Somewhere right now, in a community hospital, an AI scribe listens as a patient describes her chest pain. The audio streams to a third-party cloud, a large language model transcribes it and a draft note lands in the electronic health record. For an exhausted physician, the relief is immediate.
This isn’t hypothetical. As of 2026, 70% of physicians across the UCSF health system use an AI scribe in daily practice, while more than 40 US health systems have deployed the same class of technology.
Now the uncomfortable question: who on the security team reviewed that pipeline before it went live? Where does the audio rest? And what happens when, not if, the vendor is breached? Most hospitals cannot answer. Attackers are counting on it, and every new deployment widens the gap.
Why Cyber Leaders Need to Act Now
This is no longer a theoretical gap. In January 2026, a targeted phishing email to a single employee at Xsolis, whose Dragonfly AI platform serves more than 600 hospitals and health insurers, gave attackers a two-day window inside its network. The files they took held names, Social Security numbers and medical treatment records for nearly 1.4 million patients across at least eight health systems, including Mayo Clinic. One health system had ended its contract in 2021, yet its patients’ data was still on the vendor's servers. The lesson: every AI platform concentrates patient data into a single target, and a Business Associate Agreement is not a security control. Xsolis is not an outlier. Agentic AI vendor Serviceaide left a database holding 483,000 Catholic Health patients’ records exposed online for six weeks and, in July 2026, agreed to a $1.8 million settlement.
The consequences compound on two fronts. Financially, IBM’s 2025 report marks the 14th consecutive year that healthcare posted the highest average breach cost of any industry: $7.42 million per breach, with 279 days to detect and contain, the longest of any sector. That is nearly $3 million above the global average of $4.44 million and well above second-place financial services at $5.56 million. Clinically, the stakes are higher than money. When ransomware crippled Synnovis, the pathology provider for London’s NHS hospitals, in 2024, 10,000 appointments were disrupted, 170 patients suffered documented harm and a death was formally linked to a delayed blood-test result. University of Minnesota researchers put the pattern at scale: in-hospital mortality rises 35 to 41% during ransomware attacks. Hospital downtime is measured in patient harm, not just dollars.
Behind these incidents sits a leadership gap: governance is not keeping pace. In a 2025 HFMA survey of 233 health systems, 80% reported having no or only limited AI governance in place, while Black Book Research finds fewer than one-third of hospitals have enforced policies covering even a basic AI model inventory.
The problem isn't that hospitals adopted AI. It is that almost no one can answer the board’s next question: how much risk did we just take on, in dollars?
After more than 20 years on the front lines of cyber defense, I have learned that hospital leaders rarely suffer from a lack of threat information. What they need is a disciplined way to translate emerging risk into clear priorities, defensible investments and board-level decisions. The three strategic moves below provide a practical way to do that.
Strategic Move 1: Quantify AI Risk in Financial Terms
Factor Analysis of Information Risk (FAIR), an Open Group standard, expresses cyber risk the way boards already think: Risk = Loss Event Frequency × Loss Magnitude, in dollars and probability ranges. Frequency is driven by how often threats act and how susceptible you are. Magnitude combines the primary losses of response and notification with the secondary losses of fines, patient churn and reputational damage. The FAIR Institute's FAIR-AIR approach applies the same discipline to AI. Here is what it looks like for the ambient AI scribe from our opening scenario.
Define the loss event. A threat actor compromises the AI scribe vendor and exposes 50,000 patient records.
Estimate frequency. How often could this plausibly happen? Healthcare breach data such as the Verizon DBIR, the vendor’s control posture and your own assurance evidence can support a defensible range, for example, once every three to 10 years.
Estimate the financial impact. Tally what a single event would cost: incident response and forensics, notification and credit monitoring for 50,000 patients, legal defense and regulatory exposure that can each run into the millions, operational disruption while the workflow is offline and the quieter cost of patient attrition. Calibrate the ranges against published benchmarks from IBM and Sophos.
Quantify the exposure. Run the ranges through a Monte Carlo simulation. Free and commercial FAIR tools exist. The output is a number a board can act on: this deployment carries an estimated annualized loss exposure of $3 million to $9 million.
Compare the controls. Model two or three options against that exposure: shorter vendor data retention, stronger privileged-access controls and tokenization of patient identifiers. The simulation shows which controls reduce the most risk for every dollar invested.
Make the recommendation. The board advice then writes itself: “We recommend proceeding only after implementing the first two controls, which would reduce estimated annual loss exposure by approximately 40%.” That progression changes the conversation: AI risk scenario, financial exposure, control investment, board decision. A credible first pass takes two working sessions, not a quarter.
Strategic Move 2: Build an AI Security Readiness Framework
Measurement without management is just anxiety with decimal points. The next step is a five-pillar framework, aligned to the NIST AI Risk Management Framework and HHS’s Health Industry Cybersecurity Practices, that any hospital can start this quarter:
Pillar 1: Inventory & Govern. What AI is running, and who owns it? Build an AI system registry covering sanctioned tools, shadow AI and AI embedded inside medical devices – a device population that Claroty’s State of CPS Security research shows remains broadly exposed. Minimum fields: system name, vendor, model type, data consumed, PHI exposure, clinical or administrative use, business owner and date of last security review.
Owner: the CISO, with the CMIO for clinical AI.
Outcome: a complete registry within 90 days, with AI-specific clauses in every vendor contract.
Pillar 2: Quantify. How much risk, in dollars? Run a FAIR scenario for every high-value entry in the registry; the ambient-scribe walkthrough above is the template.
Owner: the CISO with the enterprise risk manager.
Outcome: the hospital’s top five AI risks expressed as annualized loss exposure, refreshed twice a year and tied to a board-approved risk appetite.
Pillar 3: Protect. Are controls fit for AI? Start where Xsolis hurt: require vendors to purge your patients’ data within 30 days of offboarding, enforce least-privilege access to model APIs and tokenize patient identifiers before data enters an AI pip
eline.
Owner: the CISO with vendor management.
Outcome: no AI system goes live without retention, access and breach-notification terms in the contract.
Pillar 4: Monitor. Would we know if it went wrong? Give the SOC alerts tuned to AI behavior an AI platform account pulling bulk records outside business hours, model API call volumes spiking beyond baseline and unsanctioned AI domains appearing in proxy or Data Loss Prevention logs. Threat research from Microsoft, CrowdStrike, Mandiant and ENISA documents adversaries probing these exact paths through prompt injection, data poisoning and stolen model access.
Owner: the SOC manager.
Outcome: AI incidents detected in hours, not the industry’s months.
Pillar 5: Respond & Report. Can we act and explain? Write an AI-specific escalation pathway: SOC to CISO within one hour, executive and legal teams within four and the board risk committee briefed in dollar terms at its next session. Track one board metric above all others: the percentage of registered AI systems with a quantified loss exposure.
Owner: the CISO, reporting to the CIO and the board.
Outcome: board decisions made in FAIR terms, not fear terms.
Treat this as a maturity ladder, not a compliance checklist. Most hospitals can complete Pillar 1 in 90 days with existing staff and that step alone will surface AI systems nobody knew were in production. Together, the five pillars trace the NIST AI Risk Management Framework’s core functions – govern, map, measure and manage – so auditors and regulators can follow the thread from your program straight back to the standard.
Strategic Move 3: Turn the Framework Into a 90-Day Execution Plan
Frameworks matter only when they move into action. For cyber leaders who need a practical starting point, the first 90 days can be simple:
Days 1-30: Build the AI inventory. Assign the registry to your CISO this week; the Pillar 1 fields are the template. You cannot govern what you haven’t listed.
Days 31-60: Run one FAIR scenario end-to-end. Pick your riskiest AI use case, hand your risk manager the ambient-scribe walkthrough and price it.
Days 61-90: Show your board one AI risk in dollars. One slide: the scenario, the exposure range and the two controls that cut it most. Watch the quality of the conversation change.
Securing AI Is the License to Keep Innovating
None of this is an argument against AI in hospitals. The clinical upside is real, and IBM’s own data shows organizations using AI extensively in their defenses saved $1.9 million per breach. Securing AI is the license to keep innovating without betting patient trust on unexamined risk.
AI is already in the building. The only question is whether your security program moved in with it.
