Healthcare governance must accelerate to address the rise of unsanctioned artificial intelligence use across hospitals, a concern highlighted by the sector’s chief security officer.
Informal AI adoption outpaces formal controls
Over the past decade, hospitals have upgraded digital systems, yet many still struggle to integrate new tools through established procurement channels. A 2015 survey found only 15 percent of staff felt their organization was “very ready” to adopt fresh technology, with compliance cited as the main obstacle.
Today, clinicians and administrators are turning to generative AI for faster note‑taking, patient‑history summaries, and routine workflow automation. Because official software approval processes are often lengthy, staff sometimes bypass them, creating a parallel “shadow AI” ecosystem that operates alongside sanctioned applications.
One recent survey reported that more than half of healthcare institutions discovered such shadow AI usage only after vendors disclosed it, indicating that many employees experiment with AI tools without formal oversight.
Risks tied to unapproved AI tools
Unregulated AI use raises data‑privacy concerns. When a physician inputs protected health information into an unapproved chatbot, that data may be stored or used for model training by external parties, potentially breaching HIPAA requirements.
Beyond privacy, patient safety is at stake. AI‑generated content can contain errors or omissions, and if clinicians incorporate these outputs into medical records without verification, diagnostic or prescription decisions may be affected.
Traditional IT governance structures were not built for the speed and accessibility of modern AI. Review cycles that take months clash with clinicians’ need for immediate solutions, especially amid staffing shortages and mounting documentation burdens.
Related: Digital Divide Threatens Care for Vulnerable Populations
Existing policies often categorize software simply as “approved” or “unapproved.” AI tools blur that line, serving multiple functions—documentation assistance, search, and generative writing—within a single platform. This creates blind spots, as an enterprise‑level approval may not reveal how individual users activate specific AI features.
Another hurdle is the lack of governance standards tailored to healthcare workflows. Current frameworks focus on data security and vendor compliance but rarely address generative‑AI risks such as hallucinated outputs or inadvertent disclosure of patient data through prompts.
Security teams therefore need visibility into where AI tools are employed across clinical and administrative processes.
Visibility is essential for safe AI integration.
Education also plays a role. Many clinicians are unaware of the data‑handling implications of feeding patient details into third‑party AI services. Providing straightforward guidance on permissible use can curb unintentional violations.
To align speed with safety, hospitals may need to streamline approval pathways for low‑risk AI applications while maintaining rigorous checks for higher‑impact uses. Offering pre‑vetted tools that meet security and compliance standards could reduce the temptation to turn to external, unapproved solutions.
Ultimately, the organizations that will thrive are those that make AI usage transparent, secure, and sustainable, rather than those that simply try to embed the technology in the greatest number of workflows.
