The former MultiCare strategy executive talked with us about AI's growing security exposure, building governance that holds up and why every leader needs to understand the technology.
“The attack surface has grown and expanded through AI for each organization,” David Ohm says. “The exposure is greater because it's not just when a model is wrong. It's what data it perceives, what permissions it has, and then when it's compromised.”
Ohm, an experienced healthcare executive who most recently served as chief strategic development officer for MultiCare Health System, talked with Chief Healthcare Executive® during the Becker's CEO + CFO Roundtable in Chicago earlier this month. MultiCare, a nonprofit system based in Tacoma, Washington, operates 13 hospitals.
He discussed what CEOs should ask their chief information security officers as AI tools get wired into electronic health records, how leaders can get a handle on staff using consumer AI tools on their own and what separates a governance committee that manages risk from one that just signs off.
Many health systems operate across state lines while states pass their own AI laws. “The short answer is I would build a durable governance program, and not try to isolate each new law as it comes across,” Ohm says.
“I think there's a level of hubris in healthcare that isn't being addressed when it comes to AI infrastructures, security infrastructures specifically,” he says. “It's something that I think is a problem that's going to surprise us with how hard it will hit at some point.”
This is one of a
Here is the transcript of our conversation with David Ohm.
Q: When health system leaders talk about AI risk, they usually mean accuracy or bias. You've focused on infrastructure, security and governance. What risk do you think boards and CEOs are underestimating right now?
Ohm: “I think one of the biggest risks that is being underestimated is that the attack surface has grown and expanded through AI for each organization. The exposure is greater because it's not just when a model is wrong. It's what data it perceives, what permissions it has, and then when it's compromised. So I think it's become not just an infrastructure, a cybersecurity or an accountability problem, but maybe more than a technology issue. It's maybe those other things a little bit more.”
Healthcare executive
MultiCare at a glance
Q: AI tools are being connected to electronic health records (EHRs), patient data and revenue cycle systems, and vendors are turning on AI features inside products health systems already use. How does that change a health system's security exposure, and what should a CEO be asking the chief information security officer?
Ohm: “I think once you connect AI to an EHR, a revenue cycle or patient data, you do open up new pathways to sensitive information and operational workflows. And in doing so, leaders should be asking questions about what tools are we connecting to what data, and what systems? What next steps do we need to take to make sure the vendor is securing the data? And then, are we in a position to contain a breach or recover from one?”
Q: Clinicians and staff are already using consumer AI tools on their own. How do leaders get visibility into that and set guardrails without shutting down adoption?
Ohm: “I think you need to be honest and pretty straightforward about asking what tools are being used, and then set clear expectations about what rules are in place and what approved options you have out there, especially around patient demographics, AI-generated content and other things that might be considered sensitive. We're not trying to ban experimentation. You're just trying to create new pathways that are safe and ethical.”
“We're not trying to ban experimentation. You're just trying to create new pathways that are safe and ethical.”
Q: Many systems have formed AI governance committees. What separates one that actually manages risk from one that just signs off? And who should own AI governance: the chief information officer (CIO), the chief medical information officer, strategy or someone else?
Ohm: “I think any committee that just is approving tools is a little too narrow. I think you need to incorporate other parts of that process in the equation. It needs to be something that's handled through an enterprise level, with a senior executive accountable, and then CIOs, clinical leaders, strategy, operations, legal and privacy all need to have a seat at the table. I think less important is to have a clear owner than it is to have a decision tree with next steps in place.”
Q: You've argued that AI efforts fail when they aren't tied to core strategy. From the strategy seat, how do you decide which AI investments to make and which ones to turn down?
Ohm: “So I think a lot of that is driven by priorities, like what is important to our system now? What's the organization? What's the problem we're trying to solve for either the staff or the patients? We need to take a step-by-step approach to determine what outcomes are we looking for. So we're looking more at a strategy solution than we are a technology solution, first and foremost.”
Q: As AI moves from documentation into decisions like triage, prior authorization and coding, where should the line on human oversight sit? Should systems monitor tools for bias and performance drift once they're live?
Ohm: “So I think the higher the stakes, the more meaningful the human interaction needs to be. AI has a place in the decision process, but people need to be able to have the authority, the time and the information to be able to judge the output and not just rubber-stamp it. I think there are protocols in place where you could follow the stream from the beginning to the end, where we can assure that there's enough monitoring. The greater the need, the more the human, I think, needs to partake in the end result.”
Q: Federal policy has taken a lighter touch while states pass their own AI laws, and many systems operate across state lines. How do you build compliance that holds up when the rules keep changing?
Ohm: “So I really like this question, and I have a short answer and a longer answer. The short answer is I would build a durable governance program, and not try to isolate each new law as it comes across. And I would pick how our process moves throughout the use case and then build from there.
“I've actually tried, really so far with not a lot of success, to incorporate a gathering of senior-level executives in a region. Let's use, for example, the Pacific Northwest, where we get together a bunch of senior executives from health systems, and we bring together our state legislators from, say, Washington, Oregon, Idaho and Montana. I also have a lobby group that I'm associated with in D.C. that handles healthcare from a national perspective. They also do the whole continuum, so it's not just payer, provider or pharma, but it's all of the above.
“Ideally, I'd like to get all of these individuals in the room together and bridge the gap between our region and our national scope, and have a couple of senators and some from the administration incorporate our views from the Pacific Northwest. And then we could replicate that along other regions and maybe have a contiguous solution for our healthcare, because it's a problem. We have PHI [protected health information], we have HIPAA in healthcare, so it's something that's actually near and dear to me, if you can't tell. This is something I'd like to resolve because we're not where we should be.”
Q: If a health system CEO wanted to get serious about AI governance and security tomorrow, what are the first two or three things you'd tell them to do?
Ohm: “I think you need to take a candid inventory of what's happening on the ground with AI. So, what is already embedded in your provider tools and in the systems in place now, and what is informally being used by staff? Have an idea of what's out there.
“And then secondarily, I'd say develop a credible, effective governance platform that incorporates safeguards through high-impact decisions and sensitive data, and that bridges the gap between risk management and innovation, so they don't need to be polarized and fighting each other to get to the same result, where we could have a good program.”
Q: Is there anything else you'd like to talk about?
Ohm: “I think there's a level of hubris in healthcare that isn't being addressed when it comes to AI infrastructures, security infrastructures specifically, and it's something that I think is a problem that's going to surprise us with how hard it will hit at some point. It's not something we can ignore. What is the potential for what happens in a system, systemically, when it breaks down and AI no longer can function?
“Right now, AI is being used predominantly from an ambient perspective. That's where a lot of it's used, in the background and in doctors' offices, for example, taking notes. It's a fairly safe, relatively easy way to use AI. That does give more pajama time, as they call it, for physicians and clinicians. That's great.
“There will be a time, mostly from pressure from other parts of the world where they're already doing it, where it will be decisions being made, clinical decisions, not clerical decisions. And then it poses other challenges and problems, where doctors sometimes are informally using some of these AI products, and you need to have that standardized and in one place under regulatory guidelines. That's something that I don't think we're taking seriously enough.”
Q: Is there anything else you've thought of that you want to share?
Ohm: “AI is not going to be mitigated through time like other subject matters that might come and go a little bit. You have value-based care, which has not gone, but it's risen and then faded somewhat. There are just certain things that happen in healthcare. They rise to the top, they fade to black.
“When it comes to AI, the difference in this case is that it's being used on a daily basis by everyone. Your staff is using it right now, whether you know it or not. And one of the things that is going to happen, regardless of whether you like it or not, is you need to be well-versed, even at a layman's level, throughout your leadership. Your leadership needs to be horizontal on the subject matter. You can't be siloed out where just your chief data scientist is the only one that understands this.
“That's something I think we need to work on, where everybody needs to have a basic working understanding of the subject matter, because it's not going to fade away. It almost can't, because it's so prevalent now in everybody's daily lives. I think everybody should be a little more well-versed than they are, at least to be able to share the responsibility from a leadership perspective on this subject.”
“You can't be siloed out where just your chief data scientist is the only one that understands this.”
