When Technology Moves Faster Than Healthcare
Posted on Oct. 1, 2026 / Subscribe 0
AI is arriving in healthcare faster than most organizations can build guardrails around it. In our latest Utah HIMSS webinar, James Hadley (Chief Information Security Officer, ARUP Laboratories) and Steve Ellis (Field CTO, Cy4Data Labs) talked candidly about closing that gap. Utah HIMSS Membership Director Joe Maio, DDS moderated, President Megan Park opened the session, and Sami Roe brought in audience questions.
Joe framed the hour around one question: what does this actually change for the patient and the people caring for them? As he put it, “AI is really rewriting the rules of risk.”
Five takeaways
1. The gap is real, and it’s normal
James put AI in the context of earlier booms like the internet and the cloud: risk appetite ebbs and flows, and regulation tends to arrive only after the risk is clear. His advice: “Be comfortable being uncomfortable.” Steve added that frontline staff can’t be expected to become technologists. Their job, he said, is “to deal with a person that’s in front of them or to deal with a surgery.”
2. The patient upside is not theoretical
Both panelists pointed to AI spotting findings in X-rays and MRIs, matching patterns across data volumes no single clinician could process, and catching patient risk earlier so results reach providers faster.
3. Security leaders should be partners, not gatekeepers
James described the security role as communicating risk clearly, documenting exceptions, and then supporting the organization’s decision. He urged leaders to trust their experts: “If I’m the smartest security person at that table, we got a problem.”
4. Protect the data, not just the walls
Steve contrasted traditional “castle defense” with data-centric security, where information moving between cloud, partners, and AI tools stays protected everywhere it travels. James tied this to the lean operations many organizations run: at machine speed, attackers need only “one hole in the boat.” If you can’t map every data connection, how do you know anything is truly sandboxed?
5. Start with the problem, not the tool
Steve warned against asking “what could we use AI to do?” and instead starting from a real need. His reasoning: “If you don’t know what you’re doing, neither is the AI.” When pitching a project, make the case to your board in both financial and human terms.
Governance: Define what data AI agents can access and what privileges they hold, and audit access already granted. James pointed to OWASP guidance on AI agents and the NIST AI Risk Management Framework as starting points.
Smaller organizations: Start with your regulatory requirements, such as HIPAA, and use vendors and BAAs to share the load. You stay accountable, but you don’t have to do it all in house.
For clinicians: “Please don’t make AI the next Wikipedia.” Validate output against input, remember AI can hallucinate, and as Steve put it, “don’t be afraid to ask why.”
Joe’s challenge to attendees: pick one conversation or decision from this discussion and move it forward with your team this week.
Keep the conversation going
Join as a chapter member, or as a premium HIMSS member for access to HIMSS National content plus local programming. Already a member? Bring a colleague to our next event.
0 Comments