Bearings

Epic deserves credit for testing its own software this way and saying so publicly. The harder part falls to health systems, which now have to absorb fixes at the pace AI finds problems. Many EHR teams still test updates by hand against long scripts built for a slower cadence. A short, agreed regression list for the workflows that cannot break, automated where possible, turns a weeks-long cycle into days. Review what your audit trail captures and who reads it, and tell patients plainly what your portal will and will not ask them for.

Legacy servers waiting for the last phase of a migration and remote-access appliances with no clear owner after go-live are both easy targets. Set a date for every legacy system that still holds patient data, and treat remote-access appliances as clinical infrastructure with a named owner and a patch window measured in days. When a vendor hosts your data, your contract should say how fast you will hear about an incident and what evidence you will get, because the notification letters will carry your name.

A policy that cannot be checked against what is running is a statement of intent. The organizations in good shape will be able to produce three things on request: an inventory reconciled against actual network and EHR activity, monitoring results by patient group for clinical tools, and a contract term requiring notice of model changes. The coding dispute will be settled the same way, by whether the record supports the diagnosis, and that evidence matters more as coding becomes autonomous.

Agents need the same identity discipline people do: their own credentials, the narrowest scope that works, logs of every action, and a way to stop them. When agents start calling other vendors' agents, those controls have to live outside any one vendor's product. Expect incident reporting for AI agents to become a legal requirement in more places, and write notification terms into vendor contracts now.

Most rural applicants will not be funded this round, and their projects still need doing. The hospitals that move first will phase the work: secure and stabilize the current EHR, connect to the regional exchange, then add telehealth and AI on that base. Funded or not, a plan with defined deliverables and reporting milestones makes a stronger application in the next round.