Tech

Healthcare companies struggling to adopt artificial intelligence amid a lack of federal standards are unlikely to get any help from the Trump administration, placing the burden of responsible implementation squarely on the industry’s shoulders.

That mandate is becoming increasingly difficult as the technology grows more complex, experts said during the HIMSS healthcare conference in Las Vegas.

“One thing that’s clear is that this administration is not going to regulate AI. Good or bad, take that for what it is,” Tanay Tandon, the CEO of provider automation company Commure, said during a panel.

President Donald Trump’s hands-off approach to AI governance means hospitals turning to the tools to save money and give overworked clinicians some relief will likely be operating in a regulatory gray area until at least the end of his term.

The president says his goal is to free up U.S. developers to innovate. But that comes with downsides for tech developers and healthcare companies desperate for guardrails given AI’s proclivity to make mistakes, degrade over time and exacerbate existing bias.

Not to mention, a lack of national standards might actually hamper AI development and adoption, according to some experts.

“When there isn’t a federal framework, it can just absolutely cause all kinds of problems,” said Leigh Burchell, the chair of the Electronic Health Records Association. “We all just want to know what our rules are. And then we can comply.”

Biden versus Trump on health AI

To date, a handful of federal agencies, including the HHS’ technology office, the CMS and the Food and Drug Administration, have published targeted rules around the use and quality of AI in healthcare. But neither Congress nor the executive branch have zeroed in on a comprehensive framework to regulate the models — despite some progress during the Biden administration, when an HHS task force was working to build a unified regulatory structure.

That task force unveiled a strategic plan in January 2025 — just 10 days before Trump’s inauguration. However, Trump nixed the blueprint in one of his first executive orders.

Meanwhile, federal employees working on AI oversight, including at the FDA, have been caught up in the Trump administration’s purge of the government’s workforce. Amid the turmoil, the future of the HHS office that oversees AI policy remains unclear.

As a result, what little momentum there was in Washington to create a concrete strategy for overseeing health AI appears to have stalled out, at least for now. In its place, Trump has announced the Stargate Project, a $500 billion investment deal with private companies to prioritize AI development and maintain U.S. supremacy in the space — a high-stakes bet that was immediately complicated by the release of DeepSeek, a high-performing and inexpensive open source model from China.

The Trump administration did issue a request for information in early February to get public input on a potential national AI action plan. However, the plan’s wording makes clear the administration’s priorities: to “sustain and enhance America’s AI dominance, and to ensure that unnecessarily burdensome requirements do not hamper private sector AI innovation.”

The revocation of the Biden-era AI plan was largely symbolic, as agencies hadn’t yet gotten around to imposing any requirements on developers or users.

But in “the current administration — the brakes have come off and the accelerator has come down,” said Brian Spisak, program director of AI and leadership at Harvard University's National Preparedness Leadership Initiative, at HIMSS. “There’s a lot of responsibility to leadership of health systems to find the optimal balance between innovation and speed and safety and tradition.”

A technological sea change

That responsibility — which also rests on AI developers creating the models, software vendors weaving them into health records and the clinicians using them — is not negligible.

Currently, even the most futuristic AI at healthcare institutions is being used to automate administration, and only peripherally touches patient care. But that appears to be changing: There’s growing interest among medical organizations in more clinical use cases for AI, like tailoring treatment plans or helping clinicians arrive at a diagnosis, according to a survey from HIMSS conducted in Fall 2024.

Many of those use cases involve generative AI, which can create original text and images. But such models are known to hallucinate, or provide answers that are factually incorrect or irrelevant. AI can leave important information out, an error known as omission. Models can also drift, a term for when an AI’s performance changes or degrades over time.

Given the increasing prevalence of AI in pulling data from EHR systems, transcribing doctor-patient visits and more, errors like these could interfere with clinicians’ ability to care for patients, experts say.

Meanwhile, the technology is advancing at a stunning rate. In 2024, the healthcare industry was just beginning to come to terms with governance for generative AI. But now, the conversation has already moved onto AI agents, which can complete complex tasks largely unsupervised by humans.

Commure’s Tanay equated the current moment to when America moved from kerosene to electricity at the end of the 19th century.

“The way that we did things six months ago is completely irrelevant,” he said.

Because of the breakneck speed of development, federal standards from any administration would likely need to be flexible, experts say. 

The Biden administration’s HHS task force suggested the government could create guidelines around testing and piloting tools, along with some support for adoption. However, it shied away from a prescriptive approach.

That’s in line with the wish list from many stakeholders. Numerous executives at tech companies and hospital systems said any federal standards should be stratified by the level of risk an AI model imposes — for example, stricter oversight for algorithms that help doctors diagnose diseases, and looser restrictions for algorithms that help hospital staff allocate patients to beds.

“We have to weigh the balance between underregulation, which can potentially increase risk, and overregulation, which will stunt innovation,” said Anthony Chang, the chief intelligence and innovation officer at the Children’s Hospital of Orange County in California, during a panel.

“The current administration is more likely to be on the underregulation side. So we have to be careful as a profession that we don’t allow that to happen,” Chang said.

States, industry groups filling the void

The lack of a playbook from Washington has left hospitals and medical groups scrambling to build their own internal controls amid a patchwork of state laws and voluntary standards released by industry groups.

States including Colorado, Utah and California have already enacted legislation establishing disclaimer requirements for AI systems. More states are considering similar laws: The Electronic Health Records Association is tracking 150 different state bills related to health AI, according to Burchell.

“There is a massive explosion of bills,” Burchell said.

But differing standards could stop health AI developers and software companies from rolling out products in specific states, potentially disadvantaging patients depending on where they live. More risk-averse software companies may avoid AI, or certain states, altogether, she added.

“Legislation of a lot of sizes and shapes at the state level is a risk to us, because it means we have to do all kinds of different development. We would rather develop one system that can be used broadly and accepted across the country,” Burchell said.

Health AI standards groups are also stepping into the gap left by the federal government. The groups — often made up of leading hospitals, digital health companies and tech giants — include the Health AI Partnership, an AI learning network for the industry, and the Coalition for Health AI, which recently launched an AI registry for hospitals.

”I think we’ll probably see more of these non-government organizations like Health AI Partnership and some of those emerge as maybe our north stars today, as here’s some leadership in the space,” said Rachel Wilkes, the corporate lead for generative AI initiatives at EHR vendor Meditech.

But standards from industry consortia hold little weight without the heft of the federal government behind them, experts say. Historically, voluntary standards aren’t particularly effective.

“There’s room for people to act in their own best interest, whatever that may be, without any sort of federal framework,” Wilkes said.

‘We still don’t quite know how to deal with it’

EHR vendors and hospital operators say they’re building up rigorous internal standards for AI tools, including validation and frequent auditing.

“Government oversight has its place, but I do think the way that clinical practice evolves tends to be more driven by what’s happening at a health system,” said Seth Howard, the executive vice president of research and development for Epic, the largest EHR company in the U.S.

In interviews, executives with Epic, Oracle, Meditech and eClinicalWorks said they’re making AI available to doctors with rigorous oversight, including back-end accuracy checks and ongoing monitoring.

However, tech leaders stressed that it’s also the hospital and the clinicians’ responsibility to make sure everything is working as planned.

“We are working in an industry that deals with human life. It cannot be trivial. It cannot be under-exaggerated on what guardrails and checks and balances and what discussions need to happen,” said Girish Navani, the CEO of eClinicalWorks.

Technology behemoths betting heavily on AI feel similarly. Google, for example, has worked with for-profit hospital giant HCA on an evaluation framework to catch any errors generated by its AI models and ensure their reliability, according to Aashima Gupta, the head of healthcare for Google Cloud.

“We provide those tools for an evaluation framework, and for all of this there’s a human in the loop capturing the feedback, and that feedback loop then makes the model more effective,” Gupta said. “That’s what gives me comfort.”

Though some in the private sector say they’ve got governance handled, modern AI is incredibly hard to oversee, according to AI engineers. The main advantage of generative AI — its creativity — also introduces subjectivity, making grading its outputs complicated.

For example, if two clinicians are tasked to summarize a patient’s medical history based on clinical notes, their results could be incredibly different, albeit still accurate. It’s the same with generative AI, experts say: How do you measure quality in a standardized way when there’s that degree of variability?

“AI governance is still very much a maturing process,” said Harvard’s Spisak.

Hospital executives say they’re tackling oversight carefully. But some research suggests governance systems for simpler predictive AI models already aren’t rigorous enough. Hospitals with explicit procedures for the use and assessment of AI tools are still struggling to identify and mitigate problems, according to a study published last year in the New England Journal of Medicine.

Even some of the most well-resourced and tech-savvy systems are struggling.

The Cleveland Clinic has an AI governing body that includes stakeholders from across the academic medical center, according to Rohit Chandra, the Cleveland Clinic’s chief digital officer. The task force oversees AI’s impact on the organization’s patients and workers while ensuring clinical safety and discussing thorny questions of privacy, legality and bias.

But “I don’t think we’ve figured it all out,” Chandra said during a panel. “The term hallucination, for one, has just shown up in the last two, three years. And we still don’t quite know how to deal with it.”

Hospitals should try to make specific people accountable for the performance of the tools, as part of a larger governing body that includes executives, lawyers, doctors and nurses, according to Brenton Hill, the head of operations at standards group CHAI.

Hospitals need to decide how to monitor AI effectively and report that information, which can depend on the products they have in place. They also need to consider what resources the AI will use and develop appropriate data use agreements with AI vendors, Hill said during a panel.

But “there’s not one silver bullet governance structure that you can put out there that will solve all your problems,” Hill said.

‘A pipe dream’

Though a road map from federal regulators would be helpful, stakeholders working to integrate AI tools into healthcare said they’re not holding their breath.

“While self-regulation is good, we don’t believe that’s sufficient. We believe AI is too important not to be regulated,” said Google’s Gupta.

But when asked what she expects from the Trump administration, Gupta was noncommittal. “It’s hard to say at this point. We are trying to figure out how we best work with them, share our best practices with them ... Too early to say. I think the entire healthcare community is waiting for that,” Gupta said.

Other experts said the Trump administration is a wake-up call for hospital executives who believed Washington could assume responsibility for overseeing AI.

Instead, the mandate should be on everyone touching the technology to ensure AI algorithms — given their shifting nature and innate opacity — perform as they’re designed, especially in an industry where any mistakes could impact patient health.

“The easy answer is, if this regulatory body says it’s safe, then I can trust it. I think people were hoping that might happen for AI,” said Aaron Neinstein, the chief medical officer of agentic AI company Notable. “I think that was a pipe dream.”

As hype grows around artificial intelligence in healthcare, a seemingly paradoxical question is setting off faint warning bells in the minds of skeptics and proponents alike: Could AI tools meant to reduce clinician burden actually increase it?

It’s too soon to say, given the technology’s nascency. But the answer — which has big implications for the future adoption of AI in the industry — depends in part on how intensely clinicians have to fact-check models, along with financial incentives in healthcare’s majority fee-for-service payment infrastructure, according to experts.

All told, AI products could add up to weaker time savings than developers promise, and any time saved could quickly be filled up by additional patient visits as hospitals and medical groups hustle to increase earnings.

“That’s absolutely a worry,” said Graham Walker, the co-director for advanced development at Kaiser Permanente’s medical group, during a panel at the HIMSS healthcare conference in Las Vegas. “The easiest way to get more revenue out of your healthcare system is by telling the doctors and [nurse practitioners] and pharmacists to go faster and see maybe just one more patient.”

‘The tools aren’t perfect’

The goal of many AI tools in healthcare is to reduce administrative friction by helping with rote tasks like documenting patient visits, looking up medical information or filing paperwork. Such tasks contribute to clinician burnout, which is a major problem in the industry and can lead physicians to exit the field.

About one-third of doctors responding to an American Medical Association survey in 2023 said they were interested in or planning to leave their jobs in the next few years. Many cited work overload as the reason: According to some research, healthcare workers spend the majority of their week working on administrative tasks.

Enter AI. Algorithms have been in use by healthcare companies for decades, but excitement around the tech has reached a fever pitch in the past few years with advancements like generative AI, which can create original text, and AI agents, which can perform tasks without human oversight.

A number of companies are folding the technology into sleekly-packaged products, touting time-saving metrics that may almost seem too good to be true to clinicians sick of after-hours ‘pajama time’ spent on documentation.

Abridge, a startup that uses ambient listening and generative AI to automate clinical notetaking, and Nabla, another ambient AI assistant, both claim to save providers about two hours each day.

Software giant Oracle has woven AI into its health records platform for providers, including a clinical AI assistant. Physicians using that tool see a 30% decrease in documentation time, according to the company.

Meanwhile, Microsoft says its AI documentation product saves doctors five minutes on average per patient visit.

“The capabilities that AI scribes bring to the practice of care are remarkable,” said Rohit Chandra, the chief digital officer at the Cleveland Clinic, during a panel. (The academic medical system is currently rolling out an AI documentation software from Ambience across its provider network.)

Documentation products tackle an acute pain point for doctors, while being relatively simple to use, easy to implement and safe, because they’re supervised by clinicians, Chandra said.

However, AI performance metrics such as time saved should be taken with a grain of salt, according to experts.

Clinicians still need to review the AI’s output to catch mistakes. That process, known as “human in the loop,” is key to ensure accuracy and build trust in AI, experts say.

Letting AI tools operate unsupervised could result in medical records containing made-up symptoms, or missing information that could be key to a patient’s health.

“That’s where I think we can get into trouble. The technology is going to get to the point where, at least in my opinion, I don’t think we’re going to need to worry as much. But as we think about early adoption, we do have to be cognizant that it is going to make mistakes,” Brenton Hill, head of operations at health AI standards group the Coalition of Health AI, said during a panel.

But deputizing clinicians to police what AI generates can cut significantly into time savings or, in some cases, erase them altogether.

“The tools aren’t perfect,” said Deborah Edberg, a family medicine physician with CVS-owned primary care chain Oak Street Health, during a panel. “We use AI to do our documentation and I do spend quite a bit of time going back and editing ... It can be a bit of a burden to make sure that what is recorded is accurate.”

To date, there have been no extensive, independent reviews of AI scribes in healthcare. But one study published in JAMA Network Open found Microsoft’s ambient scribe received mixed feedback from users.

“A recurring theme was the need for substantial editing and proofreading of the AI-generated notes, which sometimes offset the time saved,” the researchers wrote.

Time savings may not reach clinicians

Fee-for-service incentives could also prove a problem. The payment structure, which underpins the majority of healthcare spending in the U.S., rewards providers based on the volume of visits, tests and procedures they perform.

Meanwhile, despite a recovery in operating margins since the COVID-19 pandemic, costs are continuing to rise for hospital operators.

As a result, hospitals and other physician owners are incentivized to stuff their clinicians’ schedules as tightly as possible, to bring in as much revenue as possible. Any time freed up for doctors by AI might be filled with another visit, experts say.

“It could happen. And some organizations want to do that. And from our perspective, that’s an organizational decision,” Rachel Wilkes, the corporate lead for generative AI initiatives at EHR vendor Meditech, said. “If they want to schedule more patients with time savings, they can do that.”

Things that improve the productivity of the healthcare system — like reducing patient no-shows — often result in a heavier visit load for physicians, said Seth Howard, executive vice president of research and development at Epic.

“The conversation between the health system and the doctors need to be, ‘What do we do with those time savings?’ Does it go back into helping the doctor have some flexibility during the day? ... Or for doctors to see more patients?” Howard said.

Vendors are aware that the draw of AI products for hospitals includes the potential to increase revenue. 

Along with saving five minutes per encounter, Microsoft’s ambient AI frees up “13 additional appointment slots per provider, per month,” according to marketing materials.

The need to bolster flagging finances is one reason hospitals are ravenous for the tools, experts say. Demand has been skyrocketing, with the CEO of one company using AI to automate provider workflows likening it to “a fairy tale.”

“Our ambient product went from zero appointments a year two years ago, to a couple hundred thousand last year, to on track for 10 million this year,” said Tanay Tandon, the CEO of Commure, during a panel. “That sort of expansion and usage of AI in healthcare is incredibly exciting. That’s no longer your nerdy technical doctors playing around with it in the corner. This is meaningful use.”

Experts say like with any other technology, there are pros and cons when it comes to AI scribes, assistants and similar tools. In addition, other metrics besides time saved are important to physicians, like reducing their mental load by simplifying tasks or improving their job satisfaction by allowing them to focus on clinical care.

And anecdotal feedback from clinicians has been great, according to tech giants, AI scribes and the EHR vendors weaving the tech into their workflows.

Epic, for example, doesn’t have an average figure for how much time its own ambient documentation tool saves. But according to Howard, “physicians say, very commonly, I could never go back to how I did documentation before.”

Ransomware attacks against the healthcare sector have spiked in recent years as cybercriminals launch sophisticated assaults against hospitals — posing a serious threat to operations and patient safety.

Ransomware, a type of malware that denies users access to their data until a ransom is paid, can have dire consequences for health systems, disrupting care delivery, shutting down electronic health records, canceling scheduled appointments or procedures and forcing ambulances to travel to other facilities. Some research has shown ransomware attacks — and other cyberattacks — could increase patient mortality rates. 

Those high stakes make the sector a more attractive target for cybercriminals, said Phyllis Lee, vice president of security best practices content development at the Center for Internet Security.

Though the FBI advises against following ransom demands, providers could be motivated to pay up when patient care is disrupted.

“What you have is a victim that’s willing to do whatever they need to do to help their customers, which are patients,” Lee said. “So I think that’s why they’re an easy victim, in some sense.” 

The sector has already seen major ransomware attacks in 2024. An attack on UnitedHealth’s claims processing unit Change Healthcare disrupted normal operations across the industry for weeks, while large nonprofit health system Ascension needed more than a month to fully restore its EHR.

Over the past five years, the HHS tracked a 264% increase in large data breaches reported to the Office for Civil Rights involving ransomware.

A shortage of cybersecurity professionals, an increasingly connected healthcare environment and business models that facilitate more ransomware attacks have made the sector more vulnerable, experts told Healthcare Dive.

But hospitals that implement key cyber protections, know their technology environments and plan ahead for attacks could be in a better position to thwart cybercriminals. 

More connected devices, not enough resources

Hospitals operate in an increasingly internet-connected environment, creating more opportunities for attacks, experts say.

Facilities have ramped up adoption of connected technology over the past several years, and not just with typical IT or medical devices, according to John Riggi, national advisor for cybersecurity and risk at the American Hospital Association. Other key operations, like heating and cooling systems or elevators, could also be connected to the internet.

Connected tech creates plenty of business and clinical efficiencies, but hospitals need to update and patch all these devices to prevent hackers from exploiting these vulnerabilities, he added.

Updating devices, however, isn’t always easy for hospitals, which could require taking them offline. While vendors can update consumer products in days or weeks, it might take up to a year to deploy a patch at scale in the healthcare sector, according to the HHS’ Advanced Research Projects Agency for Health. 

“You can’t just unplug it and plug it into the new socket,” said T.J. Ramsey, senior director of threat assessment operations at cybersecurity firm Fortified Health Security. “It’s a major coordination. It becomes a major project.”

Coordinating cybersecurity measures takes resources — funds, technology downtime and staff — which may be scarce in hospitals. Many facilities, especially small ones, operate on slim margins, pushing them to choose between cybersecurity and other investments, including purchases that might more directly impact patient care, Ramsey said.

Cybersecurity personnel may also be hard for hospitals to find, said Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, or Health-ISAC. Cybersecurity professionals are in short supply across the globe, and health systems are competing with other sectors for talent, including ones that might be able to pay workers more.

“We're not training enough people, we’re not graduating enough people through college courses in cybersecurity,” Weiss said. “And the number of jobs that we need them in is ever increasing.”

Ransomware-as-a-service and state actors

Cybercriminals could benefit from permissive nation states and business models that allow them to launch attacks without significant technical skills.

Ransomware-as-a-service is a business model where developers build ransomware tools and lease them to other cybercriminals.

The model allows more people to conduct attacks at a relatively low cost, even if they don’t have the knowledge to build out their own ransomware kits, Lee said. Some might even include tech support, forums and user reviews, according to cybersecurity firm CrowdStrike.

“You don’t need to be a cybersecurity expert in order to execute a ransomware attack anymore,” she said. “It’s lowered the barrier to entry of being a cybercriminal.”

Some ransomware groups are thriving with the support of nation states, with many groups operating from Russia or its allied nations, Riggi said. 

Global politics can be a motivator for attacks, and some might be supported by the Russian government. But even if they aren’t, Russia won’t cooperate with U.S. law enforcement to shut ransomware groups down, he said. Cybercrime groups in North Korea and China also target the healthcare and public health sector, according to the federal government.

“They create a permissive operating environment for them,” Riggi said. “They provide safe harbor for these groups, as long as they attack the West and as long as they don’t attack Russia, then they’re provided safe harbor.”

How hospitals can protect themselves

Cyber protections such as multi-factor authentication and anti-phishing training for employees are critical to protecting hospitals, according to Lee. Multi-factor authentication uses a second method to verify a user’s identity, and anti-phishing protections help to guard against tactics where a cybercriminal poses as a trusted individual to gain access to sensitive information.

Health systems also need to know their technology environments, she added. What technology assets do they have, and who has access to them? What software is running on those devices? Is that software patched and up-to-date?

That can be one of the largest challenges for organizations, particularly when workers take home laptops or tablets or they have a network of temporary employees like travel nurses, she said. 

External employees, like those who log in remotely or access their email outside the hospital, should come first when starting a new cybersecurity project, like implementing multi-factor authentication, Ramsey said. Nurses and doctors swiping their badges inside health system’s facilities can be a secondary priority. 

But if attackers are able to break through a hospital’s defenses, having comprehensive backups — and a strategy for using them  — is key to a speedy recovery. Health systems should plan ahead and consider how fast they can recover data and to which point in time, as well as how much information they’d be willing to lose. 

Hospitals should also determine which workstations are critical, as some databases might need more frequent backups if they house key systems like patient records, he said.

“The best way to be prepared for it is to actively talk about it,” Ramsey said. “If you are truly concerned around how you will be impacted by ransomware, then you should be actively talking about it, you should be encouraging your team to do tabletop exercises, you should be willing to have uncomfortable conversations.”

The Peterson Health Technology Institute launched a task force in January 2025 aimed at studying the business impact of artificial intelligence on health systems. 

Implementing AI tools can be a challenge, as providers need to be wary of safety, accuracy and equity concerns that could come with the emerging technology. But rolling out safe products isn’t the only question for health systems implementing AI: They also need to figure out how to measure success. 

The institute, which has previously worked to evaluate other digital health tools, is pulling together health system leaders to discuss how they measure financial, efficiency and workforce effects of AI products.

Caroline Pearson, executive director of PHTI, joined Healthcare Dive to discuss the task force, including the group’s first focus areas.

HEALTHCARE DIVE: Can you tell me a little bit more about what the task force is and how it will work?

CAROLINE PEARSON: So we formed a task force because we really wanted to understand how some specific AI solutions were being adopted in health systems, and how they were thinking about measuring the impact of those solutions.

We started with a pretty narrow focus on AI tools for documentation — AI scribes — and revenue cycle management, which are two of the fastest areas of AI adoption that are currently happening in health systems in this country. We wanted to talk with executives of those health systems to really understand how they’re thinking about implementing those AI solutions and what the business impacts of that implementation are, from both a financial perspective, efficiency perspective and a workforce perspective.

Why do you think this task force is needed for health systems?

Health system leadership are working to both adopt technology quickly and struggling to figure out how to measure that and think about its business implications as they go. The leadership has been really excited to share best practices with one another and learn how other systems are doing this, and also to think about what kinds of data and metrics they want to be measuring for the future.

So each of the systems has made their own business case about how they’re thinking about these initial purchases on the documentation side. But over the next several years, how will they continue to be able to measure the impact of those solutions on their delivery systems? And what kinds of data are they going to need out of the AI tools in order to do so effectively?

You mentioned you wanted to focus on documentation and revenue cycle products. Is that because they’re popular, or are there any other reasons why you decided to hone in on those two areas?

I think that documentation is going to be the fastest adoption of health technology that we ever see. It feels like they’ve gone from zero to very widely adopted in less than two years. And so part of it was really driven by that growth. 

But both rev cycle management and documentation are places that are really at the business heart of how a health system operates, right? It really affects productivity, patient throughput, as well as patient experience and provider experience. So they were very good places to start, because they're just brass tacks issues around how health systems operate. 

So it’s a way of analyzing, “Sure, you’ve adopted this documentation assistant. But is this actually saving you time? Is that allowing you to see more patients? Is it reducing provider turnover?”

Yeah, exactly. Some systems are looking to increase the number of patients that they can see in a given clinic. Others are really focused on provider burnout and trying to reduce the “pajama time” that they’re requiring of doctors to do documentation, and then ultimately reducing turnover.

And yet, other systems are really thinking about that patient experience and how to make sure that every clinical interaction is giving the doctors enough time to spend face-to-face with their patients. All of those are valuable outcomes, but systems want to be clear-eyed about what their expectations are for each of those and how they will know whether they’re accomplishing their goals.

Health systems will likely still focus on containing costs in 2025. Do you think that might also push them to consider eventually dropping some of these AI tools if they’re not worth it in the long term?

I don't know. My sense is that these tools, the documentation tools, are quite sticky, and once providers get used to using them — and patients feel comfortable with them — they will be hard to remove from the exam room. 

However, we’re also seeing those tools become commoditized more rapidly. So the price may come down as that market is quite competitive. And then the question is, what other solutions are those companies selling into the health system? And how do we begin to measure the value of those investments? 

So, eventually those companies might start adding to their offerings, and health systems might be more interested in saying, “I’ll pick up this AI documentation company that might also offer me something else.”

Yes, and we’re seeing that happen very quickly, a sort of spreading of these AI solutions within systems. And rev cycle is the sort of first and most obvious place that AI solutions grow out of documentation. 

Once you’ve captured the entire patient encounter, you have all of the data to convert that into billing. And so it may be that the price of the AI scribe becomes pretty efficient, but the price attached to all the revenue that you generate off of that encounter is much more valuable. Thinking about how you measure those other lines of business is important.

The Office of the National Coordinator for Health Information Technology was born two decades ago, tasked with creating an interoperable health IT infrastructure and shifting the country away from paper medical records.

Much has changed since then. The vast majority of hospitals and physicians now use electronic health records. Nationwide health data exchange under the Trusted Exchange Framework and Common Agreement, or TEFCA, went live in December 2023, after years of work. 

And now, artificial intelligence-enabled tools — including products that aim to cut down on providers’ administrative tasks — signal more change ahead for the industry. In late 2023, the ONC finalized a sweeping rule that included transparency requirements for certified clinical decision support and predictive tools.

Micky Tripathi, head of the ONC, sat down with Healthcare Dive to discuss the past 20 years and how the agency’s work aims to create the foundation for the next generation of healthcare technology.

HEALTHCARE DIVE: When you look back at 20 years of ONC, what do you see as some of the agency’s biggest accomplishments?

MICKY TRIPATHI: The transformation that the healthcare delivery system, particularly hospitals and physician offices, have gone through in being largely paper-based to what I would argue is starting to closely approximate digital native. It’s pretty hard for any of us to find a paper record on ourselves. I don’t think there are many being recorded.

I think we’ve played a significant role, obviously working in partnership with our colleagues at the CMS, who did a lot to create the incentive structure for providers to adopt electronic health records. And then we certified those systems to be able to create sort of a digital floor or digital foundation on which we can now start to build the 21st century digital healthcare system that all of us are eagerly anticipating. 

What are some of your next big goals and priorities for ONC?

We want to continue to fill in the gaps. We’re certainly not pretending that the entire system is digital. There are large parts that didn’t get the benefit of those incentive programs and associated ONC support, like long-term, post-acute care, behavioral health. We didn’t even include human services and social services, which are a very important part of people’s overall health status, even though they’re not what we think of as healthcare in the U.S. 

But increasingly, it is building on that digital foundation that we’ve all worked so hard to put in place. What are the higher ambitions that we all have for these kinds of technologies? There is an adage out there, which is that we in technology tend to overestimate the benefits that we’re going to get in five years. And we totally underestimate the benefits in 10 years. 

And I think that’s true for electronic health records. There was a lot of anticipation that, once these are in place, they’re going to solve all of healthcare. And of course, we saw that it’s very difficult to adopt these systems, and a lot of contribution to what people call clinician burden.

But now as we look ahead to 10 years, we would not be able to have the anticipated benefits that we’re going to get from AI if we didn’t have these electronic health records in place. We would be so far behind at that point. We’d all be struggling to say, “Wow, AI is really cool. Too bad we can’t use it in the U.S.” Or, “Too bad only the Mayo Clinics and the Mass Generals of the world can use it, but not the federally qualified health centers, not the inner city hospitals.”

EHRs are widely used, but providers still have plenty of complaints about usability, the time it takes to document care and the number of alerts they’re managing. These aren’t new challenges, but what do you think ONC’s role will be to ameliorate these issues moving forward?

There’s a bunch of stuff that people blame on the EHR, but are really about piling onto the EHR. This isn’t to say that the providers’ concerns aren’t real. But there’s a lot of stuff that got added onto the EHR, like extra documentation practices and prior authorization and quality measurements. If you add all of those things onto it, then yeah, it’s going to become a very complicated, unwieldy process for some organizations. 

So a part of what we required in the 21st Century Cures Act regulation that we put into place on April 5, 2021, requires that all electronic health information be made available in a machine-readable format. And part of that was the hope that technologies are going to come on the scene that are going to be able to process that data and make it usable for people. And then of course, ChatGPT erupts onto the scene.

Now I’m not suggesting you should do this on public ChatGPT, because there are lots of privacy issues. But you do have the technological ability now to literally take those records, run them through ChatGPT or Llama or whichever one is your choice and it will actually give you a synthesis and a summary of what’s in those records, which is pretty phenomenal. 

Now, we still have work to do to assure you as a patient that that’s safe to do. It’s not going to make the serious mistakes that could actually cause you harm. And, as I was describing, we have work to do on the privacy side. You need to be assured that when you use a tool like that, you know what you’re getting into. It either does or doesn’t have privacy protections, but you need to be aware of whether it does or doesn’t, so that you can make a choice of whether you're willing to take that risk.

This is a good segue into AI. There are plenty of concerns that it’s coming too fast, and we’re not really sure how safe it is or how well it works. As the co-chair of the government’s health AI task force, do you think those concerns are warranted?

It is definitely warranted. We, as a department, are concerned. We, as the U.S. government, are concerned. But we also don’t want to lose sight of the opportunity. We’re big AI optimists. And we do believe, on net, that there’s huge opportunities for patients and for the industry at large. 

We need to be able to create the avenues to spur innovation in this area, and take best advantage of these great technologies that are coming into place. But we also want to make sure that patients feel protected. The basic mantra is that we want to make sure that these technologies are used for patients, and not on patients. 

I think that for the most part, they will see that provider organizations are being judicious in this because they have safety and quality at heart too. 

In almost all cases that I’m aware of, AI-enabled tools are being used, but to help to augment physician decision making, not to replace physician decision-making, which I think is what all of us want. We expect that our doctors are going to use the best possible tools available to them to give us the best possible care. And we want to make sure that these tools fall into that category, or the best possible tools that they trust. 

But we also recognize that it’s moving really fast and people are going to adopt it really fast. Without any rules of the road, you will get inadvertent and maybe even malicious outcomes that all of us want to prevent.

The healthcare sector needs to get serious about cybersecurity and resilience planning in the wake of the cyberattack against Change Healthcare, as attacks are likely to continue plaguing the industry, experts told Healthcare Dive. 

More than a month after the attack, the outage at the UnitedHealth Group subsidiary was still hamstringing the industry. Providers reported an array of challenges after the attack, from payment disruptions to delayed prior authorization requests. 

“Hospitals definitely are reporting to us that their teams are working weekends, they’re working nights,” said Molly Smith, group vice president for public policy at industry trade group the American Hospital Association, a month after the attack. 

The financial impact could be serious, especially for smaller providers or those who relied heavily on Change to process claims. Some hospitals delayed payments to vendors, tapped lines of credit or prioritized payroll, Smith said. 

But, even as Change restores its systems, cyberattacks are going to remain a challenge for the industry as healthcare digitizes, creating more potential vulnerabilities for cybercriminals to exploit, experts say. 

The healthcare sector needs to learn from the wide-ranging impacts from the Change attack — and prepare for the next one.

“As an industry, there’s been a lot of advancement in cybersecurity, but we’re still pretty far behind where we need to be,” said Steve Cagle, CEO of healthcare cybersecurity firm Clearwater. “We need to face the reality that this is an issue that is here to stay for a long time.”

Risk analysis, redundancy protects providers

Health systems need to evaluate where they are most at risk and how an outage could affect their finances and operations, experts told Healthcare Dive.

Many providers haven’t adequately mapped their integral business or patient care operations to the IT products that support them, which makes it challenging to protect those systems or detect intrusions, said Deron Grzetich, leader of consultancy of West Monroe’s cybersecurity practice.

“If you don't understand what is critical to patient care, and you don't understand the IT and applications and systems that support that, how can you ensure that you're properly protecting those via the right preventative controls?” he said.

Health systems need to do a risk analysis, identifying where they hold their data, potential threats and vulnerabilities in their systems, controls they have in place, the likelihood of an attack and how it could affect the organization, Cagle said. That would help them prioritize where to spend their resources. 

They should assess third parties too and question vendors on their cybersecurity protocols to determine what they should do to mitigate a high risk. For example, if an organization can’t push a vendor to implement improved security, the system could consider switching vendors or putting a backup in place, he said.

Having other vendor options for key operations is generally a smart strategy, experts say. Small providers with weaker finances were more likely to struggle during the Change outage, according to a March report by Moody’s Ratings. Many bigger and geographically dispersed organizations used more than one claims clearinghouse, mitigating some of the revenue hit.

The financial effect from an outage at a vendor like Change, which processes billions of healthcare transactions annually and touches 1 in 3 medical records, also demonstrates the importance of business planning, experts say. Nearly 60% of hospitals reported the revenue impact from the Change attack is $1 million per day or greater, according to a March survey conducted by the AHA.

Health systems should evaluate software and service vendors to know which are key to their cash flows and the impact if one of those products was brought down by a cyberattack, said Kate Festle, a partner in West Monroe’s healthcare M&A group.

Small or medium-sized systems might only have 30 to 60 days of cash on hand, which might not be enough in a longer outage. 

“I would hope a lesson learned coming out of this is that every provider, regardless of their size, does a full diagnostic to say, ‘If at any point one of my service or software vendors went away, or was compromised, what would that mean in terms of the cash I would need on hand?’” Festle said.

Why providers struggle to invest in cybersecurity

Cybersecurity is key to operations in an era of increased attacks against the healthcare sector, but many providers haven’t devoted enough resources to preventing incidents or preparing for the fallout, experts say.

Investing in cybersecurity is often a tale of have and have-nots in healthcare, said Greg Garcia, executive director for cybersecurity at the Health Sector Coordinating Council, an industry group that advises the federal government.

Large health systems are likely more advanced in implementing cybersecurity protocols, while small or safety-net providers may struggle to find the funds or talent to advance their preparedness.

“There are a substantial number of hospitals that routinely operate with negative margins. So their ability to tap into resources is much harder,” the AHA’s Smith said. “And then frankly, even getting the technology staff or the cybersecurity staff, that can be very, very challenging, particularly for independent, smaller facilities.”

Creating redundancy among vendors could be difficult for some providers too. Many health systems already want to reduce the number of third parties they contract with to cut costs and administrative work.

Building relationships with new vendors takes effort, with more contracts that need to be managed and additional invoices that need to be consistently paid, said Andrew Hajde, director of content and consulting at the Medical Group Management Association. 

It could also be difficult to find vendors interested in taking a back-up job, he added. 

“A lot of vendors don’t want to just be waiting in the wings to get paid if they’re needed,” Hajde said.

There may not even be sufficient vendors available to create redundancies, or their contracts don’t allow providers to work with another company that offers competing products, Smith said.

Plus, many tools — or large parts of them — are custom built, so it’s a challenge to shift to a new system or train workers on another product, she added.

Feds push for cybersecurity investment

Federal regulators have signaled plans to boost cybersecurity and resilience in the healthcare sector, eventually with financial penalties for hospitals. The HHS released voluntary cybersecurity goals in January 2024, broken down into essential and enhanced protections that include assessing third-party risks, as well as incident planning and preparedness. 

The Biden administration’s proposed budget for 2025 includes funding for hospitals to put cyber protections in place, with penalties rolling out in coming years. Legislation was also recently introduced in the Senate that would allow for advance and accelerated payments to providers in case of an incident, as long as the providers and their vendors meet minimum cybersecurity standards. 

The HHS has been building up its cybersecurity strategy for several years, HSCC’s Garcia said. The performance goals aren’t mysterious or new — they’re table stakes.

“The longer term project now could take a couple of years to get it right,” he said. “Tear up the floorboards and look at the plumbing underneath and see where the leaks are. That’s what’s important for us now.”

Most hospitals are using predictive artificial intelligence tools, but less than half are evaluating them for bias, according to a study published in January 2025 in Health Affairs.  

Sixty-five percent of U.S. hospitals reported utilizing predictive models, including products for identifying high-risk patients or helping with appointment scheduling. But only 61% tested models for accuracy using their own health systems’ data, and just 44% said they locally evaluated the models for bias. 

Hospitals with high operating margins, those that developed their own models and facilities that were part of health systems were more likely to report local accuracy and bias evaluation — suggesting a “growing digital divide” between high- and low-resource hospitals could threaten patient safety, lead study author Paige Nong said in a statement. 

AI has become an increasingly hot technology for the healthcare sector, boosting venture capital investment and spurring interest in tools that could stretch the overburdened provider workforce.

But accuracy and bias remain significant concerns. Models could replicate racial, ethnic or gender biases that could worsen already existing health disparities. 

Similarly, tools that work well with one patient population might provide inaccurate information when deployed in other situations, highlighting the importance of testing models on providers’ own data. Health systems also need to keep monitoring their AI products after implementation, as environmental changes could worsen their performance over time. 

However, many hospitals aren’t adequately evaluating their AI models for bias and accuracy — which could pose a risk to patient care, according to the research, which analyzed survey responses from more than 2,400 hospitals. 

Access to financial resources could play a role in boosting hospitals’ ability to conduct local evaluations of their AI tools. Meanwhile, critical access hospitals, other rural hospitals and facilities that served areas with high levels of social disadvantage were less likely to use predictive models entirely. 

Plus, hospitals that had the technical expertise to develop their own predictive models were more likely to test the products with their own data. Nearly 80% of hospitals in the study reported using models that came from their electronic health record vendor, while 59% said they utilized products built by third parties and 54% said they used self-developed tools. 

“Many better-funded hospitals can design models tailored to their own patients, then conduct in-house evaluations of them. In contrast, hospitals with fewer resources are buying these products ‘off the shelf,’ which may not reflect the needs of local patients,” Nong, an assistant professor at the University of Minnesota School of Public Health, said in a statement. 

Hospitals’ likelihood to conduct local evaluations of their models was also affected by the AI’s intended use. Facilities that utilized models to predict health trajectories or risk for inpatients were most likely to say they locally tested their AI, compared with hospitals that used the tools to follow up with outpatients or to automate billing.

Hospitals might see those tools as lower risk, even though outpatient models could also be used to perpetuate bias and patients have raised concerns about AI for billing, the study’s authors wrote.