Bearings

The EHR you configured is worth more than the EHR you bought, and now the vendor has said so with financial data. For a quarter of the installed base, the shortest path to margin is turning on and governing what is already licensed, measured the way Memorial Hermann measured it: by the downstream work that disappears. Optimization and native-AI adoption are the same program, and it should be run by people who transfer capability rather than rent it.

Three governance lessons in one week. First, the architecture regulators are funding is an acting agent plus a supervising agent plus exception-based human oversight; write that pattern into your AI policy now rather than reverse-engineering it in 2028. Second, decide your retention position on ambient audio before a records request forces it, and treat the Washington ruling as one trial court's decision rather than settled law. Third, any predictive model consuming vital signs inherits the workflow latency underneath it; check the data before you trust the alert.

Three of the week's four incidents never touched an EHR. They came through a contractor's phone, a vendor's stored credential, and an API endpoint, which is where the monitoring scope at most organizations ends. Vendor-access governance (credential rotation, least-privilege service accounts, gateway monitoring) now belongs ahead of patch velocity on the security agenda, and the interface engine deserves a named owner, because it is usually nobody's. Boston Scientific's guidance cut is the number to show a board that still files cybersecurity under IT.

The rural market is splitting by ownership. Independent hospitals are choosing subscription platforms they can run with lean teams; hospitals absorbed into larger systems are being converted on compressed timelines where data discovery sets the go-live date. Either way, a hospital named in a technology award is holding committed money with a reporting clock, and the delivery partner should be chosen before the first progress report is due.

Every one of these is an integration event dressed as something else: an outsourcing transition, an RCM re-bid, an ambient tool that now touches billing, a federal interoperability clock, a records-release workflow that draws complaints. The organizations that handle them well treat legacy data and interfaces as a governed program with an owner that outlasts go-live. Compressed timelines, whether six months or "single months," are achieved by deciding early what loads, what archives, and what waits, and by being honest about the long tail.