Skip to content

Your Chief AI Officer Daily Brief

What AI and robotics can do this week, for the Compliance, privacy and legal.

Regulation, consent, liability, privacy, audit and what has to be documented. Every item below carries a line written for this seat. Subscribe and the weekday brief arrives ordered for it.

Announced1 sourceFor patients and employeesWednesday, November 11, 2026

Chief AI Officer CISO CIO and CTO Compliance

Microsoft shows agent models can be backdoored by editing fewer than ten neurons

Microsoft Research released threat research showing that a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject a short payload. Microsoft also found that frontier agents can detect the threat by identifying anomalous weight edits.

Do this week. Add model provenance and weight integrity checks to the contract and intake review for every fine-tuned or open-weight model running in your environment. Run this

The claim.: Microsoft says the sleeper agent threat is detectable by frontier agents, which can identify anomalous weight edits.
The evidence.: This is Microsoft's own research, and no independent replication is cited.

For the Chief AI Officer. List every model in production with its origin and who could have modified its weights, and brief the board on the gaps.

For the CISO and security. Add weight tampering to the AI threat model and ask vendors how they verify model integrity before and after deployment.

Disclosure at publication: Ecofy is in the Microsoft partner program; Microsoft is one of the platforms it implements for clients.

Read the full item

Sources:Microsoft Security Blog

Reported1 sourceFor patients and employeesWednesday, November 11, 2026

Chief AI Officer CMO (medical)Compliance CEO

AMA adopts policy that AI cannot be licensed as a physician

The American Medical Association House of Delegates approved a policy on Nov. 9 at its Interim Meeting saying AI cannot be granted physician licensure, professional titles or certification to practice medicine, Becker's reports. The policy calls for AI-enabled tools to be integrated into physician-led teams and used at the direction of physicians. Becker's reports that it also pushes for vendor liability.

Do this week. Review clinical AI vendor contracts for how liability is allocated, and confirm that each tool has a named physician owner. Run this

The claim.: The AMA says AI-enabled tools should operate within physician-led teams and at the direction of physicians.
The evidence.: This is a professional association policy position, not a law or regulation.

For the Compliance, privacy and legal. Flag contracts that put liability entirely on the organization and renegotiate at renewal.

For the Chief AI Officer. Map each clinical AI tool to a supervising physician role in the governance register.

For the Chief Medical Officer and physicians. Confirm medical staff policy states who directs and signs off on AI-assisted decisions.

Read the full item

Sources:Becker's Hospital Review

Regulatory3 sourcesFor patients and employeesTuesday, November 10, 2026

Chief AI Officer CFO Compliance CNO

CMS delays end of third-party remote monitoring payments until 2029

CMS is delaying the end of Medicare payments for third-party remote patient monitoring services until 2029, after outcry from the virtual care industry, Healthcare Dive reports. Physicians Practice reports the 2027 fee schedule also carries pay cuts that groups say need congressional action, and speech-language therapy billing changes Jan. 1. Medical Economics reports medical groups want a permanent Medicare pay fix.

Do this week. Review third-party remote monitoring contracts and model 2027 revenue with the payment delay and the fee schedule pay cuts included. Run this

The claim.: Medical group and internal medicine leaders say the pay cuts require a permanent congressional fix, per Medical Economics and Physicians Practice.
The evidence.: The delay to 2029 is reported by Healthcare Dive and Physicians Practice from the 2027 Medicare Physician Fee Schedule.

For the Compliance, privacy and legal. Document which remote monitoring services rely on third-party staff so billing stays aligned with the delayed rules.

For the Chief AI Officer. Keep remote monitoring AI and vendor programs in the portfolio through 2029 planning rather than winding them down.

For the CFO and revenue cycle. Rebuild the 2027 Medicare forecast with the pay cuts and the remote monitoring payment timeline.

Read the full item

Sources:Healthcare Dive Physicians Practice Medical Economics

Announced2 sourcesFor employees and patientsTuesday, November 10, 2026

Chief AI Officer CISO CIO and CTO Compliance

Clear adds identity verification for outside providers and controlled-substance prescribing in Epic

Clear has launched two integrations with Epic, making its CLEAR1 identity platform available through Epic Toolbox for EpicCare Link and electronic prescribing of controlled substances, Becker's Hospital Review reports. The integrations let health systems verify outside providers accessing patient records and clinicians prescribing controlled substances. HIT Consultant reports it includes self-service onboarding for community providers in EpicCare Link.

Do this week. Audit how outside users of your EpicCare Link instance are identity-proofed today and decide whether in-workflow verification closes a gap. Run this

The claim.: Clear says the integrations eliminate manual administrative steps by embedding identity proofing in Epic workflows, per HIT Consultant.
The evidence.: No independent evidence on security or time outcomes exists yet; the information comes from the company's Nov. 9 release.

For the Chief AI Officer. Add identity verification of external and AI-adjacent users to the governance checklist for Epic-connected tools.

For the CISO and security. Inventory community provider accounts in EpicCare Link and their proofing method to size the outside-access risk.

Disclosure at publication: Ecofy orchestrates Epic for clients and says so on every item that names it. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Becker's Hospital Review HIT Consultant

Reported2 sourcesFor patients and employeesMonday, November 9, 2026

Chief AI Officer CISO Compliance CHRO

Hoag and Delta Dental of Missouri face separate data incidents

Hoag Memorial Hospital Presbyterian is notifying individuals of a cybersecurity incident that may have exposed personal and protected health information; it discovered suspicious network activity Oct. 8, according to a Nov. 4 notice filed with the California attorney general's office (Becker's Hospital Review). Separately, dark web monitoring sites Ransomware.live and HookPhish posted that the n0n group was responsible for a suspected breach at Delta Dental of Missouri reportedly on Nov. 5, with member names and Social Security numbers among the data reportedly exposed (Becker's Dental Review).

Do this week. Confirm whether any of your patients or employees are covered by Delta Dental of Missouri and test your own breach notification playbook against these timelines. Run this

The claim.: The n0n group claimed responsibility for the Delta Dental of Missouri incident, per dark web monitoring sites.
The evidence.: Hoag's account rests on its filing with the California attorney general; the Delta Dental claim rests on dark web postings and has not been confirmed in the source.

For the Compliance, privacy and legal. Check that state attorney general notice requirements are mapped for every state where you hold patient data.

For the Chief AI Officer. Use both incidents to confirm that AI vendors holding patient data are covered by the incident response plan.

For the CISO and security. Review detection-to-notification time against Hoag's Oct. 8 discovery and Nov. 4 filing.

Read the full item

Sources:Becker's Hospital Review Becker's Dental Review

Reported2 sourcesFor patients and employeesThursday, November 5, 2026

Chief AI Officer CISO Compliance CNO

Staff at two Washington state facilities drafted patient notes in personal ChatGPT

A staff member at a Washington state-run mental health facility used a personal ChatGPT account to draft patient notes, and a similar incident occurred at a second state facility, potentially exposing the protected health information of 16 patients, The Seattle Times reported, per Becker's Behavioral Health. One facility named is Lake Burien Transitional Care Facility, which treats youth. Separately, a report covered by Cybersecurity Dive found shadow AI remains a persistent problem even as IT and security budgets grow.

Do this week. Inventory which generative AI sites clinical staff can reach from work devices this week, and pair any block on personal accounts with an approved, contracted documentation tool. Run this

The claim.: The Cybersecurity Dive report says shadow AI persists despite rising IT and security budgets.
The evidence.: The Seattle Times reporting, via Becker's Behavioral Health, documents two incidents and 16 patients potentially affected; no data on how common this is across health organizations is given.

For the Compliance, privacy and legal. Confirm the policy on generative AI use with PHI is written, trained and attested, and that the breach assessment process covers this scenario.

For the Chief AI Officer. Treat unmet demand for note drafting as a portfolio signal and put an approved tool in front of the staff most likely to reach for a personal account.

For the CISO and security. Add web and DNS controls on consumer AI endpoints from clinical workstations and log attempts to see where the demand is.

Disclosure at publication: Ecofy orchestrates OpenAI for clients and says so on every item that names it. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Becker's Behavioral Health Cybersecurity Dive

Reported1 sourceFor employees and patientsThursday, November 5, 2026

Chief AI Officer CIO and CTO Compliance

HHS cut 14 EHR certification rules, and the checklist shrinks Dec. 28

The federal certification checklist behind practice EHRs shrinks on Dec. 28 after HHS cut 14 EHR certification rules, Physicians Practice reported. The article advises practices to lock down EHR contracts, MIPS reporting and referral workflows while they have leverage.

Do this week. Review your EHR contract for capabilities that relied on the removed certification criteria and get commitments in writing before Dec. 28. Run this

The claim.: Physicians Practice says practices have leverage now to protect contract terms, MIPS reporting and referral workflows.
The evidence.: The change is reported by Physicians Practice; no data yet on how vendors will respond.

For the Compliance, privacy and legal. Confirm MIPS reporting will not be disrupted by the change.

For the Chief AI Officer. Check which AI tools depend on EHR interfaces that were certification requirements and confirm they stay supported.

For the CIO and CTO. Ask the EHR vendor to confirm in writing which affected functions it will keep.

Read the full item

Sources:Physicians Practice

Regulatory2 sourcesFor patients and employeesWednesday, November 4, 2026

Chief AI Officer Compliance CIO and CTO

HHS health IT certification rollback shifts AI evaluation to health systems

HHS is rolling back several health IT certification requirements, which could cut certification costs for developers, MedCity News reports. The outlet says hospitals and health systems may be left with more responsibility for evaluating the safety and performance of the AI tools they buy. A guest article in Healthcare IT Today by Dr. Michael T. Neely argues validation should not be a one-time gate because vendors update AI tools frequently.

Do this week. Write vendor contract terms requiring notice and revalidation whenever a purchased AI tool's model or logic changes. Run this

The claim.: MedCity News says oversight responsibility moves toward buyers; Neely argues clinical AI needs version control.
The evidence.: No data yet on how health systems are absorbing the evaluation work; the Neely piece is opinion.

For the Compliance, privacy and legal. Document who approved each AI tool version and when, so the organization can show its own evaluation.

For the Chief AI Officer. Stand up a post-purchase monitoring and version-tracking process for every clinical AI tool in production.

Read the full item

Sources:MedCity News Healthcare IT Today

Announced2 sourcesFor patients and employeesTuesday, November 3, 2026

Chief AI Officer CMO (medical)Compliance Patient experience

athenahealth launches a server connecting patient records to Anthropic's Claude

athenahealth on Nov. 2 launched athenaPatient MCP, a server built on the open Model Context Protocol. It lets patients connect their official health record directly to Anthropic's Claude (Becker's, HIT Consultant). The stated aim is conversational interpretation grounded in verified clinical history.

Do this week. Decide how your practice will answer patients who arrive having discussed their own records with Claude, and brief front-line clinicians before those visits start. Run this

The claim.: athenahealth says the integration enables conversational interpretation grounded in verified clinical history.
The evidence.: No independent evidence on patient outcomes or accuracy exists yet; both sources describe the launch.

For the Compliance, privacy and legal. Review what patient-directed data sharing to a third-party AI means for your notices and patient education.

For the Chief AI Officer. Add patient-initiated AI access to records to your governance inventory and set a position on MCP connections before patients ask.

For the Chief Medical Officer and physicians. Prepare physicians for visits where patients bring AI-generated interpretations of their own charts.

For the Patient experience. Draft plain answers for the contact center on what the connection does and who supports it.

Disclosure at publication: Ecofy orchestrates Anthropic for clients and says so on every item that names it. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Becker's Hospital Review HIT Consultant

Reported1 sourceFor patients and employeesTuesday, November 3, 2026

Chief AI Officer Compliance CMO (medical)CEO

AMA assigns liability for clinical AI to vendors and health systems as well as physicians

In a new issue brief, the AMA assigns physicians, AI developers and healthcare organizations distinct responsibilities for clinical AI, Healthcare Dive reported. The AMA argues protecting patients requires all stakeholders to be accountable.

Do this week. Map each clinical AI contract against the AMA's split of responsibilities and close gaps in vendor indemnity and oversight duties. Run this

The claim.: The AMA argues all stakeholders, not only physicians, must be accountable for clinical AI.
The evidence.: This is a policy position in an issue brief, not a court ruling or regulation.

For the Compliance, privacy and legal. Review indemnification and monitoring clauses in AI vendor contracts against the brief.

For the Chief AI Officer. Document organizational oversight duties for each clinical AI tool in your governance record.

Read the full item

Sources:Healthcare Dive

Reported2 sourcesFor patientsMonday, November 2, 2026

Chief AI Officer CMO (marketing)Compliance Patient experience

Pew finds 46% of Americans oppose AI in insurance claim decisions

A Pew Research Center survey published Oct. 29 found nearly half of U.S. adults oppose AI playing any role in health insurance claim decisions, according to Becker's Payer Issues. The survey of 3,488 adults, conducted in June, tested openness to AI across eight healthcare tasks. Separately, Healthcare IT Today reported that 91% of patients want their permission required when AI is used for diagnosis.

Do this week. Review where your organization discloses AI use to patients and members, starting with claims and diagnosis, and close the gaps. Run this

The evidence.: The Pew survey of 3,488 adults, as reported by Becker's, found 46% oppose any AI role in claim decisions; no independent evidence ties disclosure practices to trust outcomes yet.

For the Compliance, privacy and legal. Inventory current consent language against AI use in diagnosis and claims and flag where permission is not sought.

For the Chief AI Officer. Add patient disclosure and consent to the AI governance checklist for any tool touching claims or diagnosis.

For the Chief Marketing Officer. Prepare plain-language explanations of how AI is and is not used, so patients hear it from you rather than from a denial letter.

For the Patient experience. Brief contact center staff on how to answer patient questions about AI in claims and care decisions.

Read the full item

Sources:Becker's Payer Issues Healthcare IT Today

Announced1 sourceFor patients and employeesMonday, November 2, 2026

Chief AI Officer CMO (marketing)Compliance

OpenAI will honor a shared robots.txt signal for AI training preferences

OpenAI announced it will honor a shared robots.txt signal that lets website operators communicate their AI training preferences to participating providers.

Do this week. Decide whether your organization's patient education and clinical content should be available for AI training and set the robots.txt signal accordingly. Run this

The claim.: OpenAI says the signal helps website operators communicate training preferences to participating providers.
The evidence.: This is a company announcement; no independent evidence of adoption is available yet.

For the Compliance, privacy and legal. Document the decision on training preferences alongside existing website terms.

For the Chief AI Officer. Set an organizational position on AI training use of public content and record it in governance policy.

For the Chief Marketing Officer. Weigh whether having your patient content in AI training helps patients find accurate answers or weakens control of your voice.

Disclosure at publication: OpenAI is one of the enterprise AI platforms Ecofy implements for clients.

Read the full item

Sources:OpenAI News

Reported2 sourcesFor patients and employeesMonday, November 2, 2026

Chief AI Officer CFO Compliance

Draft PATIENT AI Act would clarify FDA or ONC oversight and add AI payment pathway

Sen. Bill Cassidy released a discussion draft of the PATIENT AI Act, proposing to clarify whether FDA or ONC oversees healthcare AI tools and to create a federal payment pathway for AI-based services, according to Becker's Hospital Review. Separately, STAT reported that FDA and CMS officials are working to head off conflict as more states look to test AI in clinical settings.

Do this week. Map which of your AI tools would fall under FDA versus ONC oversight and which could qualify for a payment pathway, so you can respond to the draft. Run this

The claim.: The draft proposes to clarify oversight and create a payment pathway for AI-based services.
The evidence.: This is a discussion draft, not law; no outcomes exist.

For the Compliance, privacy and legal. Track the draft and state sandbox developments in the regulatory calendar.

For the Chief AI Officer. Classify the AI portfolio by likely regulator so the organization can comment on the draft with specifics.

For the CFO and revenue cycle. Identify AI services whose business case would change if a federal payment pathway existed.

Read the full item

Sources:Becker's Hospital Review STAT Health Tech

Announced1 sourceFor patients and employeesFriday, October 30, 2026

Chief AI Officer Compliance CMO (medical)

AMA releases framework assigning liability when clinical AI harms patients

The American Medical Association released a framework on Oct. 29 that aligns liability for clinical AI harm with each party's authority and ability to prevent or mitigate it, Becker's reported. The AMA Center for Digital Health and AI said existing frameworks were not built for tools that physicians, developers and organizations each partly control.

Do this week. Map each clinical AI tool in production to who controls its configuration, monitoring and override, and check that vendor contracts reflect that split. Run this

The claim.: The AMA says responsibility should follow authority and the ability to prevent harm.
The evidence.: This is a policy framework from a professional association, not law or case precedent.

For the Compliance, privacy and legal. Review indemnification and monitoring clauses in AI vendor agreements against the framework before renewals.

For the Chief AI Officer. Add a responsibility owner for each AI tool to the governance register using the AMA's control-based logic.

Read the full item

Sources:Becker's Hospital Review

Reported2 sourcesFor patients and employeesFriday, October 30, 2026

Chief AI Officer CMO (medical)CNO Compliance

Doximity research finds general AI models err on medication doses

Clinical AI company Doximity released research showing popular general-use AI models get medication doses wrong, some dangerously, and that its own dose verification tool performed better, Healthcare Dive reported. Separately, a family has sued OpenAI over ChatGPT advice on an epilepsy drug taper, Medical Economics reported.

Do this week. Issue clear guidance to clinicians on which AI tools are approved for dosing questions and require pharmacist or reference verification for any AI-suggested dose. Run this

The claim.: Doximity says its dose verification tool outperformed general-use models, which it describes as rife with errors.
The evidence.: The research comes from a vendor comparing its own product and has not been described as peer reviewed; the lawsuit is an allegation, not a finding.

For the Compliance, privacy and legal. Document the policy on clinician use of consumer AI so the organization can show reasonable controls.

For the Chief AI Officer. Confirm the approved-tools list covers dosing use cases and blocks or flags unapproved chatbots on clinical devices.

For the Chief Medical Officer and physicians. Remind prescribers that general chatbots are not dose references and route questions through verified sources.

For the CNO and nursing. Reinforce that nurses should not act on AI-generated dose information without the standard verification step.

Disclosure at publication: Ecofy orchestrates OpenAI for clients and says so on every item that names it. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Healthcare Dive Medical Economics

Reported2 sourcesFor patientsFriday, October 30, 2026

Chief AI Officer CISO CIO and CTO Compliance

Oracle Health breach count rises to nearly 20 million as systems move to Epic

The number of people affected by Oracle Health's 2025 data breach rose to nearly 20 million, while two large health systems moved hospitals from its EHR to Epic's, Becker's reported. Oracle also spent October pitching its AI to hospitals that run Epic, and HIStalk reported Larry Ellison's AI platform remarks at Oracle AI World.

Do this week. Ask every EHR and hosting vendor for its breach notification terms, legacy data retention and access logging, and confirm your incident plan covers a vendor-side breach. Run this

The claim.: Oracle's Larry Ellison says AI will let Oracle build a platform connecting care, research, insurance and public health.
The evidence.: Becker's reports the breach count; no independent assessment of Oracle's remediation has been published.

For the Chief AI Officer. Weigh vendor security history in any decision to add AI modules from an EHR vendor.

For the CISO and security. Inventory legacy or migrated data held by EHR vendors and verify it is encrypted, logged and scheduled for deletion.

Disclosure at publication: Oracle Health and Epic are among the platforms Ecofy orchestrates for clients.

Read the full item

Sources:Becker's Hospital Review HIStalk

Regulatory2 sourcesFor patients and employeesFriday, October 30, 2026

Chief AI Officer Compliance CIO and CTO

HHS finalizes rule cutting health IT certification requirements

HHS finalized a rule on Oct. 26 cutting health IT requirements, Becker's reported. On Raising Health, National Coordinator Dr. Tom Keane said HTI-5 proposes removing the AI model card requirement, noting Oracle reported about two queries a month and Epic about 50 queries per month.

Do this week. Write AI transparency requirements into your own vendor contracts so model details no longer depend on EHR certification. Run this

The claim.: Keane said the model cards offered false assurance because nothing was audited.
The evidence.: The rule is reported by Becker's; the query figures were stated by Keane on a podcast, not published data.

For the Compliance, privacy and legal. Update governance documentation that cited certification model cards as a control.

For the Chief AI Officer. Build a standard AI transparency questionnaire for vendors, requested under NDA if needed.

Disclosure at publication: Ecofy orchestrates Epic and Oracle Health for clients and says so on every item that names them. The item was selected and checked by the same rules as every other.

Read the full item

Sources:Becker's Hospital Review Raising Health

Reported2 sourcesFor patients and employeesThursday, October 29, 2026

Chief AI Officer CMO (medical)Compliance CMO (marketing)

OpenAI sued over epilepsy death after ChatGPT allegedly advised drug taper

The parents of a 31-year-old Seattle woman with epilepsy filed a wrongful death suit against OpenAI and Sam Altman on Oct. 27 in San Francisco County Superior Court, Becker's reported. The complaint alleges she stopped antiseizure medication on a schedule ChatGPT designed. MedPage Today also covered the filing.

Do this week. Add a line to patient education and after-visit materials telling patients to confirm any medication change suggested by a chatbot with their care team. Run this

The claim.: The plaintiffs allege ChatGPT told the patient to stop taking her seizure medication; the allegations have not been tested in court.
The evidence.: Two outlets report the filing; no court finding exists.

For the Compliance, privacy and legal. Review whether any patient-facing AI you deploy can give dosing or taper instructions and document the guardrails.

For the Chief AI Officer. Brief the board that patients already use consumer chatbots for medication decisions and set a policy for how clinicians ask about it.

For the Chief Medical Officer and physicians. Ask clinicians to add chatbot use to medication reconciliation questions for patients on high-risk drugs.

Read the full item

Sources:Becker's Hospital Review MedPage Today

Reported1 sourceFor employees and patientsThursday, October 29, 2026

Chief AI Officer CFO CMO (medical)Compliance

CMS mandatory Ambulatory Specialty Model starts Jan. 1, 2027 as groups seek delay

The CMS Ambulatory Specialty Model, finalized in the CY 2026 physician fee schedule, ties specialists' Medicare Part B pay to how they manage chronic conditions and starts Jan. 1, 2027, Becker's ASC Review reported. A coalition of provider groups is asking CMS to delay or soften it.

Do this week. Confirm which of your specialists fall under the model and assign an owner to the chronic condition measures before launch. Run this

The claim.: Provider groups in the coalition say the model should be delayed or softened.
The evidence.: The start date comes from CMS's finalized rule as reported; no change to it has been announced.

For the Compliance, privacy and legal. Plan to the Jan. 1, 2027 date unless CMS formally changes it.

For the Chief AI Officer. Check whether existing analytics or AI tools can report the measures the model uses.

For the CFO and revenue cycle. Model the Part B payment exposure for affected specialists under current performance.

For the Chief Medical Officer and physicians. Brief specialists on the chronic condition management expectations tied to their pay.

Read the full item

Sources:Becker's ASC Review

Opinion4 sourcesFor patients and employeesWednesday, October 28, 2026

Chief AI Officer CMO (medical)Compliance

JAMA letters debate guardrails for advertising inside AI decision support tools

Letters in JAMA respond to a Singh and Mello Viewpoint warning that advertising in AI clinical decision support can influence care. One proposes a clinical query firewall; another compares free tools to past drug company giveaways. The authors reply that ending the practice altogether is unlikely.

Do this week. Inventory free or ad-supported AI decision support tools clinicians use and set a policy on which are permitted. Run this

The claim.: The letter writers argue commercial interests can shape medical judgment through ad-supported AI tools, and that clinical queries need protection.
The evidence.: These are opinion letters in JAMA; no study of patient impact is cited.

For the Compliance, privacy and legal. Review whether clinician queries containing patient details flow to advertisers under tool terms.

For the Chief AI Officer. Add ad-supported tools and query data use to AI vendor review criteria.

For the Chief Medical Officer and physicians. Ask physicians which free AI search tools they use and whether they show sponsored content.

Read the full item

Sources:JAMA JAMA JAMA JAMA

Reported1 sourceFor patients and employeesTuesday, October 27, 2026

Chief AI Officer Compliance CISO CFO

AI usage caps push staff toward free chatbots without business associate agreements

Medical Economics reports that as AI vendors tighten token and credit caps, staff who hit the limit may turn to free chatbots, exposing patient data to vendors with no business associate agreement. The article sets out eight steps practices can take to stay protected.

Do this week. Check current usage against your AI contract caps and publish an approved fallback tool so staff never need a free chatbot mid-shift. Run this

The claim.: The article argues usage caps create a direct path to shadow AI and HIPAA exposure.
The evidence.: This is a reported risk analysis from one outlet; no incidence data on cap-driven shadow AI exists yet.

For the Compliance, privacy and legal. Remind staff in writing which tools are covered by a business associate agreement and which are not.

For the Chief AI Officer. Add usage-cap monitoring to vendor reviews and size licenses to real demand.

Read the full item

Sources:Medical Economics

Reported1 sourceFor patients and employeesMonday, October 26, 2026

Chief AI Officer Compliance CISO CHRO

Johns Hopkins Bayview notifies 3,182 patients after upload to unapproved AI tool

Johns Hopkins Bayview Medical Center is notifying about 3,182 patients that their information may have been compromised after a workforce member uploaded a spreadsheet containing patient data to a public AI tool the hospital had not approved, according to an Oct. 23 news release reported by Becker's.

Do this week. Confirm this week that staff have an approved AI tool for routine work and that public AI sites are covered by data loss prevention rules for patient data. Run this

The claim.: Johns Hopkins describes the upload as a mistake by a workforce member.
The evidence.: Becker's reports the incident from the hospital's own release; no regulator finding has been published.

For the Compliance, privacy and legal. Review breach notification procedures for AI-related disclosures and update the acceptable use policy to name public AI tools.

For the Chief AI Officer. Publish a short list of approved AI tools and the data each may receive, so staff have a sanctioned path.

Read the full item

Sources:Becker's Hospital Review

Reported1 sourceFor patientsMonday, October 26, 2026

Chief AI Officer CFO COO Compliance

Proposed federal rule could reduce Medicare remote patient monitoring access

A proposed federal rule could dramatically reduce access to remote patient monitoring programs for people on Medicare, KFF Health News reported. The services give patients home devices intended to keep them out of the hospital; critics cited by KFF say oversight has been insufficient.

Do this week. Have finance model your remote monitoring revenue under the proposed rule and identify which patients and programs would be affected. Run this

The claim.: Program advocates say monitoring keeps patients out of the hospital; critics say oversight is lacking.
The evidence.: KFF Health News reports the rule is proposed, not final.

For the Chief AI Officer. Review whether AI tools that triage monitoring data still justify their cost if program volume shrinks.

For the CFO and revenue cycle. Quantify exposure by program and payer before budget season closes.

Read the full item

Sources:KFF Health News

Reported1 sourceFor employeesMonday, October 26, 2026

Chief AI Officer CHRO Compliance

New Jersey bill would extend health benefits to public workers displaced by AI

A New Jersey bill that advanced in the state Senate on Oct. 1 would require at least one year of health coverage for public employees who lose jobs when agencies use vendor AI tools that evaluate or monitor workers, Becker's Payer Issues reported.

Do this week. Draft a workforce transition plan for roles your AI deployments will change, covering redeployment, training and benefits. Run this

The evidence.: The bill has advanced but is not law; it applies to public employees.

For the Compliance, privacy and legal. Track state bills on AI tools that evaluate or monitor workers, especially for public and academic employers.

For the Chief AI Officer. Include workforce impact in every AI business case, not only cost savings.

For the CHRO. Map which roles automation touches and set redeployment paths before tools go live.

Read the full item

Sources:Becker's Payer Issues

Reported2 sourcesFor patients and employeesSunday, October 25, 2026

Chief AI Officer CISO Compliance Patient experience

PHP2Shell website flaw and Quest Diagnostics breach land in the same week

Medical Economics and Physicians Practice report a critical flaw in widely used website code, called PHP2Shell, and a breach of a Quest Diagnostics lab portal. Both outlets frame the response as patch, verify and document.

Do this week. Confirm with your web host and vendors that PHP2Shell is patched on every patient-facing site, and document what you told patients about the Quest portal breach. Run this

The claim.: Physicians Practice advises practices to patch, verify and document their response to both incidents.
The evidence.: Two trade outlets report both incidents; neither summary gives a count of affected organizations or patients.

For the Compliance, privacy and legal. Record your assessment of whether the Quest portal breach involves your patients and whether any notice obligations follow.

For the CISO and security. Run a scan of all public websites, including those managed by marketing agencies, for the PHP2Shell flaw and require written patch confirmation.

For the Patient experience. Give front desk and contact center staff a short script for patients asking about the Quest breach.

Read the full item

Sources:Medical Economics Physicians Practice

Opinion1 sourceFor employeesSunday, October 25, 2026

Chief AI Officer Compliance CHRO CIO and CTO

Doctors avoid their own EHR over colleague access to mental health records

An article in MedCity News argues that default EHR access models were built for patient care, not for protecting colleagues. A nurse on another unit, a former co-resident or a department administrator may technically be able to open a clinician's record, which the author says leads physicians to seek care outside their own system.

Do this week. Audit who can open employee-patient records in your EHR and consider restricting and monitoring access to staff mental health records. Run this

The claim.: The author argues that access defaults discourage clinicians from seeking mental health care in their own system.
The evidence.: The piece is an argument; no data on avoidance rates is cited in the summary.

For the Compliance, privacy and legal. Run an access report on employee records and confirm break-the-glass alerts fire on inappropriate views.

Read the full item

Sources:MedCity News