AI Security in Healthcare Hinges on Governance and Organizational Awareness

As artificial intelligence gains traction across healthcare, cybersecurity leaders are urging organizations to prioritize governance and awareness to mitigate emerging risks.

Deepesh Randeri, chief information security officer at Akron Children’s Hospital, says that while AI is delivering early benefits in both clinical and administrative settings, it is also expanding the attack surface for hospitals and health systems.

Structured Governance at the Core

Akron Children’s has implemented a formal governance framework for evaluating and deploying AI and other new technologies. The process involves multiple layers of oversight, including internal technology committees, AI governance bodies and executive leadership review.

According to Randeri, all departments are required to follow this standardized process to ensure that new technologies meet benchmarks for clinical value, cost efficiency and, most critically, security.

Strict Vetting Before Deployment

A central component of the hospital’s approach is rigorous due diligence. Any new system or vendor must undergo a comprehensive vetting process before being introduced into the organization’s network.

This centralized model ensures that staff cannot independently deploy or connect technologies without prior approval, reducing the risk of unauthorized or insecure implementations.

Post-Deployment Monitoring Remains a Key Gap

While many healthcare organizations emphasize governance during initial implementation, Randeri noted that ongoing oversight is often insufficient.

He highlighted the need for continuous monitoring to ensure:

• AI systems remain aligned with approved configurations
• Bias does not emerge over time
• Established guardrails continue to function effectively

Without sustained oversight, organizations risk unintended consequences even after a system has been approved and deployed.

Leadership Drives Security Culture

Randeri stressed that effective AI security begins with leadership.

A strong “tone at the top,” he said, is essential to ensuring that security is treated as a shared responsibility across the organization. Executive awareness of AI-related risks helps reinforce accountability at all levels.

Shift Toward Identity-Based Security

The rise of AI is also accelerating changes in cybersecurity strategy. Traditional perimeter-based defenses are giving way to identity-centric and cloud-based security models, where controlling access and user identity plays a central role.

Randeri warned that AI technologies—like phishing attacks—can serve as potential entry points for threat actors if not properly secured.

Risks Extend Across the Ecosystem

Security concerns are not limited to third-party tools. AI systems deployed within a healthcare organization’s own infrastructure can also introduce vulnerabilities if appropriate safeguards are not in place.

Ensuring protection across technology, processes and personnel is critical to reducing the likelihood of security incidents.