Bearings
Weekly Intelligence by Purpose Health
By Jason Mudrick, Senior Director · Monday, August 31, 2026
Every Monday, Bearings sorts the week's healthcare IT news into what matters for the people who run health systems: what happened, why it matters, and what to do about it. This week the throughline is trust: in the messages patients receive, in the identities behind a phone call, in the funding now reaching rural hospitals, and in AI tools that are starting to act rather than just transcribe.
Cybersecurity
Patient portals became a phishing target at national scale
By August 27, 41 health systems had warned patients about campaigns impersonating Epic's MyChart patient portal. The American Hospital Association circulated the warning August 24: cloned login pages, fake "urgent" lab results, and a bogus Medicare giveaway that collects card numbers. Epic has been clear the portal itself is not compromised; scammers are trading on a brand patients trust.
Our take
Patients cannot be expected to spot a pixel-perfect fake, so the work falls to providers: publish which channels you use and which you never use, script your call center for "is this message really from you?", monitor for lookalike domains, and review portal authentication posture. The organizations that communicated early this week protected more than data; they kept their patients' trust in the portal itself.
How Purpose Health helps. Our Epic Practice builds exactly this kind of operational playbook for portal communication, helpdesk verification, and patient trust, alongside full implementation and optimization services.
Cybersecurity
Two major incidents made the case for identity-first security and resilient infrastructure
Two of the week's headline breaches shared a lesson. At McKesson, attackers reportedly used phone-based social engineering to reach single-sign-on credentials, then pulled data from cloud business platforms that sit outside the traditional EHR security perimeter. At Boston Scientific, an attack disrupted on-premise systems while cloud-based systems kept running. The same week, CISA gave federal agencies just three days to patch a maximum-severity server vulnerability already being exploited, and new survey data showed 78% of security leaders call authentication modernization a top priority while 53% have not significantly updated their systems in three years.
Our take
Attackers are going around hardened EHRs: through people, through helpdesks, and through the analytics and CRM platforms where health data increasingly pools. Meanwhile, patch windows are shrinking below what manual processes can meet. The organizations best positioned for weeks like this one share three traits: phishing-resistant MFA on single sign-on, monitoring scope that follows the data wherever it lives, and infrastructure managed for rapid patching and segmented recovery.
How Purpose Health helps. Our EHR Cloud Hosting services are built around patch velocity, identity architecture, and recovery readiness, so a bad day stays a bad day instead of becoming a disclosure.
Rural Health
Rural health funding now has project names attached
The $50B Rural Health Transformation Program moved from state-level awards to named projects this week. CMS announced funding for Alabama, Alaska, Ohio, and Georgia in successive daily press releases, with North Dakota and West Virginia in the same wave. Alaska's $160M covers 142 projects and explicitly includes electronic health record modernization; Georgia's $93.3M funds telehealth expansion; Ohio's targets rural pharmacy connectivity.
Our take
This is the moment the program becomes real for rural and critical-access hospitals: committed dollars, named categories, and reporting clocks that start at award. The hard part comes next. Most awardees have never run a technology program of this size, and funding that is not converted into working systems on schedule is funding at risk. Rural leaders should be selecting delivery partners now, not after the first progress report comes due.
How Purpose Health helps. Our MEDITECH Practice specializes in rapid Expanse implementations for community and critical-access hospitals, and our program-management teams help awardees turn grant categories into delivered, reportable outcomes. Rural healthcare succeeding is the entire point of this program, and we want every awardee to make their deadlines.
Prior Authorization
Prior authorization is consolidating ahead of the January 2027 deadline
R1 announced it will acquire Humata Health, adding AI-powered prior-authorization automation and real-time payer connections to its revenue-cycle platform, two weeks after Epic launched native real-time prior-auth checks. Wolters Kluwer shipped prior-auth optimization tooling the same week. The market is converging on the CMS requirement for electronic prior authorization taking effect January 1, 2027.
Our take
Providers now have real choices: EHR-native, revenue-cycle-platform, or standalone prior-auth engines. Whichever path an organization picks, the deadline work is the same: payer connectivity, workflow redesign, testing, and integration between the PA engine and the chart. Four months of 2026 remain to plan it; organizations that start now implement, and organizations that wait remediate.
How Purpose Health helps. Our Software Development & Integrations team delivers prior-authorization enablement across all three paths, from payer connections to clinician workflow, with the CMS timeline as the project plan.
Healthcare AI
AI agents are learning to act, and the winners will be the organizations ready to run them
This week's product news pushed AI past documentation: an acquisition bringing agentic staffing and scheduling to health systems, and the first commercial deployment of an AI prescribing agent that extends ambient listening into medication workflows. The evidence that scale is achievable is arriving too: at HIMSS26 APAC in Singapore, a leading Mumbai hospital reported ambient AI now handles nearly 90% of its progress notes and shift handovers across an EMR-integrated platform. The caution arrived the same week: more than 80% of AI projects still fail to reach production, and Healthcare IT Today's 200th podcast episode traced the gap to infrastructure, data, and operational readiness rather than the models themselves.
Our take
Integration architecture, data quality, governance, and clear operational ownership separate a pilot that works from a deployment that lasts. The 90%-adoption stories and the 80%-failure statistic describe the same technology; readiness is the difference. We are optimistic about what agents will do for overloaded clinical and operational teams, and that optimism is precisely why the groundwork deserves investment.
How Purpose Health helps. Our AI Strategy practice takes health systems from use-case selection through governance, integration, and production ownership, so AI investments reach production, in the United States and internationally, where this week's HIMSS26 APAC coverage shows adoption moving fastest.
The week in one paragraph
Trust was the currency of the week: patients deciding whether a portal message is real, security teams rediscovering that identity is the perimeter, rural hospitals receiving funds that must become working systems, and health systems weighing AI agents that can now act on their behalf. Every one of those is solvable with preparation, and preparation is a choice available today.
Purpose Health partners with health systems on Epic and MEDITECH delivery, EHR cloud hosting, software development and integration, and AI strategy, in the United States and internationally. Talk to our team about any topic in this week's Bearings.
Bearings publishes every Monday at purposehealth.ai/blog. Sources are selected for open access; no paywalled links.