A new survey from digital identity security firm Imprivata reveals a sharp disconnect between healthcare leaders' confidence in governing agentic AI and the reality of unauthorized deployments. The findings, published September 17, warn that patient safety could be at risk if autonomous AI tools continue rolling out without proper guardrails.
More than 85% of leaders responsible for AI strategy at healthcare organizations say they are confident they have visibility into AI agent activity and can fully control an autonomous agent's actions. Yet 72% of those same respondents admit AI tools are deployed without IT approval at least occasionally within their organizations.
Rapid adoption outpaces oversight
Agentic AI - systems that act largely independently, making complex multi-step decisions with minimal human intervention - has seen heavy investment in healthcare. More than a quarter of leaders have already implemented the technology, according to market research firm Vanson Bourne, which conducted the survey. An additional 44% are piloting projects and 21% plan to implement agentic AI within the next year.
Back-office use cases dominate early adoption. Prior authorization and revenue cycle management automation are common starting points. For professionals working in these areas, understanding how AI agents interact with billing systems is becoming essential. AI for Medical Billers courses address the specific tools and workflows now being automated across the revenue cycle.
The vast majority of respondents expect agentic AI to have a major impact on clinical and operational workflows. But expanding use cases mean agents are gaining access to a wider variety of internal systems - and with that access comes new security risks.
The autonomy problem
Unlike traditional software that relies on user input, agents can traverse different information systems and execute actions on behalf of users without direct human oversight. Dr. Sean Kelly, chief medical and growth officer at Imprivata, described the stakes bluntly.
"If an agent has excessive permissions, operates outside its intended scope, or takes a high-risk action without appropriate oversight, the consequences can directly impact care delivery," Kelly said. "An agent could access or expose sensitive patient information, enter incorrect information into a medical record, alter a medication or dosage or act under a clinician's authority in a way that the clinician never intended."
Kelly added that because agents operate at machine speed, a single error could propagate before anyone recognizes what is happening. More than half of survey respondents ranked security among their top concerns when adopting agentic AI.
Shadow AI remains rampant
The Imprivata report is not the first to flag unauthorized AI use in healthcare. A separate survey by Wolters Kluwer found that 40% of medical workers and administrators were aware of colleagues using unauthorized AI tools, and nearly 20% reported using an unsanctioned tool themselves.
Healthcare organizations are taking fragmented approaches to managing AI agents. Some tools are centrally managed by IT departments, while security teams manage others. Some deployments happen on an ad hoc or unapproved basis. Leaders are still working out how much human oversight is needed when an agent makes decisions - a calculation that varies widely depending on whether the agent operates in an administrative, operational, or clinical setting.
"Oversight must match the level of clinical risk. Agents need clearly defined identities, permissions, and boundaries, with human review for higher-risk activities and an audit trail for accountability," Kelly said. "The more autonomy we give these systems, the more important those safeguards become to detect and contain problems before they create broader operational or patient safety risks."
The nonprofit ECRI named insufficient governance of AI in healthcare as one of its top 10 patient safety concerns last year. The Coalition for Health AI, a network of thousands of healthcare systems and industry groups, issued AI governance playbooks to help health systems responsibly roll out AI tools.
Why this matters for healthcare professionals
Agentic AI is already inside your organization - whether IT has approved it or not. The survey data shows that even leaders who feel confident about governance are dealing with shadow AI deployments. For clinicians, billers, and administrators, the practical takeaway is straightforward: understanding how these tools function, what permissions they carry, and what oversight mechanisms exist is no longer optional. AI for Healthcare Courses can help professionals build the literacy needed to spot risks and work safely alongside autonomous systems as governance frameworks catch up to adoption speed.
Your membership also unlocks:
