healthsystemCIO

Letter from the Editor

Dear HIT Professional,


I think I'm pretty fit for 52. I wasn't for a long time, but in early 2025 I made the decision to lose some weight and I've kept it off. I go to the gym almost every day to either lift weights or do some cardio. I watch what I eat.


So when my wife and I went away last week for our 20th anniversary to a lakeside resort, I was ready for the many activities we were going to do – namely, using the paddle boats on the lake, hiking on trails, navigating rock scrambles and riding bikes.


All this activity seemed a good balance with the outsized eating I planned to do. I was on vacation, after all.


So when we were about to start the guided mountain trail bike tour, I was physically ready. I'd show the other old geezers a thing or two. Interestingly, there were no other geezers. In fact, there was no one at all. There was me, my wife, and the 20-something guide. A bit of a sparse crowd but nothing to worry about.


And then we started. It didn't take more than 10 minutes for me to realize that this was going to be one intense ride. I could handle it, but just barely. As we continued to climb, I couldn't help but start with the jibes.


"Hey, buddy, are we going to the top?"


"Are we at the eagles' nest yet?"


My wife knew what I was thinking and started laughing. (She is a hypercompetitive sprint triathlete in her free time, so she was fine.) Our guide, however, found my comments more a reason for concern than amusement. We had talked previously about whether the bike I was using (borrowed from my 15-year-old) was big enough for me. He thought it was not ideal. Thus, when I was complaining and he offered to let me use his bike, it was not so out of line. Though it was strange because our bikes were the same size.


My wife, impressed with the ease with which he was handling the ride, started making inquiries.


"How do you train?"


"I don't really," he said.


"What kind of bike do you have?"


"I don't own one," he said.


"How do you keep up your bike fitness?"


"I took a lifeguarding class once, and that was hard."


None of this made sense to her.


So we continued the grueling 45-minute ride. After my initial comments, I held my tongue. But the last half mile that took us back to the departure point was Sherpa-like territory. My tank was about out of gas, and it was taking all I had to finish – standing up, pedaling hard, breathing harder. I looked up at our guide and he was casually serpentining back and forth across the trail with only one hand gripping the handlebars. I had to say something.


"Dude, I have to tell you. You are some kind of athletic freak. If you put the slightest effort into training, you'd be winning races left and right. You'd have sponsors in a minute," I said, being honestly complimentary.


Then, all of a sudden, out of nowhere, my wife asked:


"Is that an e-bike?"


To which he replied, "Yeah."


What followed was five minutes of laughing and good-natured ribbing, the main gist of which was: "Why didn't you tell us?!?!?!" Obviously, all our commentary during the ride indicated we were impressed with what we believed were his God-given gifts.


Now, before you think we're complete idiots, I had never seen an e-bike like that before – there was no obvious external battery. This bike had a slim frame. There was a built-in light that looked different, but the recognition of what it truly was never clicked.


What did click was this – we had a great time all weekend, took a ton of pictures and had a few of those perfect moments you think you'll remember. But out of all those 72 hours, I think most of them will fade. Except, of course, the big reveal from our Lance Armstrong of the mountain.


Have a tremendous week,


Anthony


Find all my columns here.

New Show Episodes

Inova's Kull Says a Data Moat Is a Losing Strategy as LLMs Become the Front Door


Matthew Kull, EVP, Chief Information and Digital Officer at Inova Health, says patients now reach care through large language models, and the health system an agent cannot book into loses the appointment.


  • API calls from ChatGPT into Inova's Epic environment have skyrocketed over two months
  • Kull expects hospital CIOs to see a 10X increase in API fees
  • An agentic call center now handles 400,000 patient calls a month
  • Cancellations rose and no-show rates fell once hold time disappeared
  • All 27,000 Inova team members will get basic AI education


Read · Listen · Watch →

Chuck Christian, VP of Technology/CTO, Franciscan Health

Franciscan Health's Christian Says AI Spend Stays Unpredictable Until the Bill Arrives


Chuck Christian, CHCIO, VP of Technology/CTO at Franciscan Health, can price a new cloud workload to the month before it moves, and has no comparable way to price an agent.


  • Franciscan created a Cloud Cost Analyst role in 2023 to track spend weekly
  • Right-sizing workloads onto purpose-built servers is projected to save $50,000 monthly
  • Microsoft had to build a second portal just for AI-side consumption
  • Agent consumption still sits in the IT budget while chargeback is worked out
  • Some organizations cleared API access on a treatment relationship they did not have


Read · Listen · Watch →

Feature of the Week

Feature Story

When Clinicians Click, Health Systems Still Own PHI



OpenEvidence's own terms let a clinician accept a BAA alone, and MaineHealth's staff notice says that agreement does nothing for the institution, so the contract decision now sits with the CIO.


  • About 300 million people a week ask ChatGPT health questions, yet OpenAI says ChatGPT Health offers no BAA and is not intended for covered-entity clinical use.
  • Penn Medicine took the opposite path from MaineHealth: an enterprise OpenEvidence deployment for more than 10,000 clinicians.
  • Put contracted clinical AI tools behind single sign-on so personal logins stand out, and point DLP controls at unapproved tools.

News & Analysis

Oracle Health Wins 11-Hospital EHR Deal at Quorum

Quorum Health picked Oracle Health for all 11 hospitals after three years of net Oracle losses, and the platform it gets is still being rebuilt.


  • Quorum already runs Oracle Fusion for enterprise software, an advantage no competing EHR vendor could price against.
  • Oracle didn't say whether Quorum gets the current EHR or the rebuilt platform, whose acute care functionality is due in 2026.
  • The Clinical AI Agent, part of Quorum's purchase, now covers professional fee coding and nursing documentation, which puts third-party ambient and coding contracts up for review.



Device Code Phishing Circumvents MFA as Congress Weighs Hospital Mandates

Microsoft's analysis of EvilTokens, a phishing service it took down with Health-ISAC as co-plaintiff, shows attackers taking over Microsoft 365 accounts through a sign-in method that gets around MFA.


  • Access could survive a password reset unless sessions and tokens were revoked.
  • Microsoft recommends blocking device code sign-in except on devices that need it.
  • Pending House and HHS mandates would require MFA without specifying which kind.



Cyber Decoys Target the Hospital Detection Gap

CISA's new guidance points hospitals to decoy accounts and files that fire when an intruder holding valid credentials touches them, and the real cost is analyst time.


  • Candidates include a decoy Active Directory service account no application calls, a billing-export share finance never opens and vault credentials that unlock nothing.
  • Any touch on a decoy strongly suggests unauthorized activity, which is why CISA calls the alerts high fidelity, with fewer false alarms than conventional monitoring.
  • CISA expects a MITRE ATT&CK gap analysis and working firewall, EDR, SIEM and identity controls first, with decoy documentation kept outside production.


Medical Device Security Exceptions Need a Named Owner, Health-ISAC Baselines Say

Health-ISAC set out nine security capabilities health systems should expect from device makers, and named who owns the gap when a device cannot meet them.


  • The nine: authentication, authorization, secure remote vendor access, privacy and data handling, encryption, event logging, patches and updates, secure cloud connectivity and boundary protection.
  • Full-operating-system devices should support directory accounts, enforced password strength and SIEM log export. Embedded devices need compensating controls such as gateway MFA and segmentation.
  • Appendix B maps each domain to the HSCC model contract language, ready for RFPs, master service agreements and BAAs.


Oracle Health Plans Oncology EHR but Leaves Launch Timing Unspecified

Oracle announced plans for an oncology EHR Sept. 23 with no customers or launch date, leaving cancer programs with questions to put to Oracle before renewing oncology contracts.


  • Four planned capabilities: cancer-care timelines, nurse navigator worklists, combined genomic and imaging insights, and chemotherapy planning with lifetime cumulative-dose calculations.
  • The release doesn't say how the product relates to Oracle's existing oncology offering, or address migration and licensing.
  • Before renewing, ask Oracle for a delivery schedule, supported workflows, licensing terms and how existing treatment plans would transfer.

Register for Upcoming Webinars

Token Budgets: Exploring Dynamics and Controls Around AI Costs (9/29)

  • Ryan Cameron, VP, Chief Information & Innovation Officer, Children's Nebraska 
  • Ryan Curl, PhD, AI Governance Lead, SUNY Upstate Medical University
  • Pete D'Addio, MS, CHCIO, VP of Technology, LCMC Health
  • Brian Dilcher, MD, Associate CMIO & Director of Emergency Medicine Clinical Informatics, WVU Medicine
    

Accounting for the AI Already Inside Your Health System (10/16) Sponsored by Vitea

  • Joel Vengco, SVP and Chief Information & Digital Officer, Hartford HealthCare
  • Barry Stein, MD, Chief Clinical Innovation Officer & CMIO, Hartford HealthCare
  • Shantanu Nigam, Co-Founder & CEO, Vitea 


Building Systemness: Balancing Standardization with Local Strengths and Needs (10/20)

  • Craig Richardville, SVP, Chief Digital & Information Officer, UF Health
  • Tinu Tadese, MD, Former System VP/CMIO, Boston Medical Center Health System


From Legacy to Cloud: Lessons Learned Modernizing the Patient Contact Center (10/27) Sponsored by CTG

  • Joe Alfonsi, Assistant VP, Access / Call Center, Temple Health – Temple University Health System
  • Kathrina Bidwell, Operations Director, Care Navigation Hub (Contact Center), UC San Diego Health
  • Joseph Esdale, Strategic Solutions Partner, CTG


To sponsor a Webinar, reach out to Nancy Wilcox

Partners

Heidi Health
Netskope

Gemini's Breakout Is a Reminder the Basics Still Matter — Netskope VP of marketing Scott Hogrefe examines Google's confirmation that a Gemini agent under test reached three real organizations, using a guessed password and credentials left in a public repository. Agents exploit the credential hygiene failures already sitting in an environment, at machine speed. Expiring credentials, multi-factor authentication and secret scanning close most of the opening.


Heidi secures US$340M to scale agents across health systems globally — Heidi announced US$340 million in new funding at a US$900 million valuation, led by Blackbird and General Catalyst's Customer Value Fund. The company will extend from documentation into supervised agentic action across the clinical day, building the regulatory and clinical safety work that shift requires. Enterprise customers include Beth Israel Lahey Health and NHS England Midlands.


Contact Nancy Wilcox to learn about becoming a healthsystemCIO Partner

Streaming Webinars

Advancing AI Adoption with a Lean IT Team (Sponsored by Heidi Health)


Giving Nurses Back Time Through AI and Workflow Optimization


Building AI Literacy Across the Health System Workforce


Streaming Library

Popular

Second Epic Build-a-Thon Moves Clinician-Built Agents From Operations Into Clinical Judgment — September 16, 2026


Dayton Children’s Whitlock Says Provider Experience Will Govern the Move to Epic’s Ambient AI — August 31, 2026


Mayo Clinic’s Overgaard Says Simulation Can Help Close the AI Translation Gap — August 24, 2026


Epic Almanac Says Health Systems Moving AI Past Pilots, Early Adopters Building Agents — August 9, 2026


Overwhelming Majority of Information Blocking Complaints Name Providers, Putting Risk in Records Workflows — September 11, 2026

Topic Centers

AI

Clinical Informatics

Cybersecurity

Data & Interoperability

EHR & App Strategy

Epic

Infrastructure & Cloud

Meditech

Oracle Health

Revenue Cycle

healthsystemCIO

If a colleague would find this useful, forward it along — they can subscribe here.


Listen to the Podcast: Apple Podcasts | Spotify

For sponsorship inquiries contact:

Nancy Wilcox | Director, Sales & Marketing

nwilcox@healthsystemcio.com

Advertise/Sponsor

LinkedIn  YouTube