Healthcare organizations are moving quickly to adopt artificial intelligence, but their ability to govern these technologies safely needs to keep pace. The challenge is not simply deciding which AI tools to approve. It is understanding where AI is being used, how it can affect clinical and business operations, and what happens when it makes a mistake or becomes unavailable.

For Bill Reid and Ed Gaudet, co-leads of the Health Sector Coordinating Council's (HSCC) AI Governance Task Group, the starting point is straightforward: AI governance in healthcare must be grounded in patient safety.

“The way that we think about the mission of the Health Sector Coordinating Council Cyber Working Group ... is that really the reason why we do cybersecurity work is fundamentally about patient safety,” said Reid, who is Global Lead for Healthcare and Life Sciences, Office of the Chief Information Security Officer (OCISO), at Google Cloud. “It's about the availability, confidentiality, and the integrity of the data that is used to provide care to patients.”

Speaking at the 2026 WEDI National Conference, Reid and Gaudet, CEO and founder of Censinet, discussed the HSCC's AI governance guidance and the practical considerations health systems should address as they incorporate AI into clinical, administrative and operational workflows.

Their message was that organizations need a governance approach that accounts for the entire AI lifecycle, from identifying applications and assessing their risks to managing model updates, controlling autonomous actions and preparing for disruptions.

Healthcare AI Carries Different Stakes

AI governance is challenging in any industry, but healthcare presents particular risks because technology failures can affect patient care directly. Reid contrasted healthcare with industries in which a cybersecurity incident might result in a financial loss that can be recovered. In healthcare, the consequences can be much more serious.

“In our domain it is quite different,” he said, noting that the potential impact of AI-related incidents can be substantial when patient care is involved.

The technology itself adds another layer of complexity. Unlike traditional software, AI systems can produce variable outputs, and their capabilities and underlying models are evolving rapidly. That makes transparency, oversight and the ability to establish trust especially important.

“Without a reasonable amount of transparency, things that are opaque and non-deterministic or less understood are hard to trust,” Reid said. Healthcare organizations must also contend with overlapping regulatory requirements, including HIPAA, state privacy laws, international rules and regulations that may apply to particular products or processes.

Meanwhile, AI development continues to move quickly, putting pressure on organizations trying to determine how to evaluate new technologies and manage their risks. The HSCC guidance is intended to help health systems establish a practical direction even as the technology and regulatory landscape continue to evolve.

The HSCC Cyber Working Group brings together more than 500 organizations across the healthcare industry to develop consensus-based cybersecurity guidance through public-private collaboration. Reid described the process as a collective effort in which participants contribute expertise, debate recommendations and work toward guidance that can serve the broader industry.

Importantly, the AI governance recommendations are intended to scale across organizations with different resources. A large health system with dedicated AI and cybersecurity teams will have different capabilities from a smaller hospital without a chief AI officer or even a chief information security officer. The goal is to provide a framework that organizations can adapt to their circumstances rather than prescribe a single approach that only the largest institutions can implement.

Start by Finding the AI You Already Have

One of the most fundamental challenges in AI governance is knowing what needs to be governed. Organizations may be evaluating new AI products through formal procurement processes while overlooking tools employees are using independently or AI capabilities that vendors have incorporated into existing applications.

Reid described this as “shadow AI,” extending the familiar problem of shadow IT into a new environment in which AI services are increasingly easy to access. That can include employees using external chat services, individuals building their own agents, or AI functionality embedded in third-party products without sufficient organizational awareness. The result is that a health system's actual AI footprint may be considerably larger than its approved list of AI projects suggests.

Gaudet offered a memorable description of how these capabilities can enter an organization: “AI comes in through the ... bathroom window, the floorboards, the attic,” he said.

His point was that AI does not arrive only through the front door when an organization purchases a new product. Vendors may introduce AI features through routine software updates, potentially changing how an existing application processes information or performs tasks. Organizations that review only new AI purchases could therefore miss changes occurring within their current technology environment.

Gaudet encouraged health systems to consider both internally developed applications and third-party products that now incorporate AI. That includes understanding dependencies on foundation models, hosting infrastructure, integrations and other components of the AI supply chain.

For healthcare leaders, the first practical step is to build an inventory or registry of AI applications and their associated models. That inventory should account for where AI is used, what functions it performs, what information it can access and which systems or vendors it depends on. The exercise also provides a foundation for determining which applications require more rigorous oversight based on their intended use and potential impact.

Governance Must Extend Beyond IT and Cybersecurity

Identifying AI applications is only part of the challenge. Health systems also need to establish who is responsible for evaluating them, making decisions about their use and monitoring their performance over time.

Gaudet emphasized that AI governance cannot remain confined to traditional IT or cybersecurity functions.

“When you're building out your AI governance program, you have to take into consideration not only the cybersecurity controls or privacy controls, but also those aspects of clinical safety and ethics, and data governance and data provenance,” he said.

Those responsibilities have often been distributed across different departments. AI brings them together, requiring organizations to coordinate decisions that affect clinical practice, information security, privacy, compliance and operational performance. Gaudet said the structure of the governance program matters, including its charter, committee membership and clarity about who is responsible and accountable for decisions.

Clinical representation is particularly important. Technology and security teams may understand the architecture and technical risks of an AI application, but clinicians can help evaluate how the tool will affect workflows, decision-making and patient care. The governance process also needs to address AI throughout its lifecycle, rather than ending once a product has been approved and deployed.

Model updates are one example. As models evolve, vendors may introduce changes intended to improve accuracy, reduce hallucinations or address changes in the environments in which models operate. Those improvements may be beneficial, but organizations still need to understand which model versions are in use and whether an update should be adopted.

Reid said healthcare organizations need stability and traceability, particularly in regulated environments. A model registry, version history and documented process for evaluating updates can help organizations establish what technology was in use at a particular point in time and understand the implications of a change. That level of visibility becomes even more important when AI supports clinical decisions or other functions where inconsistent performance could have serious consequences.

Agentic AI Introduces New Questions About Control

As AI evolves from tools that respond to user prompts toward systems capable of taking actions, governance requirements become more complex.

Reid described a progression from assisted AI, in which a user directly interacts with a chat interface, to agentic systems that can coordinate multiple interactions, use tools and carry out tasks with greater autonomy. That shift changes the nature of the authority being delegated to technology.

Traditional access controls are designed to limit what a user or system can access based on its identity and role. Agentic AI introduces another consideration: limiting what an agent is permitted to do. Reid called this “least agency.”

The concept builds on the familiar security principle of least privilege. Rather than simply determining whether an agent can access a particular resource, organizations also need to define the specific actions it can take and the boundaries within which it can operate. That may involve restricting an agent's ability to initiate transactions, access sensitive information, interact with other systems or make changes without human authorization.

The challenge grows as organizations deploy multiple agents that communicate with one another and call on various tools and services. Those interactions also raise questions about non-human identities: how agents are identified, what permissions they receive, how those permissions are managed and when they should be revoked. Reid said the guidance also addresses the need to control self-modification, so that an AI system cannot make changes to itself without appropriate authorization.

For health systems experimenting with agentic AI, the lesson is that granting a system access to information or an application does not automatically mean it should be allowed to act independently. Governance needs to account for both the capabilities of the technology and the authority it receives.

Prompt Injection and Automation Bias Require Different Safeguards

AI-related risks are not limited to unauthorized access or the exposure of sensitive information. The way AI systems process information and the degree to which people trust their outputs also matter.

Reid discussed prompt injection, a technique in which malicious instructions are introduced into information an AI system processes. While the risk may initially bring to mind a user entering a harmful prompt into a chat interface, the attack surface can extend much further.

Consider a health system using AI to process incoming faxes and route information to the appropriate destination. If a malicious document contains instructions designed to manipulate the system, the AI could be influenced by information that should never have been treated as an authorized command.

Similar concerns arise when AI systems retrieve information from document repositories or interact with external tools. Organizations need to consider how inputs are screened, how information sources are controlled and how AI outputs are evaluated before they trigger further actions.

Reid also highlighted the risk of protected health information leaking through AI applications. Safeguards may need to include appropriate contractual protections, technical data-loss prevention measures and checks on model outputs to ensure that sensitive information is not disclosed to unauthorized users.

Data poisoning presents another concern when inaccurate or uncontrolled material is introduced into training datasets or other processes used to shape a model's behavior. These technical risks intersect with a human factor that may be harder to address: automation bias, or the tendency to place too much confidence in a system's output.

Reid illustrated the problem using ambient clinical documentation, in which AI captures a patient encounter and generates documentation for the medical record. Human review is an important safeguard, but it does not automatically eliminate the risk of error.

He described a scenario in which ambient technology inaccurately captures an encounter and a clinician catches the error. But he also raised the possibility that a system could accurately capture the encounter, only for an overwhelmed clinician to make an incorrect correction. The point is not that human oversight is unnecessary. It is that oversight must be designed to work in practice.

Healthcare organizations need to consider whether clinicians have sufficient time, information and training to review AI-generated content meaningfully, rather than simply accepting or approving it as another step in an already demanding workflow.

Third-Party Risk and Resilience Go Hand in Hand

The AI supply chain creates another set of governance challenges, particularly when multiple applications depend on the same underlying model, hosting provider or infrastructure. Gaudet said organizations need to understand not only the AI capabilities in individual products but also the dependencies connecting those products.

A concentration of dependencies on a single foundation model or hosting environment could leave multiple systems vulnerable to the same availability problem. Organizations that do not understand those connections may discover the extent of their exposure only when an incident occurs.

The HSCC's AI governance guidance is intended to complement its separate third-party and supply-chain risk management guidance, giving organizations resources to consider both the technology itself and the ecosystem in which it operates. Gaudet also urged organizations to account for the financial implications of AI adoption, including token utilization costs.

“As you're building out your governance programs, consider adding in a governance of where you're spending, how much you're spending, how you're spending it,” he said.

As AI becomes more deeply embedded in workflows, leaders will need to evaluate whether the costs associated with using these systems are delivering sufficient value, including in applications developed internally as well as those supplied by vendors.

Resilience is equally important. AI-enabled systems may become integral to clinical workflows, but organizations still need to know how care will continue if those systems become unavailable or must be disabled.

Reid pointed to lessons from ransomware incidents, in which healthcare organizations have had to fall back on paper documentation, alternative order-entry processes and other procedures that may have become less familiar as digital systems have taken over.

As organizations automate more work, they cannot assume that the underlying clinical processes will remain functional without the technology supporting them. Health systems should define the availability requirements of AI-enabled services, understand their dependencies and establish recovery expectations. They also need to determine what clinical fallback procedures will be used when a system is unavailable and practice those procedures before an incident occurs. Incident response planning should include deliberate decisions about when to disable a system, who has the authority to do so and what evidence is required before it can be restored.

Gaudet cautioned that a kill switch can be powerful but also dangerous if used without adequate planning. “It's great to have that power, but it's such a big hammer,” he said. “We'd wield it ... appropriately.”

Disconnecting a system may be relatively straightforward. Restoring it and reestablishing confidence in its reliability can take much longer. Reid noted that organizations may have differing expectations for when a system is safe to bring back online. Some may require independent forensic evidence or third-party validation, while others may accept a vendor's assurances. Governance should establish those expectations in advance, rather than leaving teams to negotiate the requirements in the middle of a crisis.

A Practical Roadmap for Healthcare Leaders

For organizations unsure where to begin, Reid outlined a progression that can be adapted to different levels of organizational resources and AI maturity.

First, identify the AI already in use. Build an inventory that includes shadow AI, internally developed applications and capabilities embedded in third-party products. Categorize those applications, assess their exposure and establish a registry that can be maintained as the technology changes.

Second, establish a governance framework. Define the committee's responsibilities, decision-making processes and accountability structure. Include clinical representation alongside expertise in cybersecurity, privacy, data governance and other relevant disciplines.

Third, evaluate and test the controls. Determine which safeguards are appropriate for the organization's AI use cases, verify that those safeguards are in place and assess whether they work as intended. Test incident response and recovery procedures, including the ability to continue providing care when an AI-enabled system is unavailable.

The emphasis is on preparation, not simply documentation. Reid emphasized that completing an AI inventory and developing a governance plan are only the first steps. Organizations must now put those plans into practice. That means testing controls, practicing incident response and confirming that recovery capabilities are sufficient before an actual disruption puts them to the test.

For healthcare organizations, AI governance will remain a moving target as models, applications and agentic capabilities evolve. But the underlying responsibility does not change. The goal is not to slow innovation for its own sake. It is to ensure that innovation can be adopted responsibly, with appropriate safeguards for patients, clinicians and the systems that support care.

As Reid emphasized, cybersecurity ultimately comes back to the safety of the people healthcare organizations serve. Applying that principle to AI means knowing what is in use, understanding what it can do, establishing clear accountability and being prepared when something goes wrong.

Melinda Taschetta-Millane is Market Content Director of Healthcare Editorial, and Head of Content for Healthcare Innovation.