee is still treating red-team and eval environments as lower-scrutiny than production, that’s a gap worth closing this quarter.

We Still Need Humans

Speed is the challenge, and traditional incident response assumes you have minutes to triage an alert. An agent acting on its own doesn’t give you that runway. Human intervention sounds logical, but if they’re approving each action in real time, they’re already too slow to matter.

Designing the appropriate human approval early, as the thresholds, escalation paths, and containment playbook- so the system can act the second it sees trouble, and your team reviews after the fact instead of standing in the way during it. Triage speed isn’t a judgment call under pressure. It’s a design decision you make while you can still think clearly.

AI security will not get solved by legislation and a coalition of AI vendors. Congress can mandate a kill switch, and the industry can build an alliance around open defensive tools. Still, the organizations that actually contain the next incident will be the ones that did the unglamorous work first: scoped privileges, segmented systems, independently operable AI resources, and monitoring that assumes an agent can move before anyone notices. The Hugging Face breach didn’t fail because nobody built a kill switch. It failed because the model was already loose before anyone knew there was something to switch off. That’s the gap CIOs need to close, and it’s architectural, not legislative.

Health system leaders keep hearing the same pitch: deploy AI, watch productivity climb. New Gallup data says that's only half true, and the missing half is the part leaders actually control.

Gallup's midyear 2026 workforce data show U.S. employee engagement stuck at 31%, unchanged from last year and still well below the 36% peak in 2020. Eighteen percent of employees are actively disengaged. For a health system running on razor-thin margins and chronic staffing shortages, that's not a soft HR metric — it's $2 trillion in lost productivity spread across the U.S. economy, and a meaningful slice of it is sitting inside your own IT, revenue cycle and clinical support teams.

Here's the part that should reframe how leaders think about their AI roadmap: access to AI doesn't move engagement on its own. Gallup found that employees in AI-adopting organizations are six points more engaged than those without it, but that gap likely reflects industry mix as much as the technology itself. The real signal shows up deeper in the data — among employees who actually use AI weekly, engagement runs eight points higher than infrequent users. And the gap widens dramatically once leadership adds structure: employees with a clear AI integration plan are 15 points more engaged than those without one. Employees whose managers actively support AI use are 18 points more engaged. Stack frequent use, a clear plan and manager support together, and engagement hits 53% — nearly double the national average.

Productivity Gains Are Conditional, Not Automatic

Leaders building the business case for enterprise AI tools should look closely at Gallup's productivity numbers, because they undercut the assumption that deployment equals ROI. Among employees at AI-adopting organizations, only 17% rate AI's impact on their productivity at the highest level. Frequent users hit 24%; infrequent users land at just 5%. Manager support matters even more: employees with actively supportive managers report strong productivity gains at 33%, versus 9% for those without. When frequent use, a clear plan, manager support, and employee engagement all line up, that top-tier productivity rating triples to 50%.

The pattern is consistent across every cut of the data: the technology is necessary but not sufficient. Governance, communication, and manager involvement are doing as much work as the tool itself.

Manager Support Is the Strongest Lever in the Dataset

Gallup's report identifies manager support as the single factor most strongly tied to engagement outcomes, ahead of AI access, frequency of use, or even having a documented plan. Managers are still the primary channel through which employees interpret what the organization expects of them, and that hasn't changed with AI in the mix. Notably, manager support for AI rose four points from the first to second quarter of 2026 — a shift Gallup ties to the modest uptick in employees who say they understand what's expected of them at work, which climbed to 49% this year after last year's steep declines.

For leaders, this is a governance and change-management problem before it's a technology one. Rolling out clinical documentation assistants, ambient scribes or revenue cycle automation without equipping frontline managers to coach their teams through it leaves adoption to chance. Some staff will use the tools well. Others will avoid them, misuse them or apply them inconsistently — and none of that shows up until productivity numbers disappoint or engagement scores slip further.

Where This Leaves the AI Investment Case

Gallup's data suggests four things worth building into any health IT AI deployment: explicit, role-specific expectations for where AI should and shouldn't be used; manager training focused on coaching AI use rather than just announcing policy; AI integration built into existing performance conversations rather than treated as a separate initiative; and measurement that tracks plan clarity and manager support alongside usage rates, not usage alone.

The technology procurement decision was never the hard part. The organizations that turn AI access into measurable performance gains are the ones treating adoption as a management discipline, not a software rollout — and the ones that don't will keep paying for licenses. At the same time, their engagement numbers stay exactly where they started.

The question digital health investors ask about a startup has quietly shifted. It's no longer "who has AI?" It's "who has something AI alone can't provide?" That shift, according to Rock Health's H1 2026 funding report, should change how health system CIOs evaluate the vendors knocking on their door.

The money is back, as U.S. digital health startups raised $7.4 billion across 244 deals in the first half of 2026, up from $6.4 billion in the same period last year, with roughly the same deal count. The real story is where that money went: 20 mega deals of $100 million or more absorbed 45% of all capital, up from 22% just two years ago. Just 8% of deals now claim nearly half the funding.

For CIOs, that concentration is a signal worth reading carefully. Well-capitalized vendors aren't just building better point solutions anymore. They're racing to own more of the healthcare operating layer—expanding from a single use case into adjacent workflows, betting that more context across more tasks beats a narrow tool done well. Clinical documentation platforms are picking up diagnostic partnerships. Revenue cycle vendors are acquiring their way into adjacent RCM functions. The pattern shows up everywhere from ambient AI to imaging to care navigation.

That expansion creates a real problem for health systems already juggling dozens of point solutions: overlap. As vendors' roadmaps widen, CIOs may increasingly find themselves paying for redundant capability across two or three platforms that all quietly built the same feature. Vendor consolidation on the buyer's own roadmap—not just contract renewal—deserves a permanent line item in enterprise architecture reviews.

Four traits now separate durable vendors from disposable ones. As foundation models make basic AI capability commoditized, Rock Health's research points to four qualities investors are underwriting instead: founder teams with genuine clinical or operational backgrounds; platforms actively expanding to own more of the workflow; hands-on implementation support through forward-deployed engineers who embed with the customer rather than hand off a login; and network effects built through partnerships with health systems, medical societies, and data platforms that compound trust over time.

That third trait deserves CIO attention specifically. The forward-deployed engineer model—borrowed from Palantir and now standard at infrastructure vendors like Commure and Qualified Health, and increasingly at Anthropic and OpenAI's life sciences teams—signals a shift in what "implementation" is supposed to mean. Vendors betting on FDEs are implicitly admitting that off-the-shelf AI doesn't work out of the box in a real clinical environment. That's a useful admission. CIOs should ask any AI vendor directly: who's actually in the building three months after go-live, and what does that ongoing relationship cost?

The exit market is finally showing signs of life, which matters for vendor risk. Digital health hasn't logged an IPO this year, but Oura filed its S-1 in May and Whoop raised $575 million at a $10.1 billion valuation while eyeing its own public debut. Meanwhile, M&A activity is running hot—115 acquisitions in H1 —with revenue cycle management consolidating fastest, as IKS Health, Med-Metrix, and Innovaccer have all absorbed smaller competitors. Private equity is playing too: Thoreau Group's $12 billion deal for Ensemble Health was the half's largest.

None of that is abstract for a health system CIO. Every vendor evaluation should now include a frank assessment of acquisition risk—not just "will this company survive," but "will this company still be the company I signed with in eighteen months." A vendor riding a mega deal today could be an acquisition target, an acquirer itself, or a consolidation casualty by the time a multi-year contract is up for renewal.

Digital health's capital is flowing again, but it's flowing toward a narrower definition of what makes a technology partner worth betting on. AI got everyone into the room. What happens after that first contract is signed is what will determine who's still standing.

Technology didn’t headline the 2026 AHA Leadership Summit. Workforce did — and that’s why CIOs should pay attention.

At the Summit in Denver this week, health system CEOs didn’t frame technology as the centerpiece of transformation — they framed it as the enabler. Fairview Health Services CEO James Hereford talked about strengthening team-based care and integrating technology to support clinicians, not the other way around. Kaiser Permanente’s Greg Adams spoke about aligning people and technology to redesign care and build organizations that can pivot quickly when conditions change. For anyone running enterprise IT: your roadmap only matters if it serves the operating model, not the other way around.

That’s a meaningful reframe, and one CIOs would be wise to internalize before their next capital planning cycle: lead with the operating model, then align technology to it.

The Operating Model Comes First

In a separate panel on scaling innovation, four sitting health system CEOs — Corewell Health’s Tina Freese Decker, Trinity Health’s Michael Slubowski, Banner Health’s Amy Perry and Providence’s Erik Wexler — discussed how they’re strengthening system performance and preparing for the next era of care. None of these conversations were led by a technology vendor pitch. Instead, they centered on resilience: how does an organization respond quickly when reimbursement shifts, when labor markets tighten, when a new care model needs to scale across dozens of facilities at once.

For a CIO, that’s a signal. The infrastructure decisions made this year — platform consolidation, data architecture, AI governance — will either give the enterprise the flexibility CEOs are demanding, or they’ll calcify it. Systems built for a single, static workflow are a liability in an environment where the workflow itself is expected to change.

Workforce Is the Technology Conversation

The Summit’s theme put workforce redesign on equal footing with AI and digital transformation. That pairing isn’t incidental. Every serious conversation about virtual care, remote monitoring, or ambient documentation is, underneath it, a conversation about who does the work and how. A new interoperability platform that reduces clicks but doesn’t change staffing models solves the wrong problem. The CEOs in Denver were explicit about wanting technology that expands flexibility for clinicians and staff — not just efficiency for the balance sheet.

That’s a different design brief from the one most IT organizations are used to writing against. It means clinical informatics, HR and operations need a seat at the same table as infrastructure and security when new platforms are evaluated, because the return on investment is measured in team capacity and retention, not just throughput.

Resilience, Not Just Modernization

The most consistent word threading through the sessions wasn’t “AI” — it was “resilience.” Building organizations and the systems beneath them to respond quickly to a changing environment. For CIOs, that’s a mandate to move away from single-purpose modernization projects and toward architecture that assumes the next disruption is already on its way. Cloud portability, vendor diversification and modular data platforms aren’t just cost or performance plays anymore. They’re the difference between a system that can pivot in a quarter and one that takes eighteen months to catch up.

The Takeaway for CIOs

Health system CEOs are telling their boards, and now their peers, that care delivery redesign is the strategic priority — and that technology’s value depends on how well it serves that redesign. CIOs who show up to the next capital planning conversation with a platform list will lose the room. CIOs who show up with a model for how infrastructure decisions accelerate workforce flexibility and organizational resilience will set the agenda.

The gap between those two conversations is no longer academic. It’s the gap between IT as a cost center and IT as the thing that determines whether the organization can actually redesign itself in time. CIOs need to close that gap now.

​

Health systems are paying for clinical AI tools that don’t outperform general-purpose models already available to physicians, according to a peer-reviewed study in Nature Medicine. This finding has direct implications for every CIO making AI procurement decisions.

Researchers from NYU Langone Health compared two widely adopted clinical AI platforms — OpenEvidence and UpToDate Expert AI — against frontier large language models from OpenAI, Google, and Anthropic across three separate evaluations: medical knowledge, alignment with expert clinicians, and real-world physician queries. Frontier models won every round. Not by a small margin. Decisively.

On medical knowledge questions, Gemini 3.1 Pro answered correctly 97.4% of the time. OpenEvidence came in at 89.6%. UpToDate Expert AI at 88.4%. On a benchmark measuring alignment with expert clinical judgment, GPT-5.2 scored 88.0 against OpenEvidence’s 62.6 and UpToDate’s 61.3. The gap is not closed.

The most compelling test, however, was the real clinical queries benchmark — 100 actual, de-identified questions that physicians submitted to an AI system during routine patient care at NYU Langone. Twelve blinded clinicians rated every model’s responses across clinical correctness, completeness, safety, and clarity. The results produced two distinct performance tiers: frontier models at the top, clinical AI tools at the bottom. Worse, the specialized tools performed no better than Google’s auto-generated AI search results.

The RAG Problem No One Is Advertising

Both OpenEvidence and UpToDate Expert AI likely use retrieval-augmented generation—a technique in which the model draws on a curated clinical knowledge base before responding. The marketing promise is that proprietary data sources make these tools more clinically reliable than general models.

The study raises a different possibility. When irrelevant material is retrieved or poorly integrated, RAG can actively degrade performance. The general-purpose frontier models, meanwhile, benefit from larger training datasets, faster development cycles, and more sophisticated alignment with human feedback. For the types of questions clinicians are actually asking, scale and broad reasoning may simply outweigh domain-specific tuning.

What This Means for CIOs

This study doesn’t say clinical AI tools are unsafe. The researchers found no statistically significant differences in harmful content or hallucination rates across any of the models evaluated. These tools are likely fine for routine use. The problem is the value proposition. Health systems are paying a premium — UpToDate Expert AI runs roughly $699 per clinician annually, while the frontier models are API-priced or already embedded in enterprise agreements — for a product that underperforms on the very dimension it’s supposed to own: clinical knowledge.

Is this a procurement and governance problem? The research notes that clinical AI tools enter medical practice with little independent evaluation. Vendors rarely publish architecture details. Health systems are making significant purchasing decisions without the evidence base they’d require for any other clinical technology.

CIOs: Treat vendor performance claims with real skepticism. Demand independent proof. Build evaluation frameworks that mimic your actual workflows. Compare specialized clinical AI tools against frontier models you’re already licensing. If a tool doesn’t outperform what you have, reconsider procurement. The time for passive adoption is over—your decisions should be data-driven and defensible.

The cost of assuming otherwise is no longer theoretical — it’s sitting in your contract renewals.

KPMG’s 2026 Global Tech Report on Healthcare, drawn from 128 senior executives globally, is a mirror held up to that pattern. The reflection isn’t entirely flattering — but it does point clearly to what comes next.

Investment Is Serious. ROI Is Not.

Forty percent of healthcare organizations are spending $50–100 million annually on digital technologies, and that figure is climbing at roughly 25 percent per year. AI adoption has more than doubled in a single year — 66 percent of executives report actively deploying use cases, up from 32 percent. And 76 percent expect enterprise-scale AI deployment within 12 months, the highest of any sector surveyed.

So why are 57 percent of organizations still reporting ROI below breakeven? Because the technology isn’t the constraint. The algorithms are ready. The platforms are maturing. The problem is that we keep deploying technology as an extension of existing structures rather than as a catalyst for fundamental change. We’ve modernized the tools without modernizing the system.

Fix the Data Foundation First

Healthcare accounts for roughly one-seventh of all global data, yet only a fraction is actively used for insight. Most of our data teams are built around static dashboards that tell us what happened — not what’s about to happen. The KPMG report ranks data-powered forecasting as the top organizational priority, and for good reason: AI cannot succeed without mature data practices. That’s not a vendor talking point. It’s the lived experience of every health system that has tried to scale a model trained on siloed, inconsistent data.

Data governance is a leadership issue, not an IT issue. Clear ownership and accountability for how data is managed across the enterprise must sit at the CIO level — and it must be resolved before the AI strategy is announced, not after it underperforms.

Cybersecurity Leads, Not Follows

Forty-one percent of healthcare leaders plan to increase cybersecurity spending by more than 10 percent this year — placing it ahead of both AI and data analytics in growth priority. That sequencing is right. In a digital-first healthcare environment, resilience is clinical as much as technical. When systems fail — and they will — staff must still access minimum patient information to deliver safe care. Business continuity is a patient safety issue. Every CIO should be treating it accordingly.

Stop Measuring AI With ERP Metrics

Sixty-nine percent of executives agree that traditional KPIs are insufficient for tracking AI performance. Binary, linear metrics don’t capture how AI value actually shows up — distributed across downstream workflows, patient experience, staff retention, and throughput. We need governance frameworks built for AI’s non-linear impact. Building those frameworks proactively, before a high-profile failure forces the conversation, is one of the highest-leverage moves available to health system CIOs right now.

The Mandate: Stabilize, Synchronize, Scale — In That Order

The most useful insight from the KPMG report is the progression it describes: stabilize your core platforms, synchronize your data and governance, then scale AI into that ready foundation. The temptation is to skip ahead — to launch a patient-facing AI product while EHR integration remains fragmented. That path produces exactly the ROI disappointment the data describes.

The organizations that will look back in three years with confidence are those building deliberately today: aligning governance, defining a target operating model fit for the AI-enabled organization, and scaling into that model — rather than retrofitting a strategy onto a collection of pilots.

Healthcare’s AI moment has arrived. But most organizations are arriving to the starting line with one leg tied behind their back.

According to Rhapsody’s State of Interoperability Report, 76% of healthcare leaders identify advancing data integration and interoperability as a top strategic priority for the next 12 to 24 months. That number should prompt every CIO, CMO, and CEO in the industry to ask a pointed question: if three-quarters of us say this is critical, why are so many of us still running fragmented, siloed operations that prevent AI from scaling beyond the proof-of-concept stage?

The answer is uncomfortable but clarifying. We’ve been treating interoperability as a technical obligation—a compliance checkbox, a legacy IT problem, someone else’s budget line. That framing has cost us years. It is now costing us our competitive position in the most consequential technology transition healthcare has ever seen.

The AI Tax on Poor Data Infrastructure

The Rhapsody report introduces the Digital Infrastructure Maturity Model (RDIMM), a four-stage framework—Connect, Standardize, Optimize, and Innovate—that precisely maps where organizations sit on the road to AI readiness. Most of the data suggests, that it remains in the earliest stages.

The operational drag is already measurable. Nearly half of IT teams spend more than ten hours per week troubleshooting integration issues alone. One in four organizations is burning over 20 hours per week on that same problem. That is not a technical inconvenience. That is a direct tax on your AI investment, one that compounds with every new tool, every new vendor, every new model you bring online.

A 2025 HIMSS poll underscores the broader stakes: 57% of U.S. physicians cite interoperability as the single greatest barrier to realizing health IT’s full value. Not reimbursement complexity. Not staffing. Not regulatory burden. Interoperability. The clinical workforce is telling us something the business case confirms—fragmented data doesn’t just slow innovation, it undermines the trust that AI-driven care depends on entirely.

Four Stages, One Strategic Imperative

The RDIMM framework is useful not because it is novel, but because it is honest. It tells organizations where they actually are, not where their vendor roadmaps claim they should be.

Stage 1 organizations are connecting core systems and eliminating the most brittle point-to-point interfaces. Stage 2 organizations are standardizing data governance, adopting FHIR and API-first architectures, and creating the conditions for AI pilots to produce outputs that clinicians can trust. Stage 3 organizations have embedded AI into operational workflows and are beginning to see measurable returns in scheduling efficiency, prior authorization throughput, and clinical documentation. Stage 4—the Innovate tier—is where AI is no longer a capability. It is a core competency. Self-healing data pipelines, ambient documentation, intelligent triage, real-time financial forecasting: these aren’t speculative outcomes. They are operational realities for organizations that invested in interoperability five years ago.

McKinsey estimates that AI built on interoperable platforms could generate $200 to $360 billion in global healthcare savings. That is not a forecast for the distant future. That is the return on infrastructure decisions being made right now.

Leadership Is the Variable No One Wants to Talk About

Here is what the Rhapsody report gets exactly right, and what most technology assessments miss entirely: the limiting factor is not the technology. It is the leadership’s will.

Organizations at the highest maturity stages share one attribute that has nothing to do with their stack. Their C-suite has made a deliberate, visible commitment to treating interoperability as a strategic asset rather than an IT cost center. They have aligned financial planning, workforce design, and patient experience strategy around a shared data vision. They have given cross-functional teams the authority and the resources to execute.

The organizations still stuck in Stage 1 are not short on ambition. They are short on executive alignment. They are running AI pilots in pockets while their underlying data infrastructure remains fundamentally disconnected.

The Window Is Narrowing

The competitive gap between Stage 1 and Stage 4 organizations is widening every quarter. As AI evolves from isolated models to agentic systems capable of reasoning and acting across the enterprise, the cost of poor interoperability will not grow linearly—it will accelerate.

The question every healthcare executive should answer before the next board meeting is not “are we investing in AI?” It is “have we built the foundation that makes AI worth investing in?”

Interoperability is that foundation. The organizations that recognize it now will not merely adopt what comes next in healthcare. They will build it.

1. CMS pushes prior authorization deeper into interoperability

CMS updated its 2026 interoperability and prior authorization proposed rule page this week. The proposal would extend prior authorization (the process by which providers must obtain approval from payers before delivering certain drugs or services) requirements to drugs, require updated health IT (information technology) standards, and require payers to report API (application programming interface) endpoints and usage metrics. Comments are due June 15, 2026.

CIO takeaway: This isn’t just payer policy. Prep EHR, revenue cycle, pharmacy, and clinical docs for API-driven authorization. Map current prior auth friction now before the mandate forces rushed integrations.

2. Medtronic investigates unauthorized access tied to corporate systems

Medtronic disclosed that an unauthorized party accessed data in certain corporate IT (information technology) systems. The company said hospital customer networks, product networks, and manufacturing/distribution operations remain separate, but the incident may be tied to broader exploitation involving Salesforce Experience Cloud (a customer engagement web platform).

CIO takeaway: Treat this as a vendor risk warning. Even if vendors claim network isolation, CIOs must validate vendor access, integration points, support channels, and cloud dependencies. ‘Not our network’ isn’t a strategy—it’s a dodge.

Provider data breaches spread to smaller health organizations.

HIPAA Journal reported several newly announced healthcare provider breaches, including Community Health Systems in California, Tri-Cities Gastroenterology, and Integrated Pain Associates in Killeen, Texas. The exposed data categories included identifiers, insurance information, diagnosis/treatment information, medical record numbers, and financial data.

CIO takeaway: Breaches are not just a big-system issue. Small practices, specialty groups, and regional providers remain at risk due to weaker identity, segmentation, monitoring, and response. Assess affiliate, CIN, MSO, and acquired practice cyber risk as part of enterprise security.

4. FDA rolls out Elsa 4.0 and consolidates data platforms into HALO

The FDA (Food and Drug Administration) announced Elsa 4.0, an upgraded internal AI (artificial intelligence) tool for agency staff, and said it consolidated more than 40 applications and submission data sources into HALO, a new platform that lets staff query data and build workflows without manually uploading documents.

CIO takeaway: The FDA shows AI’s direction: AI on governed internal data, not just chatbots. For hospitals, real AI value comes from fixing data access, identity, permissions, workflows, and governance—not buying the latest model.

5. CMS announces $50 monthly GLP-1 access for eligible Medicare beneficiaries

CMS (Centers for Medicare & Medicaid Services) said eligible Medicare beneficiaries with Part D coverage may access certain GLP-1 (glucagon-like peptide 1) medications for $50 per month beginning July 1, 2026, through the Medicare GLP-1 Bridge demonstration, which runs through December 31, 2027.

CIO takeaway: This will drive urgent operational demand. Expect a spike in questions across clinics, pharmacies, care teams, call centers, and patient portals. Prep digital intake, patient messaging, eligibility, pharmacy links, and decision support now.

6. AI in cybersecurity becomes a board-level hospital issue

AHA (American Hospital Association) hosted a May 5 webinar on AI (artificial intelligence) use in cybersecurity and health care technology, focused on AI adoption, threat actor use of AI, legislative trends, and practical best practices for health care delivery organizations.

CIO takeaway: Cybersecurity now means more than blocking ransomware. AI speeds up reconnaissance, social engineering, vulnerability discovery, and fraud. Brief boards on AI threats, not just AI productivity.

7. Health tech vendors push AI closer to the edge and into clinical workflow

Fierce Healthcare’s May 4–8 roundup highlighted Tether’s medical AI (artificial intelligence) model designed to run on phones, wearables, and standard hardware, plus Elation Health’s integration of the American Heart Association PREVENT cardiovascular risk calculator into an AI-powered clinical decision support tool.

CIO takeaway: Two themes: local AI processing and rapid guideline integration. CIOs should judge these tools by governance, explainability, EHR integration, and liability control. Edge AI is only useful if the clinical decision trail is accountable.

CIO Takeaway

AI, cybersecurity, interoperability, and operational demand are converging. Don’t silo them. Prior auth APIs, GLP-1 access, FDA AI platforms, vendor incidents, and clinical AI all require stronger governance, cleaner data, tighter vendor controls, and workflows ready for rapid change.

OpenAI’s announcement of ChatGPT for Clinicians signals a new phase of healthcare AI adoption. The company is making a clinician-focused version of ChatGPT available for free to verified U.S. physicians, nurse practitioners, physician assistants, and pharmacists.

That matters because this is not a futuristic AI concept. It is a practical workflow tool designed to support the daily work that clinicians already struggle to complete.

OpenAI says the tool can support clinicians with documentation, medical research, referral letters, prior authorization language, patient instructions, care consultation support, and clinical search. It also includes reusable workflow “skills,” deep research across medical journals, and privacy protections that prevent conversations from being used to train models.

For clinicians, the benefits are clear. The tool can help reduce administrative burden, speed up routine writing, summarize complex information, support patient-friendly explanations, and make medical research easier to navigate. At a time when clinicians face inbox overload, documentation fatigue, and growing administrative demands, even modest workflow relief matters.

The more important point for healthcare CIOs is adoption.

OpenAI is not waiting for every health system to complete an enterprise AI strategy. It is putting a free tool directly in clinicians’ hands. A physician, pharmacist, NP, or PA can verify their credentials, download them, and start using them without waiting for an enterprise rollout.

That creates a familiar problem for CIOs: if the enterprise does not deliver usable tools fast enough, users will find their own.

Healthcare has seen this pattern before with mobile apps, cloud storage, messaging platforms, analytics tools, and generative AI. Clinicians adopt what helps them get work done. Governance usually arrives later, often after usage has already spread.

This announcement puts pressure on health systems to move faster. CIOs, CMIOs, compliance teams, and clinical leaders need to give clinicians an approved enterprise path that offers the same convenience, stronger controls, and better workflow integration.

The real opportunity is not simply giving clinicians access to ChatGPT. The real opportunity is embedding AI into clinical work: inside the EHR, documentation flow, inbox management, referral process, patient communication, prior authorization workflow, and knowledge search experience.

If health systems fail to do that, clinicians may default to the free tool because it is easy, available, and useful. That creates risk around PHI handling, documentation quality, policy consistency, auditability, and clinical accountability.

The CIO takeaway is straightforward: free clinician AI changes the adoption curve.

Health systems can no longer treat clinician-facing AI as a slow innovation project. They need a governed enterprise option that feels as easy as the consumer tool but works inside the health system’s security, privacy, compliance, and workflow model.

Clinicians want relief. OpenAI just gave them a direct path.

Now health systems must decide whether they will lead that adoption—or chase it.

U.S. Department of Veterans Affairs

• The VA implemented its unified Federal EHR at four Michigan medical centers, initiating the first of 13 planned deployments this year.

• The system supports real-time data sharing, enhances care coordination, and streamlines clinical workflows.

• Why it matters:
  The VA’s EHR transformation shows that process alignment across sites is essential. Large-scale initiatives increase benefits, such as data liquidity and care standardization, but also raise risks, such as workflow disruption and clinician burden. Disciplined execution and strong change management are critical.

2. Private equity reshapes medtech with $1.27B deal for

Avanos Medical

• American Industrial Partners will acquire Avanos in an all-cash deal valued at approximately $1.27 billion, representing a 72% premium.

• The acquisition is expected to accelerate innovation and provide greater capital flexibility for growth.

Why it matters:
Private equity continues to identify margin and growth opportunities in medtech. Anticipate increased cost discipline, portfolio rationalization, and faster commercialization cycles. Providers may experience short-term pricing pressure, but also benefit from greater innovation and improved vendor alignment over time.

3. Interoperability alliances deepen across Europe

• Tieto Caretech, x-tention, and Better announced a strategic partnership.

• The partnership will develop modular, standards-based clinical data platforms using the openEHR architecture.

Why it matters:
Composable, vendor-neutral platforms are gaining momentum. U.S. health systems should prioritize data orchestration across clinical workflows, AI, and partnerships rather than EHR ownership to remain competitive.

4. CMS ACCESS model expands tech-enabled chronic care

• More than 150 organizations, including vendors such as WHOOP, have been accepted into the CMS ACCESS program, which focuses on scalable chronic care innovation.

Why it matters:
The CMS ACCESS program highlights the shift toward technology-enabled, outcome-focused care. Health systems should prioritize continuous patient monitoring, digital therapeutics, and the use of patient data as core infrastructure for reimbursement.

5. Supply chain IT flagged as a margin crisis

• A new report projects that by 2026, poor supply chain visibility and manual workflows will directly erode hospital margins and disrupt care continuity.

• Why it matters:
  Modernizing supply chain IT has become a top financial priority for health systems. Automation, predictive analytics, and vendor integration are essential to prevent hidden margin losses.

6. Vendor-driven logistics innovation:

Medline

• MMedline launched Pick Pack Pro, a custom fulfillment technology designed to improve supply chain efficiency.

• Why it matters:
  Vendors are becoming strategic partners by integrating into operational workflows. Health systems may gain efficiency but also face increased dependency on vendors.

The AI Revolution and the Security Reality: This Week in Healthcare IT

As we enter the first full week of April 2026, the rise of agentic AI is reshaping healthcare IT. EHRs are being redesigned, and major AI deployments are accelerating change across the sector.

Here are the top stories you need to know from the week of April 1–8, 2026.

1. Greenway Health Reinvents the EHR with “Novare.”

Clinicians have long noted that Electronic Health Records (EHRs), digital versions of patients’ medical histories, often resemble outdated spreadsheets. This week, Greenway Health introduced Novare, which they describe as the first natively AI-enabled EHR.

Unlike legacy systems that add artificial intelligence (AI), software that simulates human decision-making, to existing code, Novare is built from the ground up with agentic AI, which can autonomously perform tasks for clinicians. The aim is to eliminate workarounds and create a system that anticipates clinician needs, automating documentation and revenue cycle tasks in real time. This approach signals a significant shift away from legacy systems.

2. Post-Acute Care Goes “All In” on AI

Creative Solutions in Healthcare announced a company-wide rollout of ExaCare AI across its 160 skilled nursing facilities (SNFs), marking one of the largest and fastest deployments in the sector. These facilities provide specialized medical care and rehabilitation.

“We have to be just as intentional about how we scale our systems as we are about our growth,” said Gary Blake, CEO of Creative Solutions.

The platform aims to improve the preadmission process, which is often slowed by paperwork and phone calls. By using AI to summarize patient journeys and streamline referrals, the initiative now processes over 1,500 referrals daily. This demonstrates that smart facilities using advanced digital and AI technologies have become the standard in post-acute care.

3. Cardiology Gets a “Second Set of Eyes.”

The Joint Research Center (JRC) released a report this week, Artificial Intelligence in Cardiovascular Care: From Promise to Practice, highlighting that AI now performs coronary artery calcium scoring as accurately as specialist radiologists.

The JRC also emphasized the importance of infrastructure. While AI can detect blockages in seconds, many hospitals lack the necessary hardware and supporting software. In response, the EU has committed €20 million to accelerate AI deployment in cardiovascular care.

4. The Security Reality Check: CareCloud & Hims, & Hers

This week also underscored the ongoing risks to valuable healthcare data from cyber threats.

• CareCloud confirmed a significant cyberattack this week that resulted in the theft of patient data and an 8-hour disruption of its EHR environment.

• Hims & Hers also disclosed a breach involving stolen support tickets from a third-party service, highlighting that security is only as strong as the least secure vendor’s application programming interface (API), the software connection between systems.

The Bottom Line

There is a clear shift from experimental to operational AI. With Greenway’s new EHR and Creative Solutions’ SNF rollout, the focus is now on efficiency at scale. However, the CareCloud breach highlights that as systems become more integrated and intelligent, cybersecurity risks increase.

Sources:

• Greenway Health: Novare Launch Announcement (April 7, 2026)

• Las Vegas Sun: Creative Solutions & ExaCare AI Rollout (April 8, 2026)

• European Commission JRC: AI in Cardiovascular Care Report (April 7, 2026)

• Acronis: MSP & Healthcare Cybersecurity Digest (April 7, 2026)

Healthcare AI announcements over the last several months reveal a market that is growing quickly. The conversation is no longer centered on hype, novelty, or generic chatbot capabilities. It is shifting toward more practical priorities: connected health data, trusted workflows, and measurable value for both patients and providers. Across the market, vendors are moving beyond broad AI claims and focusing on how their tools fit into healthcare operations, clinical decision-making, and the consumer health experience.

One of the clearest trends has come from vendors building consumer-facing health copilots. Perplexity Health reflects that shift. Rather than positioning AI as a standalone search tool, Perplexity has emphasized the value of combining health-related data sources into a more personalized experience. Its broader ecosystem announcements, including integrations with partners such as b.well and Function, point to an emerging industry-wide strategy. Healthcare AI vendors increasingly understand that strong model performance alone is not enough. The real advantage comes from connecting fragmented records, labs, wearable data, and other health inputs into a unified experience that can support better answers and more relevant guidance.

Microsoft has also pushed this strategy forward with Copilot Health. Its healthcare announcements show how large platform companies are trying to create secure environments where users can interact with health information more seamlessly. Microsoft’s positioning suggests that the future of healthcare AI will not reside in a separate innovation lab or remain confined to pilot projects. Instead, it will live inside broader digital ecosystems that bring together records, lab data, and device-generated information in ways that feel more seamless to both consumers and care teams. That direction matters because it highlights a larger market reality: healthcare AI is becoming an infrastructure conversation, not just a feature discussion.

On the provider side, Oracle has taken a more workflow-driven approach. Through Oracle Health Clinical AI Agent, Oracle has focused on helping clinicians reduce documentation burden and improve efficiency in high-pressure settings such as emergency and inpatient care. That strategy aligns with what many health systems want most from AI today. They are not asking for an abstract promise. They want tools that reduce clicks, speed note creation, support clinician productivity, and create value inside the daily workflow. Oracle’s positioning shows that enterprise healthcare AI is moving away from experimentation and toward embedded operational support.

Epic’s recent AI messaging reinforces the same point. With updates on AI Charting and broader AI results, Epic continues to show that AI is becoming native to the electronic health record rather than an external add-on. That distinction matters for CIOs and digital leaders. When AI capabilities live inside the core platform, adoption becomes easier, governance becomes more manageable, and the organization has a better chance of translating technology investment into real workflow improvement. Epic’s approach reflects a broader industry pattern in which EHR vendors are trying to keep AI close to the point of care.

OpenAI and Anthropic also remain important players in this evolving market. ChatGPT Health and Claude for Healthcareshow that foundation model companies want a direct role in healthcare, not just as model providers behind the scenes, but as branded platforms with healthcare-specific positioning. Their announcements signal that privacy, compliance, and healthcare-specific safeguards are now central to the competitive conversation. In healthcare, general intelligence is not enough. Vendors must also demonstrate that their tools can operate responsibly in sensitive environments where trust, oversight, and data stewardship carry equal weight with performance.

In summary, these announcements highlight three main takeaways driving the healthcare AI market forward: consumer-facing vendors are prioritizing the aggregation and personalization of health data; enterprise vendors are embedding AI directly into clinical and operational workflows; and platform companies are working to own the environments where health interactions occur. The key lesson is that future market leaders will be defined not by bold claims but by their ability to connect data, integrate seamlessly into care, and deliver measurable results for healthcare organizations.