Complete AI Training
Sign inGet my AI kit

Your job's AI kit

Get your AI kit

Tell us who you are and what you do. We show you your kit right away and email you the link: skills, prompts, AI agents, MCP servers and courses for your job.

500+ jobs ready, and we make a kit for any other job. No payment needed to look.

Share

AI news ·

HSCC releases guidance on managing third-party AI risks in healthcare supply chains

The Health Sector Coordinating Council released guidance to help healthcare organizations manage cybersecurity risks from third-party AI vendors. HIPAA, written in 1996, doesn't cover AI-specific threats like training data leakage or model misuse.

1 min read
Management

Healthcare Organizations Need New Safeguards for Third-Party AI Tools

The Health Sector Coordinating Council released guidance this week to help healthcare organizations manage risks from third-party AI vendors and suppliers. The guidance addresses a gap in existing oversight: HIPAA, enacted in 1996, predates widespread AI adoption and doesn't account for AI-specific vulnerabilities.

Healthcare organizations are rapidly deploying AI across clinical and operational workflows-from diagnostic support systems to revenue cycle automation. These tools introduce cybersecurity risks that traditional vendor management doesn't cover.

Where the Risks Hide

Healthcare organizations often lack visibility into the AI components they're purchasing through supply chains. Vendors may shift security responsibilities to healthcare organizations through one-sided contracts, and security incidents-like training data leakage or synthetic data misuse-can go unreported.

The attack surface has expanded significantly. AI infrastructure, algorithms, and models change at rates that outpace typical risk management cycles, creating compliance and security blind spots.

What Healthcare Leaders Should Do

The council recommends organizations establish AI governance bodies and define shared responsibility models with vendors. This includes managing the AI lifecycle from procurement through end-of-life.

Specific practices include:

  • Developing AI governance policies and use-case justification requirements
  • Using model contract language covering data ownership, AI training, and performance standards
  • Adding AI-specific clauses to business associate agreements
  • Conducting vendor security assessments before adoption
  • Performing model validation and quality assurance
  • Planning response and recovery procedures with AI vendors

The guidance applies to organizations of all sizes. A large health system and a small clinic will implement these practices differently, but both should adopt the framework.

For managers overseeing AI adoption, understanding AI governance and risk management is now essential to protecting operations and patient data.

Share