healthsystemCIO – Strategies for Hospital IT Leaders

Chris Tyberg, chief information security officer at Abbott and chair of the Health Sector Coordinating Council Cybersecurity Working Group, explains why polling application owners produces unusable downtime plans and what business process owners answer instead. He shares early findings from Operation Vital Signs, the first sector-wide healthcare cyber tabletop, including why sustained response strains organizations far more than the opening hours and how the third-party contact gap still runs on relationships.

Hugo Lai, Chief Information Security Officer at Temple Health – Temple University Health System, discusses why frontier AI collapsed the 30-day patch window and what changes when defense has to run at machine speed. He details the limits and monitoring every defensive agent needs, the security point of contact missing from most business associate agreements, and why a major outage reaches the C-suite as a denial-of-revenue attack.

Stephen O'Mahony, MD, SVP and Chief Medical Information Officer at RWJBarnabas Health, discusses the clinical adoption work behind an AI deterioration warning tied to an 18% reduction in the risk-adjusted odds of in-hospital death. He details the concept-to-data mapping done with the technical team, the suppression logic that keeps the system quiet when clinicians already know, and the silent background testing that cut daily alerts to a volume rapid response teams could absorb.

Tinu Tadese, MD, System VP/CMIO at Boston Medical Center Health System, discusses Project Unite, the six-month integration that brought two former Steward Health Care hospitals onto a mature Epic build. She explains the MVP+ approach that lifted an academic build into community settings, the day-one data decisions that kept patients safe, and why conversion time is the constraint an acquisition timeline cannot compress.

Julie Demaree, VP, Chief Technology and Digital Innovation Officer at St. Mary's Healthcare, Corey Zeigler, CIO at Helio Health, and Carrie Weigand, MD, clinical advisor at Heidi Health, discuss how a lean IT department gets ambient AI into clinicians' hands. They cover buying at-the-elbow support instead of staffing it, the customization decisions that break vendor alignment, peer champions as the fastest training path, and who owns an AI model once it is live.

Chris Paravate, EVP and chief digital and information officer at Northeast Georgia Health System, discusses the five-week rollout of Epic’s Chart with Art to nurses and patient care techs at five hospitals. He explains why a tool that fails safely earns a lighter implementation, how 88% adoption in 30 days replaced a business case for the AI shift-handoff summary, and where operations must set the standard for mandatory AI use.

Cassie Marcelle, VP of clinical informatics and CNIO at UF Health, Marc Perkins-Carrillo, CNIO at Moffitt Cancer Center, and Lisa Stephenson, CNIO at Cedars-Sinai, discuss why ambient AI built for physician notes cannot simply be pointed at nursing flowsheets. They cover device platform gaps, nurses who use discrete fields as a checklist, super user programs with paid training hours, and governance built to remove flowsheet rows.

J.D. Whitlock, CIO at Dayton Children's Hospital, breaks down the ambient AI decision waiting at the end of his Abridge contract and the test Epic's Chart with Art will have to pass. He explains why nursing ambient means a second vendor and a second bake-off, what reported take-private talks at Workday would do to the EpicOps timeline, and how 20 clinical governance committees keep the call out of his hands.

Allison Dempsey, PhD, PMH-C, Director of Technology and Data Governance at the Brain and Behavior Innovation Center at CU Anschutz, discusses why behavioral health met AI’s consent and privacy questions before the rest of the enterprise. She explains the response cost test she applies to every technology request, how Colorado’s new psychotherapy AI law added a mid-session consent step to ambient documentation, and what a one-page request does to governance cycles.

Shauna Overgaard, PhD, Senior Director of AI Strategy and Frameworks at Mayo Clinic, discusses an emerging approach that tests selected AI tools in the simulation center, with standardized patients, before clinical use. She describes the workflow shadowing that changed how Mayo's review board weighs proposals, the exploratory work on bringing clinicians into evaluation, and a reliability cue in development for patients a model may serve less well.

Susan Harkness Regli, PhD, Associate CHIO for Human-Computer Interaction at the University of Pennsylvania Health System, discusses how human factors work protects clinicians from AI tools that pass technical testing yet fail at the screen. She details Penn's staged alpha and beta exposure, the usage data that caught one role accepting AI-drafted patient replies unedited, and why governance approval sets a six-month review date.

Darin Prill, MBA, CHCIO, VP/CTO at WellSpan Health, discusses the 17-week migration that moved more than 300 applications and the full Epic environment to AWS ahead of a Broadcom renewal. He details the wave schedule that held Epic downtime to about two hours, the intake review deciding which third-party tools travel with Epic, and the data work that has to precede AI.

Ilo Romero, VP/Associate CIO at WVU Medicine; Pam Austin, former SVP/CIO at Ballad Health; and Guido Giunti, MD, PhD, Chief Data Officer at St. James's Hospital Dublin, examine why AI literacy programs stall when IT owns them alone. They make the case that operational and clinical leaders hold the trust adoption depends on, and offer a role-based, federated model for building workforce capability that outlasts any single tool.

Terri Couts, SVP and Chief Information and Digital Officer at Sharp HealthCare, walks through the governance restructuring that opened her first year in San Diego. She covers moving decision authority out of advisory committees, tracking analyst time against task to build a capacity heat map, and why application load and rounding belong in the same foundation conversation.

Elias Kikano, MD, Division Chief for Imaging Informatics and Medical Director for Health Informatics at Emory, discusses the new healthcare security baseline for Apple devices developed with NIST and Apple. He covers how the mapping connects Apple control points to HHS Health Industry Cybersecurity Practices guidance, what security teams can pull into mobile device management, Emory's Apple deployment at Hillandale Hospital, and how FDA clearance for the Studio Display XDR medical imaging calibrator affects diagnostic radiology plans.

J. Scott Smitherman, MD, MBA, VP/CMIO at Providence, walks through Project Pixel, the internal effort to evaluate Epic’s AI portfolio. He covers the safety standard and time-savings test every release must pass, why fully loaded cost governs both native and third-party requests, how service-line governance works across 50-plus hospitals, and why clinicians deserve to hear what their request would displace.

Jim Blum, MD, CHIO at University of Iowa Health Care, explains why deep integration with the clinical record led his team to adopt Epic's EpicOps Teamwork scheduling module as an early adopter, how a single source of truth advanced patient safety, and why aligning ERP and clinical data could reshape total-cost-of-care analytics.

Zafar Chaudry, MD, former Chief Digital Officer at Seattle Children's, and Adar Palis, SVP of Clinical & Revenue Cycle Applications at Providence, examine why health systems struggle to retire the applications they no longer need. They explain why usage counts mislead, how legacy tools widen the cybersecurity attack surface, and why a 20% reduction target often ends the fiscal year closer to 5%.

Shannon Becker, VP of IT, Clinical & Revenue Cycle Systems at Sentara Health, explains how business acceleration workshops bring application teams back to the frontline, sort friction into quick fixes and systemic redesigns, and break down silos across business lines.

Errol Weiss, Chief Security Officer at Health-ISAC, discusses threat intelligence, attack-surface reduction and network segmentation, the budget squeeze facing healthcare CISOs, the HICP and HHS Cybersecurity Performance Goals frameworks, third-party and concentration risk, and governing agentic AI as an identity, returning throughout to the people and resources that determine whether a health system can defend itself.

Ramandeep Singh, MD, Associate Chief Health Information Officer and Director of Imaging Informatics at University of Iowa Health Care, breaks down the radiologist shortage equilibrium and the workforce, volume, and reimbursement trends driving it. He details a four-pillar governance model, the scalability case for cloud PACS, an on-prem backup strategy for business continuity, and how his team went live on PACS and dictation in five to six months.

Colleen Mallozzi, MBA, RN, SVP and Chief Nursing Informatics Officer at Jefferson Health, explains why ambient AI documentation succeeds only when nurses help build the rationale, why newer nurses hesitate more than seasoned ones, and how the health system keeps its Abridge and Microsoft Dragon pilots flexible while the nursing ambient market matures.

Craig Richardville, SVP and Chief Digital and Information Officer at UF Health, explains why soft ROI now rivals hard return, how multi-lens governance gates technology spending, and why bringing shadow AI work into a documented sandbox beats blocking it.

Your downtime plan says go to paper. But what if no one on the floor has ever charted that way, and the warehouse ran dry years ago? A CISO explains what resilience really takes. Source: Cyber Resilience Is an Organization-Wide Discipline, Michigan Health’s Sieg Says on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Brian Dilcher, MD, Associate CMIO and Director of Emergency Medicine Clinical Informatics at WVU Medicine, breaks down what he saw at Epic's Agent Factory build-a-thon: token costs that vary wildly between builders, governance that has to run continuously, and the data discipline that keeps fixed-field tools from pulling the wrong information.

John Halamka, MD, president of Mayo Clinic Platform, and Melek Somai, MD, VP and chief technology and product officer at Inception Health, examine why AI-assisted development is reopening the build option for new application requests. They weigh build against buying in-suite or niche, the integration tax that sinks third-party tools, and how abstraction layers and multi-cloud strategy help health systems avoid vendor and LLM lock-in.

Most cyber plans assume your own defenses are the whole battle. McLaren’s Sam Jacques makes the case that survival now turns on how the entire sector moves together when a shared dependency suddenly fails. Source: Resilience Is a Team Sport: McLaren’s Sam Jacques on Operation Vital Signs on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Sahan Fernando, CISO at Rady Children's Hospital-San Diego, explains why understanding hospital operations is the foundation of cyber resilience, covering clinician outreach, executive participation, the IT-operations divide, shadow IT, and downtime planning.

Beth Lindsay-Wood, Chief Informatics and Technology Officer at Moffitt Cancer Center, explains how a breast imaging system that would not scale set off a three-year enterprise imaging consolidation onto one cloud-based platform. She covers how imaging problems surface, getting IT close to operations, governance at the EVP level, streamlining intake as AI floods the request pipeline, and why clean, well-owned data is the foundation for everything that follows.

John Riggi of the American Hospital Association and William Walders of The Joint Commission explain why cyber resilience depends on a single accountable executive, board-level priority, and treating clinical continuity as the mission. They walk through the new Cyber Resilience Readiness program and a 30-day planning benchmark drawn from hundreds of real attacks.

Jason Hill, MD, of Ochsner Health explains how the system treats patient throughput as an end-to-end process, why front-end access matters as much as length of stay, the CMIO-CIO dyad, and how Epic's Cosmos Median Length of Stay tool predicts stays accurately at admission.

Helen Oscislawski, Esq., of Attorneys at Oscislawski LLC, explains what the Epic, Health Gorilla lawsuit means for health system CIOs, why a contract breach differs from an unlawful disclosure, why TEFCA participation remains voluntary, and how to coordinate breach-notification decisions across legal, compliance, and IT.

CISOs Anahi Santiago of ChristianaCare, Krista Arndt of St. Luke’s University Health Network, and Antonio Davis of Northeast Georgia Health System, join Robert Butler from Netskope and healthsystemCIO's Anthony Guerra to examine how to secure AI as it spreads through health systems via shadow tools and vendor upgrades. They argue that visibility, not blocking, lets security permit AI responsibly — pairing governance and guardrails with a culture that coaches users toward sanctioned tools rather than simply saying no.

Ilo Romero, CHCIO, VP and associate CIO at WVU Medicine, explains why HIPAA-compliant frontier AI access now carries a seven-figure entry point, how his model-agnostic platform routes workloads across in-house GPUs and cloud endpoints, and why owning the integration layer beats betting on any single model.

Most leaders treat unsanctioned AI use as a compliance headache to stamp out. Heidi Health’s Simon Kos sees a free market signal hiding in plain sight, one that points straight to the tools your clinicians actually need. Source: Heidi Health’s Kos Says Shadow AI Signals a Tool Gap CIOs Can’t Ignore on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Most EHR selection stories center on platform features. At one rural Indiana hospital, the deciding signals came from outside the platform demos themselves, and from the sponsor relationships that came with one option. Source: Schneck’s Rice: Clinician Scoring, Independence Drove Meditech Expanse Pick Over Epic on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Most patient throughput tools underperform because health systems deploy them too early. A panel of healthcare IT leaders explain the operational disciplines that have to be in place first, and why skipping them costs months of progress. Source: Patient Throughput Improvement Demands Operational Clarity Before Technology on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Most CIOs treat enterprise imaging as a back-burner project. Cincinnati Children’s Towbin lays out the math that changes the conversation, with 90% of healthcare data, 80% workflow gains, and the right champion all in play. Source: Cincinnati Children’s Towbin Says Imaging Is 90% of Medical Data, CIOs Must Lean In on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Most healthcare CISOs handle pen testing and risk assessments routinely. Device inventory and PHI mapping fall into a tougher category, and the new HIPAA Security Rule will soon make both mandatory. Health-ISAC's Phil Englert explains where to focus first. Source: H-ISAC’s Englert Says Device Inventory and PHI Mapping Will Be the Heaviest Lifts When New HIPAA Drops on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Most AI business cases get reduced to a financial spreadsheet. Two veteran health system leaders say clinician satisfaction belongs on the same line, and explain how to find the executive sponsors who will defend it. Source: Health System CIOs: Anecdotal ROI from Key Stakeholders Punches Above Its Weight on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Third-party attacks against health systems jumped from monthly to weekly, outpacing how most cyber programs are built. Inside: how Providence redesigned the CISO role to absorb emergency management and what shifted when the team walked the NICU floor. Source: Providence’s Ratliff Says Merging Cybersecurity and Emergency Management Builds Stronger Cyber Resiliency on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Julia Adler-Milstein, PhD, Chief of UCSF's Division of Clinical Informatics and Digital Transformation, dissects the procurement and integration dynamics steering health systems toward their EHR vendor's in-suite AI tools at the expense of third-party innovators. Drawing on her recent JAMA viewpoint with Sara Murray and Robert Wachter, she explains why market forces alone will not loosen the EHR vendor's grip — and what a policy intervention could realistically look like. Source: UCSF’s Adler-Milstein Says Stay-in-Suite Pull for Clinical AI is Strong, Policy May be Only Way to Level Playing Field on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Ken Kawamoto, MD, Chief Health AI Transformation Officer at University of Utah Health, describes how the AI Workbench lets clinicians build their own AI applications without one-off engineering. The standards-based tool sits inside Epic and uses SMART on FHIR to scale clinical AI across the enterprise. Source: University of Utah Health’s Kawamoto Says Workbench Approach Scales Clinical AI Across the Enterprise on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Most health IT teams assume their SaaS providers built genuine multi-region resiliency. Mass General Brigham’s CTO discovered the truth is less reassuring. The fix starts with one missing habit nobody’s been practicing. Source: Mass General Brigham’s Sriraman Says SaaS Outages Expose Hidden Cloud Dependencies on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Your EHR vendor’s product suite keeps things simple, but simplicity comes at a price. One health system CTO explains why building in-house opened doors he didn’t know existed. Source: Inception Health’s Somai Says Always Staying in Your EHR Suite Limits Differentiation; Building Easier Than Ever on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Panel discussion on EMR optimization with Dr. Hannah Galvin, Dr. Ash Goel, and Dr. Marc Tobias. Source: EMR Optimization: Why Ambient AI Can’t Fix a Broken EHR on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

When clinicians and IT leaders build together from the start, the results speak for themselves. Rush's Associate CMIO shares the partnership playbook behind a handoff tool adopted by 25 health systems and an AI chatbot built in two weekends. Source: Rush University Medical Center’s Rojas Explains How IT & Clinicians Can Truly Partner on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Keith Duemling explains why Catholic Health treats cybersecurity as a chronic condition requiring continuous management rather than an episodic fix. Managing cybersecurity at a health system is less like performing surgery and more like treating diabetes. That is the operating philosophy Keith Duemling, VP/CISO at Catholic Health, brought to his first year leading the security […] Source: Catholic Health’s Keith Duemling: Why Cybersecurity is a Chronic Condition, Not an Episode on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Christina Kochan, Healthcare Solution Architect at CTG, explains why organizing clinical informatics teams by service line instead of by application reveals workflow gaps that product-focused IT structures miss, and how value stream mapping can follow the patient across every handoff, system, and care setting to eliminate friction. Source: CTG’s Kochan Says Patient-Centric Workflow Mapping Exposes Gaps Product-Focused IT Teams Can Miss on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders

Simon Nazarian explains why City of Hope builds AI governance into the technical foundation to move beyond pilots and ensure safe, scaled clinical care. City of Hope has built a proprietary generative AI platform that converts thousands of pages of patient medical records into actionable clinical summaries in seconds, saving physicians hours of after-hours chart […] Source: City of Hope’s Nazarian Says AI Governance Must Be Built Into the System on healthsystemcio.com - Interviews & Webinars with Health System IT Leaders