Healthcare AI Has Left the Lab. Now Comes the Hard Part.
For years, artificial intelligence in healthcare was treated as a horizon technology — something promising but perpetually a few trials away from real-world deployment. That era is over. AI tools are no longer being piloted in controlled environments or evaluated by innovation committees. They are embedded into the operational fabric of hospitals, clinics, health systems, and insurance platforms right now. The question is no longer whether healthcare will adopt AI. The question is whether the rules, the institutions, and the financial ecosystems surrounding healthcare can keep up.
According to an analysis authored by Alaap Shah, a member and co-chair of Epstein Becker Green's AI Cross-Practice Working Group, published in TechReg Chronicle, AI has moved swiftly from experimentation to execution — and that shift carries consequences that extend well beyond the exam room.
Where AI Is Already Doing the Work
AI applications in healthcare are no longer limited to research contexts or experimental diagnostics. Today, these systems are active participants in some of the most consequential workflows in medicine. Shah's analysis highlights several core areas where AI has achieved meaningful operational penetration.
- Clinical scheduling: AI systems are managing appointment allocation, predicting no-shows, and optimizing provider calendars at scale. What once required teams of administrative staff is now largely automated, reducing overhead while introducing new questions about accountability when errors occur.
- Drug dispensing: Automated pharmacy systems powered by AI are handling medication verification, dosage flagging, and dispensing workflows. The efficiency gains are real, but so is the risk when a system makes a mistake that a human pharmacist might have caught.
- Patient communications: AI is increasingly responsible for follow-up messaging, appointment reminders, care instructions, and even triage guidance. For patients navigating complex conditions, the line between automated convenience and clinical advice is becoming uncomfortably thin.
- Diagnostic decision-making: Perhaps the highest-stakes application, AI is now informing diagnoses across radiology, pathology, and primary care. Clinicians are working alongside systems that flag anomalies, suggest differentials, and prioritize cases — systems that may carry biases or failure modes that are not yet fully understood.
Each of these use cases represents a genuine improvement in operational capacity. None of them come without risk. And collectively, they represent a transformation in how healthcare decisions are made — a transformation that has moved faster than the regulatory infrastructure designed to oversee it.
A Compliance Framework That Has Not Caught Up
Shah is direct about the central tension in the current landscape: the pace of AI adoption in healthcare has outrun the rules designed to govern it. Federal agencies are working from frameworks built for a different era, and the institutional memory of how to regulate software-driven medical decision-making is still being written.
The Food and Drug Administration, which has traditionally overseen medical devices and diagnostic tools, is expanding its oversight of AI-driven clinical software. But the classification challenges are significant. Many AI tools in healthcare do not fit neatly into existing device categories. They learn over time, meaning that the version regulators evaluate may not be the version operating in a hospital six months later. Static approval processes are poorly suited to adaptive systems.
Beyond the FDA, the Office for Civil Rights within the Department of Health and Human Services is grappling with how AI intersects with HIPAA obligations. When a patient's data is fed into an AI model to generate a care recommendation, who is responsible for ensuring that data is protected? When an AI system produces a discriminatory outcome in care delivery, which regulatory framework applies? These are not hypothetical questions. They are live compliance issues that organizations are navigating without clear answers.
State-level regulatory activity is adding another layer of complexity. Several states are moving ahead with their own AI governance requirements, creating a patchwork environment that multi-state health systems must navigate simultaneously. For legal and compliance teams, this is not a future planning problem — it is a present operational burden.
Why Financial Institutions Are Not Bystanders
One of the more striking dimensions of Shah's analysis is its attention to the financial ecosystem surrounding healthcare. It would be easy to frame healthcare AI governance as a concern exclusively for providers and payers. Shah argues otherwise, and the argument is persuasive.
Financial institutions are deeply embedded in the healthcare economy. Payment processors handle billions of dollars in healthcare transactions. Insurers design products around health system capabilities and outcomes. Employers offering health benefits are exposed to the liability environments their provider partners operate in. Lenders extending credit to health systems are underwriting institutions whose operational and legal risk profiles are shifting as AI becomes central to their workflows.
As the regulatory and liability environment around healthcare AI tightens, these financial relationships will feel the effects. A health system facing enforcement action over a biased AI diagnostic tool is a credit risk. An insurer whose coverage products depend on AI-driven utilization management faces regulatory exposure as oversight frameworks evolve. The interconnections are real, and the institutions that have not yet mapped their healthcare AI exposure may be operating with incomplete risk pictures.
What Responsible Adoption Actually Requires
The case Shah makes is not one against AI adoption in healthcare. The efficiency, diagnostic, and access benefits of these tools are substantial and well-documented. The case is for governance that matches the pace and stakes of what is already happening.
Responsible adoption requires transparency about how AI systems are trained, what data they use, and where their known failure modes lie. It requires audit mechanisms that can detect bias or drift over time, not just at the point of deployment. It requires clear lines of accountability that specify who bears responsibility when an AI-assisted decision causes harm. And it requires cross-functional collaboration — between clinical leadership, legal teams, compliance officers, and technology vendors — that many organizations have not yet institutionalized.
Healthcare AI has left the lab. The systems are running. The decisions are being made. The hard part is not deploying the technology — that has already happened. The hard part is building the governance infrastructure to ensure that what has been deployed serves patients, providers, and the broader healthcare economy without creating liability vacuums, regulatory blind spots, or inequitable outcomes that undermine the very promise these tools represent.
The window for getting this right is not closing — but it is narrowing. Organizations that treat AI governance as a future concern are already behind.