BearingsWeekly intelligence for healthcare IT leaders.

AI now has an auditor on both sides of the claim

Accountability arrived from outside: payers auditing what AI adds to the claim, a government asking why an AI agent ignored a locked door, a vendor claiming the patient's record on the patient's behalf, rural awards published with names and questions attached, and attackers exploiting a help-desk procedure many hospitals never wrote down. In each case, the organizations that already have documented answers will spend less of the next quarter responding.

• AI now has an auditor on both sides of the claim
• AI agents left the sandbox, and the notice took weeks
• EHR vendors are reaching for the patient relationship, and the patient's record
• Rural funding named its recipients, and attackers are calling the help desk

AI agents are pulling on the EHR faster than anyone is metering them

The week's stories share one condition, infrastructure under strain: agents pulling on EHR APIs at volumes nobody metered, the largest EHR programs moving under subpoenas and restructuring while conversions ran in both directions, rural money that now names hospitals by the hundred, prior authorization and AI at scale arriving with real metrics, and a tenth enforcement action about the same missing risk analysis. Every one of those is a governance question with a date on it, and the dates are close.

• The largest EHR programs in the country are moving under political and financial weight
• Rural funding started naming hospitals by the hundred
• Prior authorization went live early, and the metrics for AI at scale arrived
• The same missing risk analysis, for the tenth time this year

Epic put numbers on configuration depth, and about a quarter of its customers are below the line

Measurement was the theme: a vendor tying configuration depth to margin, an AI feature judged by the messages it removed rather than the seconds it saved, breaches that arrived through credentials nobody was watching, rural dollars with hospital names and reporting clocks attached, and a federal program that will decide how an autonomous clinical agent gets approved.

• Autonomous clinical AI got a federal lane, and ambient recordings got their first court ruling
• The breaches came through vendor credentials, and the patch list reached the interface engine
• Rural technology money now carries hospital names, and two award drops are weeks away
• Health systems are redrawing the IT operating model, and data migration is the critical path

Three AI tools now want to read the same chart, and the newest one did not come through the front door

Stewardship was the theme: a chart that three AI tools now want to read, an EHR program whose oversight gaps read like a checklist for every conversion, a hospital that kept caring on paper while its systems were dark, rural dollars that now carry hospital names and reporting clocks, and a prior-authorization workflow that simplified on one end and got more technical on the other. None of it is beyond preparation, and preparation is a choice available today.

• The largest EHR program in the country drew a subpoena, and the conversion pipeline kept moving
• A health system spent the holiday week on paper
• Rural funding now names hospitals, and the clocks are running
• Prior authorization got simpler and harder in the same week

Patient portals became a phishing target at national scale

• Two major incidents made the case for identity-first security and resilient infrastructure
• Rural health funding now has project names attached
• Prior authorization is consolidating ahead of the January 2027 deadline
• AI agents are learning to act, and the winners will be the organizations ready to run them