Bearings

Ambient documentation and AI-assisted coding are working, and payers are now auditing the results. The organizations that come through the next payer review well will be able to show, for any coded condition, where the diagnosis came from, who reviewed it, and what treatment followed. The same evidence satisfies an accreditation survey. Build it once, before the audit letter arrives, and tag AI spend by department while you are at it, because the model provider's invoice is now a line item someone will ask about.

Most AI contracts in healthcare define data use and uptime. Very few define what counts as an agent incident, how quickly the vendor must report one, to whom, and with what logs. Write that clause now, give every agent scoped credentials and rate limits rather than a clinician's session, and find out which AI tools your clinicians have already agreed to on their own.

Ellison is right that the record belongs to the patient. That principle argues for open access, and it also argues for health systems to decide deliberately which outside platforms may query their data on the patient's behalf. Expect more products that sit above your EHR and ask for its data. The questions to settle before the first one arrives are identity (how the patient is matched), consent (what the patient authorized), and accountability (who answers when the summary is wrong).

The Mississippi coverage is a preview of the scrutiny every awardee will face: what was bought, from whom, and what changed for patients. Rural hospitals that define deliverables and milestones before the first invoice will have an easy answer. North Carolina's network is the model worth copying elsewhere, because small hospitals should not each have to evaluate AI vendors alone.

A reset request that arrives by phone should be treated like a wire transfer request: verify the caller through a channel they did not choose, call back on a number already on file, and require a second person for administrator accounts. That procedure costs little and counters the method described in the Health-ISAC warning. For small hospitals, the eight-day dwell time is the number to plan against, and managed monitoring is no longer optional at any size.