Managing AI Before It Manages You – The HSCC AI Framework – Ep 565 

Healthcare is rushing to adopt AI, but most organizations haven’t figured out what it really means to keep it in check. The HSCC just released an AI governance framework aimed at helping healthcare leaders get ahead of the curve—before “shadow AI” and unapproved tools turn into a bigger problem. This episode breaks down why AI governance isn’t just IT’s job, where most organizations are getting stuck, and the surprisingly simple questions privacy and compliance teams should be asking about AI before things go sideways.

In this episode:

Managing AI Before It Manages You – The HSCC AI Framework – Ep 565

Today’s Episode is brought to you by:

Kardon

and

HIPAA for MSPs with Security First IT

 Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity. 

Great idea! Share Help Me With HIPAA with one person this week!

Learn more about Kardon Club and HIPAA for MSPs!

Thanks to our donors. We appreciate your support!

If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com

Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA

Episode Roadmap

Managing AI Before It Manages You – The HSCC AI Framework

We’ve talked several times about the work coming out of the HSCC AI Task Groups. Recently we covered the Third-Party AI Risk and Supply Chain Transparency Guide. Now we have the new AI Cyber Governance Framework Implementation Guide. And there is another operational playbook currently working its way through review.

One thing worth highlighting is that this isn’t a one-and-done effort. The healthcare sector continues to build practical guidance for itself through the efforts of the HSCC CWG. Rather than waiting for someone else to tell us exactly how to govern AI, provider organizations, technology companies, security leaders, privacy professionals, and clinical leaders are collaborating to build frameworks that healthcare organizations can actually use.

The interesting thing about this guide is that it starts with a simple question:

How do you safely govern something that is increasingly making recommendations, taking actions, and becoming part of patient care?

Before we get into the security and privacy pieces, we need to understand what governance actually means.

“Effective AI Governance transforms AI from a technical challenge into a strategic asset.”

Health Industry AI Cybersecurity Governance Framework Implementation Guide General information.

What Is Governance?

One of the better explanations in the document is that governance is not just cybersecurity. Governance is the collection of policies, processes, standards, oversight mechanisms, and accountability structures that guide how AI is developed, deployed, managed, monitored, and eventually retired. It is the system that determines whether an organization should use an AI system in the first place, who is accountable for it, how risks are managed, and how decisions get made when things go wrong.

A simple way to explain it:

• Cybersecurity asks: “Can we secure it?”
• Governance asks: “Should we use it, who owns it, who watches it, and what happens when it fails?”

That’s a distinction many organizations are still struggling with. Governance has to become a bigger conversation for SMBs with AI than it ever has with the introduction of other technologies. Especially ones in our sector. Healthcare, as always, has its own animal to tame.

Why Healthcare Is Different

This is where I would spend some time because it becomes the foundation for every other topic.

The guide identifies several unique healthcare challenges:

Patient safety: Unlike other industries, algorithm errors can directly affect patient outcomes. If Netflix recommends the wrong movie, nobody dies. If an AI system influences a clinical decision incorrectly, the consequences are very different.

Regulatory complexity: Healthcare organizations don’t just answer to one regulator. They are balancing HIPAA, FDA oversight, CMS requirements, state privacy laws, accreditation bodies, and more. AI gets dropped into the middle of all of that.

Clinical validation: Healthcare cannot simply ask whether the AI works technically. It also has to ask whether the recommendation makes clinical sense and actually improves care.

Resource disparities: The governance model has to work for both a rural critical access hospital and a large academic medical center. The HSCC report on resource limited entities laid out clearly just how wide that variation can be and it continues to grow.

Ethics and equity: Healthcare has to worry about fairness, bias, informed consent, and patient trust in ways many industries do not. Again, no one dies if there are failures like in most businesses. What does that really mean we need to face and how does governance matter in that equation?

Here is the bottom line……

If AI is becoming part of clinical operations, then eventually we have to stop treating it like software and start treating it more like a workforce member.

Shadow AI: The Problem You Already Have

Most organizations are focused on governing approved AI while employees are probably, often, likely already using unapproved AI tools every day.

Points:

• Difference between Shadow IT and Shadow AI
• Staff using ChatGPT, Copilot, Gemini, Claude, and embedded AI features
• AI capabilities appearing in products without a formal procurement process
• BYOD and personal device concerns
• Why inventory becomes the foundation of governance

Can you govern something if you don’t know it exists? I can’t protect something I don’t know I have.

Once you know where AI is being used, the next question becomes whether it’s simply making recommendations or actually taking actions.

Agentic AI: When AI Stops Advising and Starts Acting

The guide spends significant time on agentic AI because this is where risk changes dramatically.

• Difference between generative AI and agentic AI
• AI systems that can access records, trigger workflows, send messages, and make changes
• The concept of action capability versus decision capability
• Human approval gates
• The importance of kill switches and containment mechanisms
• Why “the blast radius” of an agentic AI failure is larger than a traditional AI failure

Think of it this way:

• A chatbot is an AI employee making suggestions to the humans doing the work.
• An agent is an AI employee with keys to the building and access to the payroll system.

How much authority are we willing to give these digital employees when they are onboarded? Who is going to monitor their work and give them “reviews” to keep up with things that may change without you even knowing it.

Even if your AI behaves perfectly, what happens when the systems behind it fail? Oh, yeah we will really have to think like there is no box on that one.

AI Supply Chain Risk: The Vendor Behind the Vendor Behind the Vendor

Healthcare organizations often know their AI vendor but not the ecosystem supporting that vendor. We talked about this issue long before AI became the super star of the show. As we move forward how much will we be allowed to understand how they are using these tools and new “employees”?

• Foundation models – what is the real backend
• Cloud providers
• Data providers
• API dependencies
• Fourth-party and nth-party risk
• AI Bill of Materials (AIBOM)
• Concentration risk

Interesting Example:

You are using 5 different AI products:

1. A clinical documentation solution
2. A coding assistant
3. A patient chatbot
4. A revenue cycle product
5. A physician support tool

Five different vendors may all depend on the same underlying model provider. So what you really have is

1. Open AI
2. Open AI
3. Open AI
4. Open AI
5. Open AI

If one foundation model has an outage tomorrow, how many of your critical systems go down at once?

What Happens When Your AI Employee Calls In Sick?

The guide repeatedly emphasizes dependency assessment, manual fallback procedures, and business continuity.

• AI dependency assessments
• Workflow criticality
• Manual fallback procedures
• Annual testing of fallback plans
• Cascading failures between AI systems
• Recovery time objectives

The Most Interesting Topic:

The ERCI report we covered a while back mentioned a specific concern about AI creating skill atrophy specifically in healthcare. They suggested there must continue to be critical thinking work done to prevent that from happening.

• What happens when staff rely on AI for years?
• Can they still perform the task manually?
• Are we creating the same dependency that GPS created for navigation?
• If your documentation assistant disappeared tomorrow, what happens?
• If your coding AI went offline for a week, could operations continue?
• Have we become too dependent on systems we don’t fully control?

And what if the AI doesn’t disappear but starts behaving badly?

AI Incident Response Is Different Than Traditional Incident Response

Most organizations have ransomware plans. Few, very few, have AI incident response plans.

Different incident categories:

• Model failure
• Performance degradation
• Data poisoning
• Prompt injection
• Privacy leakage
• Agentic AI unauthorized actions
• Supply chain compromise

If OpenAI, Anthropic, Google, or another major foundation model provider had a significant outage tomorrow, how many healthcare applications inside your organization would suddenly stop working?

The Blast Radius Concept:

Instead of asking: “What systems were affected?”

When AI is involved you must ask:

• Which patients were affected?
• Which decisions were influenced?
• How long was the model wrong?
• Do prior clinical decisions need review?

Interesting Comparison:

• Ransomware recovery focuses on restoring systems.
• AI incident recovery may require rebuilding trust in decisions already made.

All of this becomes even more complicated when the “users” aren’t people. How do you investigate an incident where the AI wasn’t hacked but simply started making bad decisions?

The Rise of Non-Human Identities

AI creates thousands of new digital identities. It may even create some on its own.

• Service accounts
• API keys
• OAuth tokens
• Machine identities
• AI agents acting on behalf of users

Organizations may soon have more AI identities than human identities. Definitely the case in the smaller environments.

• Least privilege matters more than ever when assigning it to AI agents
• Credential rotation
• Attribution and audit trails
• Preventing AI systems from escalating their own privileges

Question:

If an AI agent accesses a record or takes an action, who is accountable? What happens when that kicks out on the audit report from SPHER or one of the other tools like it?

This brings us back to the reason we have governance and why it is so important to think holistically in the organization when it comes to governance.

Governance Is Really About Accountability

Governance isn’t about whether the AI is smart. Governance is about making sure humans remain responsible when the AI inevitably does something unexpected.

Key Takeaways:

• Governance is not about slowing innovation
• Governance is not just cybersecurity
• Governance is accountability for AI decisions and actions
• Healthcare’s challenge is bigger because patient safety is involved

For years we’ve treated AI as a tool. This framework guide assumes AI is becoming a participant in healthcare operations. The question isn’t whether AI will be part of healthcare.

We have talked repeatedly about how Agentic AI allows us to create independent thinking entities within the computer systems. Like David shared with his two employees Ava and Hal. Healthcare is moving from AI as a tool to AI as a participant in operations like everyone else. Governance is how we make sure we remain in charge.

Get your copy of the Health Industry AI Cyber Governance Framework Implementation Guide today and just take a few minutes to review parts of it every day for a week. Then, decide what you can take from it and do ASAP to get your program on track – it will never get easier than it is today. Every day will make it harder to inventory what is in use. Every day you don’t have a process for approving tools and how they are used the worse your problem will become.

AI isn’t just the latest gadget to add to your tech stack—it’s now part of the workforce, bringing new opportunities and some real challenges for healthcare organizations. Making sure you actually manage your AI tools (instead of letting them manage you) can make the difference when it comes to patient safety and compliance. This week’s episode unpacks what effective AI governance looks like for healthcare, why it matters, and how you can avoid a few AI headaches before they start. If you’re wondering where to start or just want practical ideas to take back to your team, the full conversation is worth a listen.

Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!

Special thanks to our sponsors Security First IT and Kardon.