healthsystemCIO
ELLKAY: Unify your data. Power your future. Partner with ELLKAY for Enterprise Data Management.

Letter from the Editor

Dear HIT Professional,


Sometimes we decide to take walks down memory lane, but sometimes we get pushed. For example, we've all been doing our usual stressing about the present or the future when our phone pops up a "Memory" photo that casts our minds back.


I have mixed emotions about these journeys – rather than pleasure, they sometimes make me melancholy, longing for something that is no longer, regretful that I wasn't better at what I was doing at the time (think parenting), or didn't "live in the moment" enough. Ugh.

Recently, while working with my BFF Claude to redesign some of our website pages, I got pulled down memory lane. We were on the "About" page when I asked it:


"Do you think we should add a little bit of an origin story here? It's been almost 17 years, and I have a pretty cool one."


"Tell me about it – give me some bullet points," encouraged my buddy.


After dashing them off, I was told:


"This is great stuff!"


And so our About page has a few short paragraphs about it.


As I was pondering those paragraphs last night, I saw one theme shine through. Each of those bullet points, each of those origin elements, is pegged to somebody helping me.


I am proud of what I've accomplished, so this isn't an aw-shucks humblebrag. But I also own the fact that there is so much I don't know and that I'm not good at. I think I understand the delicate balance of holding pride and confidence while retaining humility.


I bring that perspective to evaluating the past. I worked really hard but, when you read those paragraphs, you will see that my in-laws helped me, my father helped me, my mother helped me (and my sister too, though she didn't get a mention). It's likely all of us have been the beneficiaries of those who, though we climbed the ladder, held it firm.


So with that combination of confidence/pride and humility, we should all hold deep gratitude. And, more than that, we should remember that there is no greater gift we can give than, once we are on firm ground, holding the ladder for others as they climb.


For there is likely no greater testament to the quality of our lives than, someday, being part of someone's origin story.


Have a tremendous week!


Anthony


Find all my columns here.

ELLKAY: AI starts with data you can trust. ELLKAY's Enterprise Data Management Platform makes it possible.

New Show Episodes

Sachin Pawar, MD, Surgical Medical Informatics Officer, Froedtert Health

Froedtert Health's Pawar Says Surgery Crosses Every Epic Team, So Surgical Informatics Needs a Dedicated Lead


Sachin Pawar, MD, Surgical Medical Informatics Officer, Froedtert Health, says surgeons work across Epic application teams that IT runs separately, so a surgeon with protected informatics time can keep those teams aligned with surgical practice.

  • Froedtert moved surgical case entry from schedulers to surgeons or clinical team members and met its 80% target across the organization.
  • Training for the case-entry change ran one-on-one with about 220 surgeons, delivered by an internal team and an outside consultant.
  • Pawar said surgeon champions without protected time can struggle to keep up with informatics work; his role includes time allocated for that work and a defined job description.
  • A monthly surgical governance subcommittee takes requests in SBAR format and includes clinical and operational leaders from ORs and ambulatory surgery centers, plus supply chain representation.
  • Without such a role, Pawar recommends standing roadmapping meetings between perioperative IT leaders and operations, plus IT leaders sitting in on operational meetings.


Read · Listen · Watch →

Matt Seul, Principal Information Security Architect, Sutter Health

Sutter Health's Seul Says Maximum AI Reasoning Can Raise Token Costs and Derail Agent Workflows


Matt Seul, Principal Information Security Architect at Sutter Health, found that model size and reasoning level need to fit each step of an AI agent to manage token costs and improve consistency.

  • Seul said a model could use roughly 500,000 tokens to list, size and sort files; his tool call using a Python script did the same work for about 12,000.
  • Seul described context window exhaustion as a gradual loss of precision that can be hard to spot when a harness tries to compensate in the background.
  • In Seul's testing, excessive reasoning led models to override rules and invent steps, undermining the consistency he needed from a security scanner.
  • Seul runs his orchestrator agent at medium reasoning and uses a large model with heavy reasoning for the sub-agent that analyzes code.
  • Sutter Health's AI curriculum teaches staff at each skill level where AI tools fall short and why agents derail.


Read · Listen · Watch →

ELLKAY: Simplify interoperability. Unlock AI. Partner with ELLKAY for Enterprise Data Management.

Feature of the Week

Feature of the Week

California's Clinical AI Bias Law Takes Effect Jan. 1, 2027, With Work Ahead for CIOs


California's SB 503 requires hospitals to regularly monitor AI clinical decision support tools that pose a known bias risk starting Jan. 1, and CIOs can help prepare the inventory, documentation and data.

  • Developers must make documentation on training data, evaluation and monitoring available on request or at initial sale, and with material updates.
  • Before SB 503 was signed, Penn Medicine described reviewing vendor upgrade notes and seeking advance notice of model changes.
  • Mayo Clinic found an asthma prediction model performed less well for lower-income children; the study named missing data as a possible explanation.

News & Analysis

Luminis Health Restores MyChart After Four Weeks, Highlighting Downtime Needs Beyond the EHR


Luminis Health says its cyberattack spared the system storing patient records, yet phones and MyChart stayed down for weeks, a sign downtime plans have to cover the services around the EHR.

  • Luminis is still scanning outage-period notes, lab results and imaging results into MyChart, so some information might not yet be visible to patients.
  • In a June interview before the outage, the American Hospital Association's John Riggi said downtime after high-impact attacks averages about 30 days.
  • In June, Greg Sieg, CISO of the University of Michigan Regional Health Network, described nurses on one unit who had never charted on paper.



Intermountain's Smith Plans a Control Plane for Cross-Platform AI


Ryan Smith, SVP, Chief Digital & Information Officer at Intermountain Health, says coordinating agents across systems requires controls over how they communicate with one another and retrieve outside data.

  • AI enters health systems through vendor features, standalone products and internal development, with coordination and governance needed before production.
  • Intermountain has more than 200 AI capabilities, products, tools and solutions in production, including some serving patients and other consumers.
  • Models on a separate enterprise data platform test the IT triage solution's quality and safety, with people overseeing both systems.



Health-ISAC Urges Validation of Restored Clinical Systems After June Cyber Exercise


Health-ISAC's after-action report on its June tabletop exercise says restored services can come back before they can be trusted, so health systems should set validation checks before an incident.

  • Validation covers EHR write access, medication orders, nurse-call routing, alarm routing, device-management policies and infusion pump drug libraries.
  • Temporary accounts, remote sessions, vendor exceptions and firewall rules opened during an incident should be closed or formally approved and monitored.
  • Health-ISAC recommends reassessing vendor and incident response contracts so rural campuses, affiliates and clinics are covered with realistic support expectations.



ONC Funds MedStar's Open-Source Guardrails for Clinical AI Agents


ONC awarded MedStar Health Research Institute $999,985 to build open-source software that routes and verifies clinical AI agents' work, code CIOs could use as a reference when weighing vendors' agent controls.

  • MedStar's planned software would keep patient data in Solid protocol stores patients control, with tamper-evident certificates recording how AI work was routed.
  • ONC's project description calls for testing in shadow mode and a clinical pilot with human approval gates, with the work running through September 2029.
  • Intermountain Health's Ryan Smith told healthsystemCIO in September that no single platform vendor provides enterprise controls for agents working across systems.

Register for Upcoming Webinars

CHIME certification holders earn 1 CEU: CHCIO, CHISL, CFCHE, and CDH (all levels).

Vitea

Accounting for the AI Already Inside Your Health System

10/16 · Sponsored by Vitea

  • Joel Vengco, SVP and Chief Information & Digital Officer, Hartford HealthCare
  • Barry Stein, MD, SVP, Chief Clinical Innovation Officer & CMIO, Hartford HealthCare
  • Shantanu Nigam, Co-Founder & CEO, Vitea 

Register →

Building Systemness: Balancing Standardization with Local Strengths and Needs

10/20

  • Ash Goel, MD, SVP/CIO, Bronson Healthcare 
  • Craig Richardville, SVP, Chief Digital & Information Officer, UF Health
  • Tinu Tadese, MD, Former System VP/CMIO, Boston Medical Center Health System

Register →

CTG

From Legacy to Cloud: Lessons Learned Modernizing the Patient Contact Center

10/27 · Sponsored by CTG

  • Joe Alfonsi, Assistant VP, Access / Call Center, Temple Health – Temple University Health System
  • Kathrina Bidwell, Operations Director, Care Navigation Hub (Contact Center), UC San Diego Health
  • Joseph Esdale, Strategic Solutions Partner, CTG

Register →

Learn more about Webinar sponsorship

Partners

Heidi Health
Netskope
Imprivata

Why healthcare needs to ditch the password and switch to the PIN — Imprivata principal product manager Jason Potts says a short PIN paired with a proximity badge protects clinical access better than a twelve-character password.

  • A password’s weakness is portability, not length. It works from any device anywhere, which is exactly why it can be stolen from anywhere.
  • A badge and PIN together have no remote attack surface: the PIN is worthless without the card, and the card is useless without the PIN.
  • Clinician workarounds — shared logins, sessions left open, passwords taped to monitors — are rational responses to authentication built for a different environment, not carelessness.

Become a healthsystemCIO Partner

Streaming Webinars

Token Budgets: Exploring Dynamics and Controls Around AI Costs


Advancing AI Adoption with a Lean IT Team

Sponsored by Heidi Health


Giving Nurses Back Time Through AI and Workflow Optimization


Building AI Literacy Across the Health System Workforce


Watch past webinars in our Streaming Library

Popular

Luminis Health Restores MyChart After Four Weeks, Highlighting Downtime Needs Beyond the EHR

Oct. 5, 2026


Intermountain's Smith Says AI Ticket Triage Freed Informaticists for At-the-Elbow Support at Epic Go-Live

Sept. 30, 2026


Insurers Blame Hospital AI Coding for $942 Million in Added Costs; CIOs' Audit Trails Can Help Hospitals Respond

Sept. 29, 2026


Froedtert Health's Pawar Says Surgery Crosses Every Epic Team, So Surgical Informatics Needs a Dedicated Lead

Oct. 5, 2026


Temple Health's Lai Says Machine-Speed Attacks Leave CISOs No Choice on Automated Defense

Sept. 14, 2026

Topic Centers

AI

Clinical Informatics

Cybersecurity

Data & Interoperability

EHR & App Strategy

Epic

Infrastructure & Cloud

Meditech

Oracle Health

Revenue Cycle

Rural & Community Hospitals

healthsystemCIO

If a colleague would find this useful, forward it along — they can subscribe here.


Listen to the Podcast: Apple Podcasts | Spotify


For sponsorship inquiries contact:

Anthony Guerra | Founder
sponsorships@healthsystemcio.com

Advertise/Sponsor

LinkedIn  YouTube