healthsystemCIO Weekly Roundup: Guerra on Reliability, Shah on Adoption, HHS on Info Blocking, and More

Letter from the Editor

The Risks of Rescheduling

In the millisecond between when I saw the hole in the ground and when I was able to move my body, it was too late, and I felt the sting on my leg that I knew was going to change my day.

Once again. I’d mowed over an in-ground hive—something that really makes them angry.

Now, before you start to worry too much—though I am allergic to bees and take my EpiPen when I get stung—I have never had trouble breathing.

Nonetheless, it is not a fun occurrence and not to be taken lightly. So when I came inside and said to my wife, “I got stung, damn it,” she was concerned.

“Really? Come on, Ant!” she said, as if I’d intentionally tap-danced on the hive. “Where’s your EpiPen? Take it, and we have to go to the hospital.”

“Damn it,” I said. “But I have an interview in two hours!”

“Forget your interview,” she said.

And with that, I had a flash of (probably unreasonable) anger. “Don’t say that! Don’t say ‘forget my interview’ as if it doesn’t mean anything, as if it doesn’t matter!”

In that moment, her reasonable statement met with a deep psychological tenet of mine—I don’t quit, I don’t stop, I show up, I keep my word. Period. That knee-jerk reaction took a few minutes to have a nice chat with reality so they could work something out.

And so as we drove to the hospital, I resigned myself to the fact that I was going to do one of the things I detested most in the world: tell someone who had made time for me that I wasn’t going to make it.

Why am I like this? If I think back, I’d say it comes from my father. Like a duckling “imprinting” a parenting trait deep in its psyche, I have a strong impression of seeing my dad go to work every day—rain or shine or snow, no matter what happened the day before or how things were going. It seemed to me he was an unstoppable force of nature in this respect. It was something to count on—a marvel to my little brain. And it has stuck with me.

Combine this imprint with a lesson from my readings of history’s events and great figures. It’s the idea that life is not a steady progression but punctuated by opportunities we either grasp or miss, and they don’t come around a second time. This is why I detest everything about rescheduling or postponing—because if it was important enough to arrange, it must transpire at all costs. Dare I use a line from Rocky III in which, when Apollo tries to get Rocky to focus on his training, he screams, “There is no tomorrow!”

Cancellations make a deep impression on me. I can remember a very painful one during COVID-19 when we had to cancel Thanksgiving because someone in the family had caught that ailment. As parents get older and the number of holidays remaining diminishes, missing one hurts deeply.

So when my sister called me this weekend to say my mother was coughing and she wasn’t sure if they should come up for a BBQ I was hosting, I responded immediately. “Of course you’re coming.”

I feel like any downside that comes along with this mania for following through is more than offset by the upside. In fact, the people I want to work with, befriend and associate with in general are communicative (they don’t “ghost” you), give their word deliberately, keep it religiously, and break it regretfully.

And for those who look at commitments on their calendar as mere placeholders until something more important comes along. That also comes across loud and clear, and no doubt has its costs.

Find this column online

Thoughts on this piece? Drop me a line aguerra@healthsystemCIO.com

Featured Interview

Providence’s Shah Focused on Uptake of Digital Tools; Wendt’s Study Indicates Progress

At Providence, digital success hinges on use, not implementation. Maulin Shah, MD, CMIO, details how informatics pairs system-wide rollouts with coaching, usage metrics, and governance to drive sustained clinician adoption. Staci Wendt, PhD, Director, Providence Health Research Accelerator, explains randomized, staged evaluations—such as DAX Copilot—that combine surveys and EHR telemetry, revealing reduced after-hours documentation and workflow fit. Together, they offer a replicable model: evidence before scale, continuous measurement, and enablement, because “Adoption is everything.”

News, Articles & Columns

HHS to Step Up Info-Blocking Enforcement, Puts Industry on Notice

HHS will intensify enforcement against information blocking, directing ASTP/ONC and HHS-OIG to investigate and penalize entities that hinder access, exchange, or use of electronic health information. Deputy Secretary Jim O’Neill, Acting IG Juliet T. Hodgkins, and ASTP/ONC chief Tom Keane, MD, said investigations are underway. Under the Cures Act, developers, HINs, and HIEs face civil penalties up to $1 million per violation; providers risk CMS disincentives. Stakeholders are urged to report violations via ONC’s portal.

The Epic Tortoise vs Startup Hares

John Lee, MD, Clinical Informatics Specialist at The MetroHealth System, argues that Epic’s Cosmos advances through iteration embedded in clinical workflows. Poor documentation creates “data cannibalism,” yielding models that reflect documentation behavior rather than patient truth. Lee expects Cosmos and CoMET to keep evolving, citing progress from SlicerDicer to SQL/R/Python on Cosmos’ Dimensional Database. He favors synthesizing Epic’s vision with graph approaches and contends that workflow integration is decisive—making Epic’s tortoise strategy a likely winner.

Partner Perspective: Drawing on Global Experience, Heidi Health’s Kelly Offers Advice on Optimizing Clinician AI Adoption

Dr. Thomas Kelly, Co-Founder & CEO, Heidi Health, outlines a playbook for clinician AI adoption: build a cross-department council of super-users, design specialty-specific workflows inside and outside the EHR, and measure activation—not licenses—with explicit exit criteria before scaling. He urges seeding train-the-trainer materials, starting with high-friction tasks beyond notes, and preparing governance for emerging regulation. Done well, adoption delivers capacity gains, documentation improvements, greater throughput, and clinician sentiment.

Sanctioned AI Concept: Innovation with Control or a Resume Generating Event (RGE)

Mike Ratliff, CISO, Providence, proposes a “Sanctioned AI” model to enable adoption without unmanaged risk. He recommends limiting each category to a small set of vetted tools, rolling them out in waves, and iterating on outcomes. Governance shifts to business-managed access groups (Developer, Productivity, Commodity) using a five-question risk lens. Addressing gaps in telemetry, DLP, and behavioral baselines, plus training and communication, is critical. The goal: scalable innovation with accountable guardrails—not chaos or an RGE.

Google’s Personal Health Agent: Where Wellness Meets Care

Google Research’s preprint on a “Personal Health Agent” examines how people seek health information across four behaviors: general knowledge, personal data insights, wellness advice, and symptom queries. Daniel Yang, MD, VP of AI & Emerging Technologies, Kaiser Permanente, argues the wellness/medical divide is increasingly artificial, yielding fragmented experiences and gray areas as LLMs answer with disclaimers and human care stays hard to access. A unified agent integrating EMR, wearable, and search data could close gaps, prompting health systems to engage more beyond medical care.

Where Culture Rules, Change Thrives

Edwina Bhaskaran, Chief Clinical Systems and Informatics Officer, Mayo Clinic, argues that flawless workflows fail without cultural readiness, learning tools, and outcomes. Drawing on a transplant-unit rollout, she notes users resisted until leaders explained the why, educators built confidence, and communicators tied changes to real-world impact. Bhaskaran frames adoption as STICKY’s back half—Culture, Knowledge, Yield: anticipate resistance, demand actionable data from vendors to evolve systems, and prove time saved. When yield lags, rethink or retire.

HISAC Releases Business Information Security Officer White Paper Series

Health-ISAC’s three-part BISO series distills practitioner guidance across financial services, health, and retail/hospitality. It defines the Business Information Security Officer as the liaison translating cyber risk and compliance into actionable guidance; outlines responsibilities, organizational placements, obstacles, and performance indicators; and maps competencies, education, and career progression. Emphasizing cross-industry collaboration, the papers give executives templates for aligning security with business objectives, building trust among teams, and operationalizing risk management to safeguard continuity, profitability, and resilience today.

Defining Real Cyber Risk: Context, Cost, and Governance

Randall (Fritz) Frietzsche, Enterprise CISO at Denver Health, argues that missing or misconfigured security controls are control gaps—not risks—until evaluated in context. Risk emerges from Likelihood × Impact, which demands analysis of environment and consequences (think: an unlocked door in Kansas versus a war zone). He advises ranking remediation by risk rating and mitigation cost, distinguishing material from compliance risk. Governance and standardization prevent repeatable errors—like forgetting a firewall—while ensuring scarce resources target what matters.

Sponsor Updates

Artera Flows Agents Facilitate 42M Unique Patient Sessions with 94% of Conversations Completed Without Staff Intervention

Brilliant Bites