Most health systems are still stuck in the pilot phase with agentic AI. Only 3% have deployed an AI agent into a live clinical or operational workflow, according to research from Microsoft and The Health Management Academy published in NEJM AI in January 2026 - even though 43% of health system leaders are testing or piloting the technology.
That gap between pilot and production is rarely a technology problem. It's a trust problem. Giving an AI agent the ability to schedule patients, update an EHR, submit claims, or coordinate care requires accuracy, security, and full auditability. For CIOs, the real decision is how much operational responsibility to hand an AI agent, what governance needs to be in place, and which implementation approach fits the organization's long-term strategy.
Why agentic AI changes the build-versus-buy calculus
Healthcare organizations have made build-versus-buy decisions for years. Agentic AI is different because it doesn't just provide information - it takes action and completes tasks autonomously. A chatbot answers a query; an agent understands the purpose, makes a decision, reaches into multiple systems, and executes the process without manual monitoring.
Consider a denied insurance claim. An AI agent could confirm eligibility, retrieve required documents, fix coding mistakes, ensure the claim follows the correct approval process, and refile it. That shifts the evaluation from comparing software features to evaluating operational responsibility.
Before selecting a solution, CIOs should answer three questions: Can the agent securely interact with every system required to complete the workflow? Can every action be reconstructed later for a compliance review? And is the workflow specific to how your organization delivers care, or is it a problem every health system solves the same way?
The audit gap most organizations miss
The biggest mistake CIOs make isn't choosing the wrong vendor. It's assuming that if an AI agent can complete a workflow, it's ready for production.
A Black Book Research survey of 182 U.S. hospital leaders, reported by Presidio following HIMSS26, found that only 22% feel confident they could produce a complete, auditable explanation of an AI agent's decision for a regulator within 30 days.
"If a vendor can't show approval logs, role-based access controls, and a clear record of what an agent did and why, the deployment speed they're selling doesn't matter," said Chandresh Patel of Bacancy Technology. "Ask for the audit trail before you ask for the demo."
Build, buy, or hybrid: Comparing the options
Buying is usually the less expensive option to get started. Building costs more initially but gives you greater ownership over time. However, without a skilled AI and integration team, maintaining a custom solution can quickly become a challenge.
Buy options deploy in weeks, handle standard workflows like scheduling, intake, and basic revenue cycle management, and shift compliance and maintenance to the vendor. The trade-offs are limited flexibility and higher vendor lock-in.
Building takes months, supports custom workflows like clinical pathways and payer rules, and gives the organization full control over compliance, audit, and maintenance. Upfront costs are higher, and the organization needs internal AI talent to sustain it.
A hybrid approach uses a vendor platform for standardized, high-volume workflows - patient intake, eligibility checks, appointment scheduling - while custom development handles workflows tied to specific payer contracts, clinical protocols, or care pathways that no vendor platform was designed to support. That combination is what most health systems end up needing, according to Patel.
Few health systems need to commit to one approach forever. The hybrid model gains speed without giving up control of critical workflows.
What production-ready agentic AI requires
Getting an agent to work in a demo is one thing. Deploying it inside a health system's real compliance rules and real EHR systems is another. That's the difference between a successful pilot and enterprise-wide adoption.
Integration with Epic, Oracle Health, MEDITECH, Cerner, FHIR R4 APIs, and HL7 matters - as does approvals, logging, role-based access control, and security guardrails included from the initial release. Prior authorization, denial management, patient access, scheduling, clinical documentation, and care coordination each have different operational challenges, so workflow-specific design matters more than fitting healthcare into a generic AI platform.
CIOs evaluating agentic AI can build relevant skills through an AI Learning Path for CIOs or explore broader AI for Healthcare training to support their assessment.
Why this matters for healthcare leaders
The decision between building and buying agentic AI should come from workflows and compliance requirements - not from which option looks fastest on paper. The organizations that will deploy successfully are the ones that can demonstrate a complete, auditable explanation of an AI agent's decision within 30 days of a regulator asking. That standard should shape the vendor evaluation process and the internal governance framework before any code is written or contract signed.
Your membership also unlocks:
