Sat Oct 17
The Governance Gap Hospitals Can No Longer Delegate to IT
Health systems are running hundreds of AI tools with few having named oversight authority, and agentic AI is already outrunning the approval process.
CommonSpirit Health now runs more than 240 AI applications across its system, governed by a multidisciplinary Enterprise Data and AI Governance committee that evaluates ethics, data, algorithm, and governance implications before and after deployment, according to Health Progress. That kind of structure is still the exception. A recent review cited by Jan Beger found that of the four components a real-world AI governance framework needs, guiding principles, an assessment method, lifecycle stage coverage, and an organizational oversight mechanism with actual decision-making authority, the oversight mechanism is the one most frameworks skip.
That gap is no longer theoretical. The AMA’s new governance framework for agentic AI found that 72% of respondents say agentic tools are occasionally implemented without IT approval, and more than half flagged potential compliance or regulatory violations and unauthorized access as direct consequences, according to Healthcare Dive. Agents are being stood up inside clinical and administrative workflows faster than existing committee structures can see them, let alone approve them. HIT Consultant reports that more than half of health plans and a quarter of provider organizations already have AI embedded somewhere in their workflows, with data distributed across systems that were never built to track autonomous decision-making.
Why committee governance alone won’t hold
Duke Health’s Algorithm-Based Clinical Decision Support framework offers institutional oversight through committee review, but it emphasizes human sign-off at fixed milestones rather than continuous, automated monitoring, a limitation the AEGIS proposal in npj Digital Medicine is explicitly built to address for adaptive AI that changes behavior after deployment. That distinction matters for any system using continuous learning models, not just diagnostic tools. A governance committee that meets quarterly cannot catch drift that happens weekly.
Mark Sendak, CEO of Vega Health, has argued the fix is not a single centralized regulator but a combination of centralized oversight and local hospital governance working together, according to RAPS. That is a reasonable long-term policy direction. It is not a reason to wait.
The decision in front of compliance and IT leaders now
ISO 42001 already requires a named governance function with defined decision rights across the AI lifecycle, not just a principles document. NIST AI RMF’s Govern function makes the same demand. The organizations ahead of this, like CommonSpirit, built committee structures with actual authority to approve, pause, or retire tools before agentic AI became a procurement category every department could access on its own.
The practical test for any health system right now is simple. Can your governance committee name every AI agent currently running against clinical or financial systems, and does it have the authority to shut one down without a six-week escalation process. If the answer is no, the exposure isn’t hypothetical. It’s the gap the AMA just measured at 72%.
Boards that treat AI governance as a policy document to be ratified once a year will keep discovering, after the fact, how much has already been automated without them.
Board record
This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.
| Seat | Reviewer | Finding |
|---|---|---|
| Chair · Editorial Judgment | Claude | cleared. The argument is coherent and well-structured—the 72% AMA finding anchors a clear thesis about governance gaps—but the piece conflates ‘implemented without IT approval’ with ‘implemented without any go |
| Source & Claim Verification | Qwen · hosted fallback (qwen-2.5-72b-instruct) | cleared. All factual claims are supported by citations, but some sources (e.g., LinkedIn posts, Instagram) may not be the most reliable for academic or professional verification. |
| Regulatory & Framework Fidelity | Mistral · fallback (mistral-medium-3.1) | cleared. The briefing cites ISO 42001 and NIST AI RMF but fails to explicitly align governance gaps with specific clauses (e.g., ISO 42001:2023 Clause 6.2 or NIST RMF Govern function controls) or address EU AI |
| Technical Accuracy | Llama | cleared. The article is generally technically accurate regarding AI governance in healthcare, but some cited sources are not directly relevant to the main argument. |
| Bias, Balance & Hype Control | Gemini | cleared. The briefing effectively identifies a critical governance gap and directly challenges the efficacy of traditional committee-based approaches, offering a strong counterargument to complacency. |
| Novelty & Non-Duplication | Grok | held. Competent but derivative synthesis of already-circulating wire (AMA 72% agentic bypass, CommonSpirit committee, AEGIS continuous-monitoring critique, ISO/NIST Govern) that adds only a sharp practical- |
| Validation | DeepSeek | cleared. The central claim that a significant governance gap exists is strongly validated by the AMA survey data showing 72% of respondents report agentic AI tools are occasionally implemented without IT appro |
Sources cited: 45. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.