Healthcare Organizations Need New Safeguards for Third-Party AI Tools
The Health Sector Coordinating Council released guidance this week to help healthcare organizations manage risks from third-party AI vendors and suppliers. The guidance addresses a gap in existing oversight: HIPAA, enacted in 1996, predates widespread AI adoption and doesn't account for AI-specific vulnerabilities.
Healthcare organizations are rapidly deploying AI across clinical and operational workflows-from diagnostic support systems to revenue cycle automation. These tools introduce cybersecurity risks that traditional vendor management doesn't cover.
Where the Risks Hide
Healthcare organizations often lack visibility into the AI components they're purchasing through supply chains. Vendors may shift security responsibilities to healthcare organizations through one-sided contracts, and security incidents-like training data leakage or synthetic data misuse-can go unreported.
The attack surface has expanded significantly. AI infrastructure, algorithms, and models change at rates that outpace typical risk management cycles, creating compliance and security blind spots.
What Healthcare Leaders Should Do
The council recommends organizations establish AI governance bodies and define shared responsibility models with vendors. This includes managing the AI lifecycle from procurement through end-of-life.
Specific practices include:
- Developing AI governance policies and use-case justification requirements
- Using model contract language covering data ownership, AI training, and performance standards
- Adding AI-specific clauses to business associate agreements
- Conducting vendor security assessments before adoption
- Performing model validation and quality assurance
- Planning response and recovery procedures with AI vendors
The guidance applies to organizations of all sizes. A large health system and a small clinic will implement these practices differently, but both should adopt the framework.
For managers overseeing AI adoption, understanding AI governance and risk management is now essential to protecting operations and patient data.
Your membership also unlocks:
