# HSCC releases guidance on managing third-party AI risks in healthcare supply chains

> The Health Sector Coordinating Council released guidance to help healthcare organizations manage cybersecurity risks from third-party AI vendors. HIPAA, written in 1996, doesn't cover AI-specific threats like training data leakage or model misuse.

- Type: AI news
- Page: https://completeaitraining.com/news/hscc-releases-guidance-on-managing-third-party-ai-risks-in/
- Published: 2026-04-18
- Updated: 2026-09-19
- Author: Jeroen Erne
- Jobs: Management
- Reading time: 1 min

### Healthcare Organizations Need New Safeguards for Third-Party AI Tools

The Health Sector Coordinating Council released guidance this week to help healthcare organizations manage risks from third-party AI vendors and suppliers. The guidance addresses a gap in existing oversight: HIPAA, enacted in 1996, predates widespread AI adoption and doesn't account for AI-specific vulnerabilities.

Healthcare organizations are rapidly deploying AI across clinical and operational workflows-from diagnostic support systems to revenue cycle automation. These tools introduce cybersecurity risks that traditional vendor management doesn't cover.

#### Where the Risks Hide

Healthcare organizations often lack visibility into the AI components they're purchasing through supply chains. Vendors may shift security responsibilities to healthcare organizations through one-sided contracts, and security incidents-like training data leakage or synthetic data misuse-can go unreported.

The attack surface has expanded significantly. AI infrastructure, algorithms, and models change at rates that outpace typical risk management cycles, creating compliance and security blind spots.

#### What Healthcare Leaders Should Do

The council recommends organizations establish AI governance bodies and define shared responsibility models with vendors. This includes managing the AI lifecycle from procurement through end-of-life.

Specific practices include:

- Developing AI governance policies and use-case justification requirements
- Using model contract language covering data ownership, AI training, and performance standards
- Adding AI-specific clauses to business associate agreements
- Conducting vendor security assessments before adoption
- Performing model validation and quality assurance
- Planning response and recovery procedures with AI vendors

The guidance applies to organizations of all sizes. A large health system and a small clinic will implement these practices differently, but both should adopt the framework.

For managers overseeing AI adoption, understanding [AI governance and risk management](https://completeaitraining.com/tag/executives-and-strategy/) is now essential to protecting operations and patient data.

---

This is the Markdown form of https://completeaitraining.com/news/hscc-releases-guidance-on-managing-third-party-ai-risks-in/. The whole site is mapped at https://completeaitraining.com/llms.txt.