AI in Hospitals: A Double-Edged Sword for Cybersecurity and Patient Care

Artificial intelligence (AI) is revolutionizing patient care in hospitals across the country, but this same technology is also becoming a powerful tool for cyberattackers. Karen Habercoss, chief information security and privacy officer at the University of Chicago Medicine, warns that hackers are using AI to automate and scale their attacks with unprecedented speed and precision.

"Healthcare remains the most attacked industry in the country," Habercoss said during a recent interview. The problem is compounded by the widespread use of legacy technology in many health systems, which cannot be replaced overnight. This older infrastructure poses significant risks, making it essential for organizations to focus on segmenting and isolating these systems to reduce vulnerability.

Navigating the AI Security Landscape

The complexity of third-party vendors further exacerbates the challenge. Many vendors are now integrating their own AI tools into healthcare products, which adds another layer of risk. Habercoss emphasizes that vendor oversight must be a continuous process, not a one-time checklist. "We audit our partners over time to ensure their security and privacy practices align with our standards," she explained.

To manage this increasingly complex web of risks, UChicago Medicine has developed a multilayered AI governance system over the past several years. This system includes a steering committee that oversees subcommittees focused on various aspects of AI management, such as intake, inventory, education and training, and auditing and monitoring. A separate cross-functional committee, co-chaired by Habercoss and the health system’s chief analytics officer, ensures a holistic approach to AI governance.

The importance of this governance structure cannot be overstated. As AI adoption accelerates, both in healthcare delivery and cybersecurity, the need for robust oversight becomes even more critical. HCA Healthcare, one of the largest hospital systems in the U.S., is also expanding its AI integration across hospitals to enhance patient care. Their goal is to redesign how care is delivered, allowing clinicians to focus on patients while technology supports doctors.

Why It Matters

The stakes are high when it comes to protecting patient data. Cyberattacks can lead to significant financial losses, legal liabilities, and, most importantly, compromised patient safety. The ethical implications of AI misuse in healthcare are profound. Patients must trust that their personal information is secure for the healthcare system to function effectively.

Habercoss stresses that balancing risk is crucial. "The risk has to be balanced," she said. "We need to leverage AI to improve patient care while ensuring it does not expose us to unnecessary vulnerabilities."

As more than half of U.S. Hospitals are expected to use AI-powered electronic health records (EHRs) by 2026, the importance of robust cybersecurity measures will only grow. Hospitals must remain vigilant and proactive in their approach to AI governance to protect both patients and the integrity of the healthcare system.