I’ve been in IT long enough to recognize a pattern: organizations throw money at problems they don’t fully understand, hope something sticks, and call it progress. Healthcare is doing exactly that right now with cybersecurity, and the latest HIMSS report confirms what I’ve suspected for years—they’re spending more on tools while still missing the fundamentals.
The real problem isn’t that healthcare lacks security solutions. It’s that they lack governance. And now that AI is entering the picture, the gaps are widening faster than ever.
The Tool Trap
Healthcare organizations are investing heavily in security tools. Firewalls, endpoint detection, threat intelligence platforms, multi-factor authentication—you name it, they’re buying it. On paper, this looks like progress. Management gets to report that “security spending is up 23%” to their boards. Everyone feels better.
Here’s what I’ve learned after twenty-plus years in this field: buying better tools doesn’t fix broken processes.
A hospital can deploy the fanciest endpoint detection system on the market, but if nobody’s actually reviewing the alerts, it’s just expensive decoration. I’ve walked into organizations with six different security tools that don’t talk to each other, operated by people who don’t have time to understand what any of them actually do. It’s security theater with a six-figure price tag.
The real work—the unglamorous stuff—is governance. Who decides what gets protected? Who owns the data? Who’s responsible when something goes wrong? What’s the actual process for responding to an incident? These questions don’t have flashy vendor solutions. There’s no software that makes governance happen. It requires people, time, and decisions. That’s why it doesn’t get done.
AI Governance Is a Mess
Now healthcare is bringing AI into the mix, and they’re approaching it the same way: buy the tool, figure out the governance later.
AI systems in healthcare are handling sensitive data and making decisions that affect patient care. An AI model trained on real patient data can leak that data in ways nobody anticipated. An AI system making treatment recommendations can carry hidden biases. An AI tool integrating with your clinical systems can create new attack surfaces that your security team hasn’t even mapped yet.
And governance? Most healthcare organizations don’t have it for AI. They have:
- A vague hope that vendors know what they’re doing
- A legal team writing contracts that don’t address the real risks
- IT and clinical teams working in separate silos
- No clear answers to questions like: Who owns the AI model? Who’s responsible if it fails? What happens to the training data? How do we audit it?
I’ve seen hospitals deploy AI-powered diagnostic tools without anyone in the security department even knowing about it. Then, surprise, those tools are making network calls to external servers. That’s not a cybersecurity problem waiting to happen—that’s a cybersecurity problem already happening.
What Actually Needs to Change
Healthcare needs to stop treating security as a technology problem and start treating it as a governance problem. That means:
First, you need accountability. Not the “someone is in charge” kind of accountability. The “if the data gets stolen, this person’s name is on it” kind. Right now, responsibility gets spread so thin that nobody actually owns anything.
Second, you need to understand what you actually have. Most healthcare organizations can’t tell you where all their sensitive data lives. They definitely can’t tell you which AI systems are touching it. You can’t protect what you don’t know about.
Third, you need policies that actually work. Not policies written by consultants that sit in binders on a shelf. Policies that your teams use every day because they make sense and solve real problems.
For AI specifically, healthcare needs governance frameworks before deployment, not after. That means understanding what data trains the model, who can access it, how it gets audited, and what happens when it fails.
The HIMSS report shows that healthcare is moving in the right direction by investing in security. But investment without governance is just expensive flailing. Until someone decides to actually run the organization like it matters, all those security tools are just going to sit there, alerting into the void, while the real risks go unmanaged.
The tools are ready. The people aren’t. Fix that first.
Source: AI governance gaps threaten healthcare cybersecurity
Rachel Adams