Peter Bonis, MD is chief medical officer of Wolters Kluwer Health and an adjunct professor of medicine at Tufts University School of Medicine.
Tell me about yourself and the company.
I’m a gastroenterologist. I was at Yale on my first faculty job when I was recruited to join UpToDate as a startup. I joined the company, and along with many other capable people, I was able to lead it to grow, scale, and become a very important information resource that is used by healthcare professionals around the world.
Wolters Kluwer acquired UpToDate in 2008. We became part of a portfolio of information services across different verticals. Those verticals include health, tax and accounting, finance and corporate compliance, legal and regulatory, and corporate performance and ESG.
What are the advantages of presenting clinician-authored or clinician-supervised content at the point of care rather than using the literature search engine approach of some of your competitors?
Let’s frame the issue. Patients expect their doctors to give them the best possible advice. It’s a covenant that doctors would be seeking to counsel their patients with the best possible information.
As it turns out, clinicians have regular questions. When they get answers to those questions, they in fact change decisions about 30% of the time. As readers are out there doing the thought experiment of being with their clinician, imagine that they would change their plan if they had a particular piece of information. Those are the stakes.
We decided to address that information need, which has been well documented, by recruiting a faculty of the best people in the world who are clinically active and who are contributing to the body of knowledge in the area that they are writing about.
We framed the approach by understanding the types of questions at an extremely granular level, having an evidentiary way to look at the body of evidence, make that transparent, rate the level as a recommendation so that it’s highly transparent, and infuse into that the wisdom of these people who are some of the most deeply experienced clinicians in the world.
Human curation not only can summarize the body of evidence, but also can add to that the clinical wisdom and experience of considering factors that are important, such as patients’ values and preferences, to issue recommendations that are granular enough to be used at, or near, the point of care.
Doing that purely as a matter of information retrieval, even with advanced technology, is complicated. The expectation is that that technology can ingest all of that material, present it, prioritize it, and consider all of those factors that I just mentioned to make that experience transparent for both clinicians, and ultimately the patients that they’re serving.
Clinical decision support in its early days pushed guidance indiscriminately on physicians, with the assumption that they should digest it all and also to avoid malpractice issues from not offering complete advice. How do AI-focused tools address that, and could AI itself tailor the content to what an individual physician sees and how they react to the information, such as measuring overrides?
That is the frontier and the challenge, and indeed it’s the opportunity. We have plenty of opportunities to inject knowledge at or near the point of care, both for matters that might be more operationally focused, but also in this high-stakes domain of clinical care. Doing that well can improve care, remove friction, and help to ensure that every patient gets the best possible care, no matter who they are seeing and where they are being seen.
Doing that well is extremely challenging. It requires an enormous commitment to be sure that the experience is as accurate and usable as possible. And where feasible, to include information that is relevant to specific patients and make that experience transparent enough so that the clinician who is ultimately making those decisions can feel confident in the accuracy of that decision, or at least to be sure that they can serve as an interpreter when applying it to the patient in front of them.
To do this well, particularly in this area of decision support, requires a enormous commitment. You have to be sure that all of the different components of that which can break down are done as well as they possibly can be, and to provide an experience to clinicians that is as transparent and as effective as possible.
The business model of massively funded OpenEvidence appears to be running drug company ads that are targeted to the retrieved medical information of the patient. Will clinicians see the ad-supported model as a conflict of interest?
We focus on what we do and have always done well. We have been entirely supported through subscriptions. We have extremely strict policies related to conflicts of interest, particularly among our internal staff, but also all of our 7,500 external contributors, the external faculty and peer reviewers who contribute to UpToDate. We have found that important for maintaining integrity, increasing transparency, reducing bias, and ensuring that our sole purpose is to deliver care recommendations that are clear, unbiased, and free of any commercial taint.
Whether that can be done with a different business model remains to be determined. Ultimately, the market will let us know where the cracks are in that type of a model.
We will continue to do what we do and do well, which is to have a commitment to deliver an effective and easy-to-use experience, focusing on making it easy to do the right thing wherever frontline healthcare professionals are working in their EHR in an enterprise environment or on their mobile devices, Making that experience as free from bias as possible to ensure safety to the best of our capabilities. Providing transparency so that the entire experience is grounded in information that has been curated by humans, and in fact some of the most experienced clinicians in the world.
Will standards of care change as enterprise-associated physicians are provided access to sophisticated knowledge tools while others are financially forced to do without or to use free resources such as ChatGPT?
That’s an excellent point. It really comes down to the matter of how widely governance can be established across healthcare enterprises and small institutions as well. Obviously the governance involved in advanced technology such as AI requires a multidisciplinary approach. It’s not clear that that is going to be available widely for all of the different types of institutions that could take advantage of these technologies.
I do think there is a potential for creating a digital divide, or at least to have some institutions which have governance processes in place and others which may be relying on third parties such as their electronic medical record systems to do that governance process for them.
It ultimately comes down to the safety and effectiveness of the information services, particularly in the high-stakes domain of clinical decision support. For an institution that employs doctors, it’s not just the doctors, but it’s the institution itself that has risk involved, along with the potential benefits of helping to achieve high quality, consistent, and safe care. Having the right information available is certainly a fundamental piece of that equation.
Everybody cites the supposed fact that it takes 17 years to incorporate research findings into frontline care. Will that go away as point-of-care tools can put fresh information right on the screen of the person who is making a clinical decision?
It’s interesting you mention that. The 17-year statement has been cited often, to the point where I decided to hunt down one day the original source of that. In fact, there is documentation, but it’s much more nuanced than that. And in fact, it is not 17 years.
A lot of the adoption of new technologies and new approaches is related not just to having the information available, but also other factors, such as financial incentives, convenience, and superiority over alternatives. But there is a process of information diffusion.
UpToDate since its origins has done very well to accelerate that process. We have, for many years, showcased some of the newer concepts in a specific feature within UpToDate called Practice Changing Updates. It describes what is new to ensure that our subscribers have an efficient way to know when practice has changed because of new studies, new guidelines, or simply new knowledge that has accrued.
Now with more tools available at or near the point of care, including Gen AI, that process will continue. Ideally, as new technologies evolve and new knowledge evolves, we as a system will have an easier time at implementing them for the right patients.
The physician who is making decisions from the EHR may be presented with patient summaries or suggestions, information they already know but might miss, and new information that they are seeing for the first time. How do you present that without overloading them data they don’t need?
It’s an excellent point. Doctors are overloaded, and that fact is critical to consider.
Studies have looked at the number of tasks that clinicians have to perform to fulfill all of the requirements that are expected of them. Primary care, for example, would have to have about 26.7 hours per day to complete all the tasks that are required. That is impossible to achieve, obviously, so there’s always a matter of triage. Designing systems that do not produce a cognitive overload is a critical part of the overall design process, and also the approaches of who should be doing what. It doesn’t always have to be clinician facing.
The potential for overloading clinicians is absolutely there. Many organizations are seeking to have that mindshare and to inject knowledge in front of clinicians, and all of it can’t be done. It has to be prioritized and it has to be effective. How that will look is still a work in progress. There are many efforts to do this using advanced technologies, but there’s also a long track record of what works and what doesn’t work.
I’m optimistic that we can do better and that these advanced technologies will have an important role, but the devil is in the details. How will this work within workflow systems? What will the interaction look like with the data that are available within the clinical record, and perhaps even from other sources, to create an experience that helps frontline providers and their patients? That will be the journey that we’re on.
If I can digress for a moment, what is happening to the patients in all of this? All of what we are talking about is taking place in the background, when there is an enormous erosion of trust in healthcare services and healthcare professionals taking place in the backdrop. Patients are increasingly fed up. They are looking for alternatives. The healthcare system is increasingly unaffordable, and it delivers variable quality of care depending on where you are, your level of insurance, and other factors as well.
In more recent surveys this year, 15% of consumers don’t trust their doctors, which is up from 7% in 2023. Only 24% believe that their healthcare systems are focused on caring for patients, down from 77% in 2020. Instead, about three-quarters believe their hospitals are mostly focused on making money.
This process of busyness and the business of medicine is having a fundamental effect, not only on clinician burnout and the actual care delivery, but in a very fundamental way around trust and the experience that patients are having. Ideally, technology will help this problem, both for frontline providers and for patients who are seeking to have a better, more affordable experience.
We are in that potentially awkward phase where some physicians aren’t interested in technology for technology’s sake, but digital natives are coming out of medical school who can’t wait to do everything electronically. How will that change the way that physicians are educated and then trained?
There has already been an organic adoption of technologies, particularly by younger clinicians and those who are trainees. That has been going on for a very long time. It’s really no different that an adoption cycle occurring with Gen AI as well. Although it’s not uniform, clinicians of all ages and career statuses are facile at adopting technologies for it.
But I do think it will change education in many ways and we’re on that journey as well. One is where AI fits into traditional education and the awarding of continuing medical education credits. Is an AI experience and AI-generated content sufficient and trustworthy, for example, to award continuing education or CME credits?
For students, can you adapt these technologies to support a more effective learning journey and a lifelong learning journey? Certainly AI has been applied for adaptive learning. We at Wolters Kluwer have had a lot of experience in this area, and there are opportunities there.
There’s also training around healthcare professionals being an effective consumer of information services. And particularly now, to understand the limitations of Gen AI and how its convincing and compelling answers can make us falsely believe that they are accurate when they clearly need more interrogation.
A final point is that there is an emerging literature about the degradation of learning from overreliance on Gen AI tools. There is some empirical data that reliance on Gen AI tools might lead to a decreased ability to retain and then to apply that knowledge in other settings. That’s a fundamental pedagogical change. Where this comes out and how educators will approach all this remains to be determined.
For the moment, clinicians at all levels, including trainees, are adopting Gen AI tools. It’s important that the tools that they are adopting to lead to their training and to patient care will be effective, safe, and reliable over an extended period of time.
What about AI governance?
Governance is important. It is tempting to use tools that are expedient. In fact, they are so compelling that there’s a tradeoff that I think clinicians are willing to take around expediency when they haven’t really taken a sharp look at what’s being traded off for accuracy, reliability, and some of the other dimensions of challenges related to the core technology.
The word that I’d like to get out is the emphasis on adequate governance. That can be by a third party, such as the electronic medical record vendor who is forwarding and embedding these tools, or the governance committees themselves at institutions. They need to be sure that all the tools that they are onboarding that are provider-facing, or that take advantage of advanced technologies, are properly vetted, scrutinized against important benchmarks, and transparent. If there are deficiencies, you have the tools necessary to understand those deficiencies over time in domains like we operate such as decision support, where a right and wrong answer to an untrained eye or even to a trained eye can look equally good.
You need a gold standard to be sure that each answer is complete, accurate, and contemporary. That’s hard to do, but nonetheless, that’s the work that needs to be done to be sure that we’re helping all the healthcare professionals live up to their covenant and deliver the best possible care for their patients.
How do you choose a company strategy when AI and other technologies change literally every day?
Across Wolters Kluwer, we have a lot of experience with adopting advanced technologies. Across our verticals, we have already released more than 20 Gen AI related products and services. We are reinvesting constantly into advanced technologies and innovation, including AI, SaaS, blockchain, and other emerging technologies.
In the area of clinical decision support, such as what UpToDate provides, we have to really live up to our own standards in this high-stakes domain. There’s an evolving regulatory framework, but we understand our North Star. We understand in constructing this content that we are part of a medical community. We adhere to those standards. We have 55 physicians who work for UpToDate as deputy editors. Many of them are still in practice, mainly in academic medical centers. So the culture is one of patient safety, of seriousness, of understanding that there is a live patient somewhere behind all of our computer screens.
We have taken our time, as we have looked at the advances and particularly in Gen AI and how they can be applied, so that we adhere to our own standards and the standards that have been expected for our more than 3 million users out there. That means very, very careful product development and extensive testing. We’ve had a lot of innovation around ways to ensure reliability, accuracy, and validity, including not having the known pitfalls of Gen AI solutions like the degradation of context.
These things are very important. Generic Gen AI tools, for example, may recommend drugs that can be unsafe because they don’t ask contextual questions such as, is the patient pregnant? We have found examples of generic Gen AI tools that recommend drugs that are potentially perfectly suitable for the condition, but not if the patient is pregnant or they could be harmful to the fetus.
There have been many examples like that, so we have to understand the limitations of the technology and understand where the technology is going. We grounded it in this database that we have built over 30 years, which is not only summarizing the evidence, but infusing it with the clinical wisdom of deep experts drawn from a faculty around the world.
It’s our own commitment, our own standards, that are deferential to what is expected of us from our customers and the responsibility to take our time to test, release slowly, develop feedback mechanisms, and ground exclusively in UpToDate not the chaos of the internet, and in my view, create one of the most effective Gen AI solutions for decision support that currently exists.
Virtual primary care provider LifeMD sells its majority ownership of WorkSimpli Software for $22 million in cash plus performance incentives.
AI clinic employee management platform vendor Planbase announces its launch and $2.1 million in funding.
Mayo Clinic announces Mayo Clinic Platform_Insights, which gives healthcare organizations access to its AI-driven clinical and operational expertise for digital solutions implementation.

Healthcare AI agent vendor Hippocratic AI announces $126 million in Series C funding, bringing its total raised to $404 million at a valuation of $3.5 billion.
The company, which launched in 2023, will use the investment to globally scale its software and pursue mergers and acquisitions.
From Rude Boy: “Re: Wellsoft. After CareCloud’s acquisition of Medsphere’s assets, they declined to offer positions to key Wellsoft staff, which will effectively sunset the Wellsoft product. Whether this is CareCloud’s intent is TBD.” Unverified. Medsphere acquired the ED EHR vendor Wellsoft in early 2019, also bringing on founder and CEO John Santmann, MD as CMIO. CareCloud closed its acquisition of Medsphere in August 2025.
From AzDave: “Re: Clinisys. Laying off as we speak!” Unverified. But honestly, are there any health tech companies that aren’t laying people off? The best you can hope for is that they hold off until after New Year’s, though I can’t remember a year when at least one cluelessly desperate outfit decided that it wasn’t beneath them to ruin the holidays for its allegedly valued associates and their shocked families.

My aged car has a CarPlay-capable touch-screen entertainment system that works with my phone only if it is connected via a standard Lightning-to-USB cable. The phone then maddeningly disconnects at the worst possible navigational moments with the slightest jostling in its drink holder home, which probably means that either the port or the car unit itself is flaky. Enter this $17 dongle that takes about 30 seconds one time to pair with the phone via Bluetooth, after which the CarPlay panel comes up every time the car is started, the phone can remain pocketed, the cable can be retired, and I don’t forget to repocket the phone from the aforesaid drink holder upon egress. The gadget might fall just shy of being a change-your-life solution, but it’s close enough for $17.
None scheduled soon. Contact Lorre to have your resource listed.

Healthcare consulting firm Canopii Collaborative acquires Anchor Healthcare Consultants. Anchor co-founder and CEO Joe Galea will become principal of Canopii’s provider solutions segment.
Popai Health, which offers AI-powered care coordination call technology, announces $11 million in new funding.
Risk adjustment and clinical quality solutions vendor Vatica Health acquires Cozeva, which offers value-based care enablement software. Both companies are #1 rated in Best in KLAS in their respective categories.
Remote robotic surgery company Sovato closes a Series B funding round that increases its total raised to $41 million.
Virtual primary care provider LifeMD sells its majority ownership of WorkSimpli Software for $22 million in cash plus performance incentives. LifeMD paid $1.25 million for its stake in the PDF and signing solutions vendor starting in 2018.

AI clinic employee management platform vendor Planbase announces its launch and $2.1 million in funding.
HealthStream announces Q3 results: revenue up 4.6%, EPS $0.20 versus $0.19, beating expectations for both.

Veradigm names Tehsin Syed (AWS) chief product and technology officer.
Netsmart launches an AI-powered clinical coding solution for post-acute and human services providers.
Intelerad will deliver a cloud-native medical infrastructure that uses Amazon Web Services HealthImaging. The AWS-hosted system will consolidate PACS, VNA, and image sharing workflows into a single back-end system.
Mayo Clinic announces Mayo Clinic Platform_Insights, which gives healthcare organizations access to its AI-driven clinical and operational expertise for digital solutions implementation.

Athenahealth introduces an AI-native EHR clinical encounter for AthenaOne that includes an ambient scribe and a clinical co-pilot.
Orlando Health’s South Lake Hospital launches a wearables pilot program for COPD patients using devices and software from B-Secur, Whoop, and Sensr.

University Medical Center (NV) opens an Online Care Connection Center to help patients access virtual care in the rural area of Laughlin.
MaineHealth Patient Financial Services mistakenly sends letters to 531 living patients announcing their deaths and offering their next of kin instructions on how to settle accounts. The health system has attributed the correspondence to a software malfunction.
Blog Posts
Mr. H, Lorre, Jenn, Dr. Jayne.
Get HIStalk updates.
Send news or rumors.
Follow on X, Bluesky, and LinkedIn.
Sponsorship information.
Contact us.
![]()
Healthcare AI agent software vendor Hippocratic AI announces $126 million in Series C funding, bringing its total raised to $404 million.
Healthcare consulting firm Canopii Collaborative acquires Anchor Healthcare Consultants.
Popai Health Raises $11M to Transform Care Coordination with Voice AI
Popai Health, which offers AI-powered care coordination call technology, announces $11 million in new funding.
The American Medical Association recently announced the launch of its Center for Digital Health and AI. It stated that it was “created to put physicians at the center of shaping, guiding, and implementing technologies transforming medicine.”
AMA leaders went on to say, “The new Center will tap the full potential of AI and digital health by embedding physicians throughout the lifecycle of technology development and deployment to ensure it fits into clinical workflow and physicians know how to utilize it.”
It’s a nice sentiment, but it feels aspirational. I don’t think the AMA has the resources to embed physicians anywhere, let alone in the spaces where this kind of development is happening.
The statement add that AMA will create policy and provide leadership in the regulatory space; provide “knowledge and tools” for physicians and care delivery organizations to integrate AI into their practices; collaborate with tech, research, government, and healthcare to drive innovation; and creating opportunities for doctors to shape AI and digital tools so they work within clinical workflows and enhance patient and clinician experience.
The latter is particularly interesting to me. How, exactly, will they be creating these opportunities? Some US care delivery organizations refuse to acknowledge the value of the CMIO role, so perhaps they can start by lobbying those folks. Oracle Health has eliminated a tremendous number of physician roles. Will the AMA demand that product teams receive adequate input from physicians who have formal informatics training and experience?
If you surveyed a room full of physicians, I’m not sure they would identify the AMA as an organization that looks out for the interests of frontline clinical providers. In the 1950s, approximately 75% of practicing physicians were members of the AMA. The best estimates I could find for recent years had estimates between 12% and 20%. If that’s accurate, it shows that physicians are voting with their pocketbooks. Dues are $420 per year for practicing physicians, which is a lot to ask from folks who don’t feel that the membership brings value.
It seems like an uphill battle advocate for more physician involvement in the development and implementation of AI tools. Organizations that already see the value of having physicians involved in the process are doing so. Given the cost of hiring a physician, it would be a hard sell for those that don’t already have a line item for that expertise in their budgets. A number of my physician informatics colleagues are concerned about keeping their current roles, since we’ve seen numerous CMIO and informatics roles eliminated either as part of the ever-growing list of health system mergers and acquisitions or just as a part of general restructuring efforts.
It will be interesting to circle back to this press release in six to 12 months to see if the AMA has gained traction with its efforts.
Speaking of look-back efforts, I took a look through my own retrospectoscope this week when I was digging through some paperwork. I found a sheet of notes from an AI symposium last year. It was about the impacts of generative AI on physicians, and featured a couple of physician executives talking about their health systems’ use of AI. I have a habit of capturing quotes when people are speaking. Some of the comments still ring true, but others haven’t stood the test of time. Let’s take a look:
My favorite quote was when one of the speakers encouraged the audience (which included not only clinicians but also IT, operations, and finance colleagues) to “go play with ChatGPT and try to make it do the part of your profession that you hate.” It’s an interesting challenge, although I struggle with trying to find ways to add AI tools to my non-clinical workflows. I’m curious what others have done and whether it’s really making your work life better or if you have seen unintended consequences.
What odious parts of your work have you outsourced to AI tools? Have you been unsuccessful in automating others? Leave a comment or email me.
Email Dr. Jayne.
HLTH: Healthcare’s Burning Man for the Well Funded
By Anonymous
I’ve been around this industry for decades. I have to admit that I’m still trying to wrap my head around all these newfangled conferences like HLTH.
Back in my day, HIMSS was the gold standard. Everyone knew it, everyone went, and you could count on a certain level of professionalism.
HLTH, on the other hand, feels like it’s out of control. I remember when it started in 2018 as just a small gathering in Las Vegas. It has apparently ballooned to 12,000 attendees and 900 sponsors. I guess that’s progress, although I’m not sure it’s all for the better.
When I went to my first HLTH a couple of years back, I was struck by how different it felt. Most companies had the same booth size, so you would think the focus would be on substance. Still, there were a lot more “tech bros” than I’m used to, with lots of sneakers and puffer vests but not many suits. It was supposed to be about conversation and content.
Now we have big booths with espresso machines and ice cream carts. Honestly, it felt more like a popularity contest. Maybe I’m old-fashioned, but I miss the days when people were more interested in building real relationships than just being seen.
HLTH also doesn’t seem to care much for academic rigor or peer review. At HIMSS, you could count on presentations that were vetted and at least acted like they had substance. At HLTH, it feels like speakers are chosen for how much noise they make online, not for what they actually have to say. Most presentations are just opinions and visions, not proven results.
I suppose HLTH never claimed to be academically rigorous. They say they are about “healthcare innovation and societal well-being,” whatever that means. I’ve always believed that lofty goals are fine, but in healthcare, you need something concrete. I’ve seen plenty of big companies come and go, thinking they could fix healthcare, only to leave with their tails between their legs.
There were some positives at the 2025 HLTH conference, such as Kroger and Walgreens giving flu shots. But I ran into plenty of vendors who couldn’t explain what they actually do. I even asked a CEO for a simple elevator pitch, and all I got in return was a finger pointing to an iPad and a questionnaire. If you ask me, that’s not a good sign. Nobody bothered to ask about my organization or my needs, even though I have buying authority.
This year, HLTH was crawling with so-called “influencers.” I’ll be honest, I don’t care much for that term. Most of these folks seem more interested in building their personal brands than in driving real innovation. Some have medical degrees but never finished residency or got board certified. They’re quick to share opinions on topics where they don’t have much expertise. Their LinkedIn profiles are full of adviser roles and startup credits, but it’s hard to tell if they have actually accomplished anything.
There was even a dust-up online about a group of “physician founders” flying to the conference on a private jet, courtesy of an anonymous sponsor. The LinkedIn post and group photo were deleted after some backlash, but it makes you wonder how many of these folks still practice medicine.
HLTH seems to encourage this influencer culture, handing out free passes if you agree to post about the conference nine times. You could spot them in the exhibit hall, always taking selfies and blocking the aisles. They even had their own lounge.
Another trend I just don’t get is all the rebranding. Companies spend a fortune changing logos and colors, then throw parties to celebrate. Wouldn’t that money be better spent on employees or helping out struggling healthcare organizations? HLTH is also the time for big corporate announcements, most of which don’t mean much once you read the fine print.
And don’t get me started on the entertainment. The opening event was at Topgolf, way off the strip, and you needed a shuttle to get there. It just reinforces the old “business is done on the golf course” mentality. The Industry Night at Drai’s Beach Club was another example of excess. I even witnessed some pretty bad behavior at the casino bars, stuff I thought we had moved past.
Sponsors also go overboard with their own parties. I got at least 20 emails inviting me to events, but most required a certain profile to attend. Sometimes you had to apply, and even then, you might get rejected or have your invitation rescinded at the last minute. That’s just bad manners and bad business.
I didn’t bother with the hosted buyer program, even though I’m a budget owner. From what I overheard, it’s basically speed dating for vendors, and I heard some complaints from vendors that the buyers they met with acted bored, as if they were just doing it for the discounted registration.
Bottom line: HLTH and vendors need to take a hard look in the mirror. It’s become too much of a party, with way too much extravagance. In a year when care delivery organizations are facing more uncompensated care and cuts to Medicare and Medicaid, all this glitz just feels out of touch.
I will run pieces whose author prefers to remain anonymous, although they must submit it to me under their real name so I can check for credibility and conflict of interest.
Dan Dodson, MBA is CEO of Fortified Health Security.
Tell me about yourself and the company.
I have been in cybersecurity since about 2014, and in healthcare IT for 20 years. Fortified Health Security is a cybersecurity company that is focused exclusively on healthcare. We provide two kinds of services, advisory services and our managed security service provider business, or MSSP, for 24×7 monitoring and management of cyber technologies.
How does a healthcare-focused cybersecurity firm work differently than a more generalized company?
The attacks, adversaries, and the vectors they use are similar to other industries. The difference is how you respond to those threats and adversaries and risk reduction.
We believe strongly in having a knowledge base and an understanding of how healthcare organizations work, not only from a governance and regulatory perspective, but regarding infrastructure, legacy applications, mixed environments, EHRs, and medical devices. We build our playbooks and recommendations to take those elements into consideration. Our clients get more actionable intelligence so their teams can respond and take actions faster with the intelligence that is infused into our recommendations.
The top things organizations are trying to work through are AI, third-party risk, and training and awareness. Those three things are what organizations are talking mostly about with us.
What findings have surprised you in performing security risk assessments?
One surprise that we see is that everybody is at a different spot, and the weaknesses and the opportunities to improve are pretty vast. We’ve seen a lot of organizations make investments in different areas, some of which are reducing the risks that they set out to do. Sometimes they have opportunities for improvement. But as they’ve built their program over years, some areas tend to have significant gaps.
Third-party risk is a big area where organizations are struggling to tackle those challenges. Obviously with the rise of AI, we are in the early innings of understanding that from a risk perspective at the client side.
A lot of conversations are happening around end-user training and development. It’s a big challenge to actually drive better utilization of the tools to combat phishing, et cetera.
Are easily guessed or shared passwords still a big problem?
That certainly is still a challenge. The vast majority of compromises that could lead to a breach of data involve the end-user clicking on an email and giving up their credentials into a phishing email. Then the adversary comes in, moves laterally across the environment, and ultimately causes havoc. That’s still the number one entry point, so organizations are focused on combating that.
It seems like tools should have gotten sophisticated enough to block the clicking of suspicious links.
Tools are out there, and not having a tool would certainly increase your exposure. But this is an area where the adversaries are good. They are able to navigate around those tools and ultimately end in the inbox.
We see organizations thinking about how to reduce that attack surface. Do I have employees within the healthcare organization that maybe don’t need external email to execute their job? That’s a little bit of a culture challenge, because in the US, people associate their employment with having email. No one really talks about that. It’s the norm.
We are seeing some creative designs around that to make sure that we are limiting the attack surface. There are actually some cost benefits as well, such as fewer licenses for whichever email that you may use.
The other approach is training end users. A recent development is that most people are familiar with someone who was compromised personally for some type of phishing attack. Or, they have been impacted by breaches at Target or Nordstrom’s. One part of training is whether to focus more on the personal side and helping users understand how to protect themselves at the individual level. That would ultimately increase the level of protection for the organization.
What about users logging into their company email from personal devices?
That is still an issue. BYOD is prevalent. We have a lot of contract labor. If you live in a metro area, physicians have multiple privileges at multiple facilities.
Who is winning the AI war between hackers and organizations?
I think the data would would tell us that the adversaries are being more successful. Breaches are continuing to occur. If you look at the Office for Civil Rights, the number of breaches year over year is stabilizing, but the impacts are getting larger. So I would say that, unfortunately, the adversaries are probably winning that fight. The adversaries are also using AI to launch more sophisticated attacks, both via email and help desk voice impersonations. They are definitely leveraging AI to hit us on all fronts.
How is the government’s role in healthcare cybersecurity changing?
Our view is that we are in a little bit of a standstill. There was a lot of energy at the end of the Biden administration. Senator Warner was leading that charge. Frameworks were put in place for programs that would provide clear expectations, along with some monetary support in a carrot-and-stick model to adopt said frameworks.
But a lot of that has stalled. The current view is that we may see tweaks to frameworks and expectations, but monetary support coming alongside that is probably off the table, at least in the near term.
Hackers have threatened to report their breach to HHS or have contacted individual health system executives, board members, media outlets, and even patients to threaten to expose breach information in hopes of getting a ransom payment. How do you address that dynamic, especially knowing that you wouldn’t be paying the most of honorable people with no recourse if they don’t deliver?
That’s the biggest challenge if you have a ransomware event or active breach that ends up in some type of negotiation. Thinking about adversarial intent, bad actors come after us to begin with because it’s monetary. They will pull all the strings that they can to create as much leverage against that organization to increase the likelihood of payment.
Also driving that behavior is class action lawsuits. Attorneys who used to chase car wrecks and malpractice cases have turned their eyes to cyberattack class action lawsuits. The adversaries know that, so they will weaponize that against the victim that is under attack. They will pull the strings on anything they can do to increase the likelihood of payment.
What are the advantages of organizations moving from point tools that are monitored by understaffed internal security groups to moving to a more centralized approach?
In most healthcare delivery organizations, teams are quite small. A lot of those individuals have been at that healthcare organization for a number of years and have made their way to the cybersecurity team. Health systems in general are not the best at training and having dollars available to train resources.
How do we make those individuals who have institutional knowledge about the networks, environment, and culture of the organization as effective as cyber warriors as possible? We partner with those organizations to bring high-fidelity, actionable information to that team so that they can take quick and swift action.
As far as which service or what opportunity, I would just tell you that every healthcare organization is at a different point in their cybersecurity journey. They have made prior investments. Can our organization plug in, leverage existing investments, and operationalize that in a more efficient way to ultimately drive down risk?
One of your reports about downtime preparation quoted a chief nursing officer whose hospital experience an unanticipated problem because young nurses couldn’t read the cursive handwriting that doctors used to write paper orders. Is it common to find problems during downtime that weren’t anticipated in the plan?
Almost every time. Organizations do their best to prepare for downtimes that are short in duration. Hospitals go on diversion a lot for various reasons that have nothing to do with cybersecurity. They have downtime when they have to patch a system, implement a system, or upgrade a machine. We are relatively good at doing that for a short period of time. The challenge arises when you are down for a long duration and you don’t really know how to manage through days or weeks of not having access to the systems.
That’s driven by a couple of things. One, we are heavily reliant on systems when delivering care, whether that’s the EHR or the hundreds of other applications that power these health systems. So when they are down to some degree, the clinicians are frozen in their normal work habits. Anxiety and nervousness sets in because they want to take care of the patients, but they don’t have the technical controls in place to ensure that they provide swift, quality care. It slows down the care delivery model significantly.
Calculating is another issue we see. How am I calculating if I’m making an order for a particular medication? Med reconciliation is another thing that drives a lot of nervousness, making sure that I’m giving the right meds at the right dose to the right patient. Most of that at scale is done electronically, and that becomes an issue.
Communication is also another big challenge that we see. How are we communicating as a team if we’re using some type of a pager system or a walkie-talkie-system like Vocera and it’s down? That’s how we are used to communicating.
Lastly, a lot of the younger physicians have never operated in a world where they haven’t had technology. They were trained on an EHR at med school and they’ve been delivering care for years while being guided by electronic systems.
How do you advise organizations to deploy resources to protect their ever-increasing reliance on external technology vendors?
Step one is understanding how you interact with those third parties technically, so that if they have an event, you can take quick action to sever ties to limit the disruption to your organization from an adversarial perspective. But then comes the challenge that you need that system to deliver it, but the reality is that for the hundreds of systems that are that are in these healthcare delivery organizations, there’s not enough dollars to have backup systems for every single one of them. It’s unrealistic, both monetarily and operationally. That would also double your attack surface, so it’s not necessarily recommended. The first step is getting your arms around all of your third parties.
Step two is determining what the interaction is between your organization and those third parties.
Step three is putting in some contractual language and some compensating controls on your side to try to limit the downtime.
Step four is that as you think about the disaster recovery plan, work with your clinical teams to understand how they would operate with certain critical systems down. Start with the ones that are most useful clinically and are most widespread so that you have some type of backup plan in place in the unlikely event that it’s unavailable.
What is the company’s strategy over the next few years?
Our strategy is to continue to work with healthcare organizations to increase their cybersecurity posture. We believe very strongly that a coordinated, programmatic approach through various elements of their cyber program can help minimize that risk. We are going to invest in our central command platform, which is our service delivery platform that provides actionable information and drives results across their entire organization to reduce risk.
Waystar Reports Third Quarter 2025 Results
Waystar reports Q3 results: revenue up 12%, EPS $0.17 versus $0.03, beating expectations for both.
Medical Technology Company Expands in Oakland County, Creating Over 107 new jobs
Remote therapeutic monitoring software company PtMantra will expand its operation in Wixom, MI through a collaboration with affiliate IT consulting firm Youngsoft.
YNHHS reaches preliminary $18 million settlement over data breach
Yale New Haven Health System (CT) will pay $18 million to settle a class action lawsuit related to a March 2025 cybersecurity breach that affected 5.5 million patients.

Waystar reports Q3 results: revenue up 12%, EPS $0.17 versus $0.03, beating expectations for both.
WAY shares are up 73% since its June 2024 IPO, valuing the company at $7 billion.
CEO Matthew Hawkins said in the earnings call that Waystar’s $1.25 billion acquisition of Iodine Software in October 2025 extends its data coverage across all RCM phases and will enable development of AI-based products that autonomously manage revenue cycle functions.
From Decent Undercarriage: “Re: Epic consulting. Redditors are discussing a LinkedIn post that says Epic is calling out certified analysts who are billing multiple clients, aka double dippers.” A since-removed LinkedIn post claims that Epic is sending quarterly reports to health system executives that list employees and consultants who are using multiple logins across organizations. The author says some of those folks have been terminated without a chance to explain their situation, even when their extra hours were legitimate, such as moonlighting. The post also refers to individuals who are billing 160 or more hours per week.
I think most poll respondents recognize the achievement of earning a doctorate in anything. However, more than half say that hospitals should limit the title’s use to medical doctors.
New poll to your right or here: Do health systems create a conflict of interest by promoting or using technology from for-profit companies that they partly own? I’ve noticed a trend of posting glowing press releases about successful technology rollouts at major health systems, only to find in the fine print that the health system is also an investor in the company and thus unlikely to utter a discouraging word.

It’s that annual time when I pretend to be a performative marketer instead of a hospital IT nerd lifer whose hobby is spending part of every day filling blank computer screens. If your company has been meaning to sponsor HIStalk “someday,” this is your nudge to do so before December 31. You get free months, startup perks, and a special nod if you are a former sponsor who returns to my little fold. Email Lorre while I’m briefly focused on feeding the financial beast of keeping HIStalk running instead of obsessing over writing it.
None scheduled soon. Contact Lorre to have your resource listed.
Virginia Commonwealth University pursues the purchase of a 450,000-square-foot former tobacco company building to house drug and cancer research and to increase the capacity of its public health and pharmacy programs.
Health insurers will fight profit-sapping medical costs by using AI to counter what they say is the AI-driven aggressive claims coding of providers.

You may be unaware that private equity firms own an increasing percentage of US hospices. You may be unsurprised that their hospices make the most money, spend less on patient care, and shift care to nursing facilities whenever possible to push medical costs onto someone else.
A Black Book Research survey of health tech vendor executives finds that health system cash worries, many of them triggered by the federal government’s shutdown, are prompting project pauses, RFP delays, and a shift toward revenue-producing initiatives.
A study finds that asynchronous, text-based depression therapy is just as effective as real-time video sessions. Most insurers don’t cover it, however.
OpenAI says that it will deliver an AI intern-level research assistant by September 2026 and a fully capable scientific researcher by 2028, also predicting that deep learning systems will reach superintelligence — systems that are smarter than humans — within the next decade.
Yale New Haven Health System will pay $18 million to settle a class action lawsuit related to a March 2025 cybersecurity breach that affected 5.5 million patients. The health system has not confirmed reports that the attack involved ransomware.
Dilbert creator Scott Adams will ask President Trump to intervene in his quest to obtain chemotherapy for prostate cancer. A course of Pluvicto costs about $300,000. Clinical trials showed that it extended average survival from 11 months to 15 months, although other studies found that the drug had no impact on lifespan.
Blog Posts
Mr. H, Lorre, Jenn, Dr. Jayne.
Get HIStalk updates.
Send news or rumors.
Follow on X, Bluesky, and LinkedIn.
Sponsorship information.
Contact us.
![]()
Thermo Fisher strikes $9.4bn acquisition of Nordic Capital and Astorg-backed Clario
Thermo Fisher Scientific will acquire clinical trials software vendor Clario from its private equity owners for $9 billion in cash.
Layoffs hit Bellingham caregivers as PeaceHealth announces 2.5% workforce reduction
PeaceHealth will reduce its workforce by 2.5%, with 13 informaticist positions and chief health information officer job listed as eliminated positions.
WellSky Launches AI-Powered Ambient Listening for Specialty Care EHR
WellSky enhances its Specialty Care EHR with ambient listening using Suki’s solution, which it found reduces documentation time and after-hours work by 40%.
CVS Health reports Q3 results: revenue up 7.8%, adjusted EPS $1.60 versus $1.09, beating analyst expectations for both.
The company took a $5.7 billion impairment charge for its Oak Street Health business that focuses on Medicare Advantage primary care patients and value-based care.
An executive said in the earnings call, “And lastly, our operating platforms, a tremendous amount of credit goes to our leadership in this business is driving to a much more tech-driven AI native platform that’s driving and really taking a lot of the work out a lot of operations and something that was one of the most complex parts of healthcare, which is effectively trying to drive these medications into the patients’ homes.”
From The Chart Whisperer: “Re: AI-free periods for physicians. Let’s lock the autopilot and see if they still know how to fly. Spoiler: some don’t, so then what?”
From MarginMatters: “Re: hospital innovation. The biggest threat isn’t a lack of technology, it’s misaligned incentives. Every tool that improves quality but reduces billable volume fights a losing battle with the revenue cycle. That’s why most planned uses of AI involve cranking out bills, reducing costs, or increasing widget volume (visits).”
None scheduled soon. Contact Lorre to have your resource listed.
Teladoc Health reports Q3 results: revenue down 2%, EPS –$0.28 versus –$0.19, beating analyst expectations for both. Its BetterHealth virtual behavioral health business continued its slide with another revenue drop. TDOC shares have lost 8% in the past 12 months, valuing the company at $1.5 billion versus its $45 billion market cap in early 2021 shortly after it acquired Livongo for $18.5 billion.
Thermo Fisher Scientific will acquire clinical trials software vendor Clario from its private equity owners for $9 billion in cash. The company’s analytics software was used in 70% of US drug approvals.
Telemedicine kiosk maker OnMed will go public via a SPAC merger.
PeaceHealth will reduce its workforce by 2.5%, with 13 informaticist positions and chief health information officer job listed as eliminated positions.
Health insurer EmblemHealth and Prime Therapeutics launch a pharmacy benefit model that uses Judi Health’s cloud platform and Amazon Pharmacy to deliver transparent drug pricing, real-time savings alerts, and digital prescription management. The partnership aims to make specialty drug access simpler, faster, and more affordable for members.
Healthmonix launches Prism, a unified quality-reporting and interoperability platform that supports healthcare organizations through shifting CMS models such as MVPs, TEAM, and ASM.
Altera Digital Health launches CareInTelligence, a cloud-native data platform that unifies fragmented healthcare data for payers, providers, and community outreach organizations, enabling actionable insights, custom reporting, and governance controls to advance care delivery and outcomes.
WellSky enhances its Specialty Care EHR with ambient listening using Suki’s solution, which it found reduces documentation time and after-hours work by 40%.
Updated Affordable Care Act pricing on Healthcare.gov shows that premiums will increase an average of 26% for 2026, with a 114% increase if Congress fails to extend ACA tax credits.
In Canada, Saskatchewan’s health minister orders the health authority to stop using the staff scheduling module of the AIMS system, whose implementation has faltered several times since its 2021 launch, and revert back to the system it replaced. The AIMS project, which will cost triple its original budget at $175 million USD, has been relaunched multiple times due to pay and scheduling problems. The province will continue to use the software’s payroll and supply chain modules.
The New York Times covers the use of fall detection and prevention technology in assisted living facilities, mentioning vendors Foresite Healthcare and SafelyYou. It notes the privacy concerns of residents and the occasional deployment of such systems without obtaining informed consent.
Blog Posts
Mr. H, Lorre, Jenn, Dr. Jayne.
Get HIStalk updates.
Send news or rumors.
Follow on X, Bluesky, and LinkedIn.
Sponsorship information.
Contact us.
![]()
Sometimes reader comments make my day. One did earlier this week, when Data Diva accused hospital boards of “trying to cosplay as tech bros” and suggested that we consider “automating leadership bloat before automating bedside care.”
This inspired me to see whether a large language model could do a better job than hospital administrators at certain tasks. I asked Microsoft Copilot to assume that I am a hospital administrator trying to figure out how to make life better for the nurses who work at my hospital. I then asked, “How would they like to be rewarded for their hard work?”
I was pleased with Copilot’s response. Nurses deeply value recognition that feels personal, meaningful, and supportive of their well-being and professional growth. A mix of financial, emotional, and developmental rewards works best.
The response went on to suggest a combination of authentic recognition and appreciation, such as peer-to-peer recognition programs, along with fair compensation and financial incentives. Competitive salaries were specifically mentioned, along with ensuring that pay aligns with industry standards and reflects experience and performance. Performance-based bonuses and spot rewards were listed, as were tuition reimbursement, paid training, and clear opportunities for promotion and skill building.
Other suggestions included flexible scheduling, additional time off, and mental health support. Copilot went on to recommend that recognition be embedded into daily culture, “not just during Nurses Week,” and that rewards should be tailored to individual preferences to “ensure all staff feel seen and valued.”
It went on to ask if I wanted help designing a nurse recognition program tailored to my hospital’s culture and budget. I threw out a random number and asked what I could get for $100 per nurse. Suggestions included a customized thank-you box; a voucher for an experience, such as a massage or yoga class; branded gear, such as a high-quality fleece jacket, tumbler, or tote; a continuing education stipend; extra PTO, a coupon for a flexible shift swap; or a gift card for healthy meals.
Nowhere did it recommend pizza parties or challenge coins. For that alone, I can conclude that LLMs are better than actual hospital administrators. I ran these items past a couple of nurses and they were on board. Administrators should take note before they wind up being replaced by an AI assistant.
I was feeling a little punchy, so I went on to ask, “Do nurses like pizza parties?” Copilot was again accurate: pizza parties are appreciated as a kind gesture, but most nurses view them as insufficient on their own. They prefer meaningful recognition, support, and resources that address their real challenges. Copilot went on to suggest that pizza parties are “symbolic but shallow” and “can feel tone deaf” since they don’t address deeper needs such as burnout, staffing shortages, and lack of support.
Without prompting, it instead recommended authentic recognition, work-life balance elements such as flexible scheduling and adequate staffing, professional growth and career advancement opportunities, and mental health support. It went on to recommend that “if you still want to host a pizza party” that leadership should pair it with something meaningful and also make it inclusive and convenient, specifically recommending making sure that the night shift can participate. Winning the hearts of the night shift is pretty smart, so two points for Copilot.
I’ve had some medical adventures over the last year and have several important physician appointments pending. I’m always tuned in when I receive an email or text saying that I have a new message in my chart. I admit it triggers a bit of a fight-or-flight response. I was less than thrilled when I logged in to find that the message was letting me know that the hospital is having phone issues I should use the patient portal instead if I need to contact a physician. Health systems should be able to flag these kinds of communications as “non-urgent” or “a general communication from your health system” header so that patient anxiety isn’t provoked.
Pet peeve of the week: people who keep sending broken web links even though you’ve told them that the link is broken. I have been working with a vendor rep who keeps sending me documents to review. I dutifully report the broken links, but each subsequent includes the same broken links. If I can’t trust that you’re reading my emails and taking action on my requests to send content that I can actually view, I’m not sure you’re the kind of person or organization with whom I’d like to do business.
This article about AI-free periods for physicians caught my eye. It points out concerns for “deskilling” that is due to overreliance on technology. Singapore’s National University Health System has been implementing the AI-free periods after studies found that physicians who relied on AI tools during endoscopy were less able to use their own skills to detect polyps when the tool was taken away. By removing AI tools occasionally, leaders hope that physicians will maintain their core competencies and avoid being overly reliant on tools.
The article also mentions tracking physician performance to determine whether AI tools are having a negative impact. Anyone who has had to navigate a downtime situation when it hasn’t been practiced for a while knows what it feels like when technology is taken away, so I think that considering AI-free practice on occasion is a good idea. And if you haven’t had a downtime drill in a while, there’s no time like the present.
My hospital recently did a user survey to gather information on how well the informatics team did as they implemented a new feature. We’ve used anonymous surveys before and have always found them to be a good way to get direct user feedback and ideas for improvement. We don’t usually receive a lot of free-text user feedback, but we always get a few constructive comments.
This time, however, I was completely floored by how hostile some of the free-text responses were. Some of them even included personal attacks on members of the training and implementation teams.
I’ve seen enough anonymous posts on social media to know that societal rules are evolving to a point where people feel emboldened to say whatever they feel, but I haven’t seen these kinds of borderline threatening responses from our medical staff. It makes me wonder about the overall stress level of providers in the organization and whether we need to take additional steps to ensure the welfare of our employees.
Have you noticed a change in the level of civility at your institution? Have steps been taken to improve communications and ensure that staff members are safe? Leave a comment or email me.
Email Dr. Jayne.
CVS Health tops Q3 forecasts but absorbs hefty charge for struggling clinic business
CVS Health sees a 7.8% increase in Q3 revenue, resulting in an increase in 2025 earnings estimates despite a $6 billion hit from its poorly performing care delivery business.
OnMed and Berto Acquisition To Merge
Health kiosk vendor OnMed will merge with special purpose acquisition company Berto ahead of an eventual IPO.
Teladoc Health Reports Third Quarter 2025 Results
Teladoc Health reports a 2% dip in Q3 revenue, with its Better Help online mental health segment experiencing yet another quarterly decline.

Hospital for Special Surgery hip and knee replacement patients give high marks to an AI-powered chatbot that was trained on the hospital’s patient education materials to answer their pre- and post-op questions. The small study found that most questions were asked before the operation rather than after, and patients said they were comforted by knowing that someone was always available to respond. The technology was provided by customer care AI agent vendor Aidify.
A Johns Hopkins study finds that physicians perceive their AI-using peers as less capable, regardless of whether those doctors use it for primary decisions or for verification. Doctors viewed peers most favorably when they avoided generative AI altogether, even though most said they appreciate its healthcare potential.
Cleveland Clinic expands its use of Bayesian Health’s sepsis detection software, which applies AI to EHR data to identify at-risk patients. The Clinic is an investor in the company.
The American Medical Association asks ASTP/ONC to harmonize federal AI regulations, remove regulatory barriers, and ensure that clinicians review algorithms that affect patient privacy and safety.

Laudio enhances its leader operations platform with Performance Insights, an AI tool that provides insight for mentorship and performance management.

England-based Aide Health, which develops apps to help patients manage chronic conditions, launches an AI tool that records and summarizes medical visits for patients and their families. The company says that its Mirror app improves prescription adherence and engagement, reduces avoidable visits, and helps patients retain information that they would otherwise forget, which it estimates is 80% of what is discussed during appointments.
OpenAI finds that 0.07% of ChatGPT users who are active in a given week exhibit possible signs of mental health emergencies in their AI conversations. The company created a network of 170 psychiatrists, psychologists, and primary care physicians to devise ChatGPT responses that encourage users to seek real-world help. The company acknowledges that while the percentage is tiny, it still represents hundreds of thousands of users.

A man’s brother-in-law dies of a heart attack during a brief ED visit that generated a hospital bill for $195,000. The brother used ChatGPT to negotiate it down to $37,000 by requesting an itemized bill with CPT codes, comparing the charges to Medicare rates, and then finding major discrepancies. The hospital agreed to correct its charges, but asked him to accept the bill reduction as charity care. He declined, saying that the move was likely to protect the hospital’s tax-exempt status. He concludes that “hospitals know they are the criminals they are” and that no one should pay more out of pocket than Medicare would.

An 1,800-attorney law firm apologizes to a judge in a hospital bankruptcy case for submitting an AI-generated filing that contained inaccurate and fabricated legal citations. The hospital alerted the court that the document appeared to be AI-generated, but the attorney initially denied it, later admitting that while she hadn’t used AI herself, she knew it had been used but let it pass because she was overworked.
Mr. H, Lorre, Jenn, Dr. Jayne.
Get HIStalk updates.
Send news or rumors.
Follow on X, Bluesky, and LinkedIn.
Sponsorship information.
Contact us.
Fitbit’s personal health coach in public preview is here
Google will launch the public preview of its AI-powered personal health coach for its Fitbit Premium subscribers on Wednesday.
Samsung Health and HealthTap Expand Access to Virtual Primary Care to Millions
Samsung Electronics will offer virtual primary and urgent care from HealthTap through the Samsung Health app.
UnitedHealth Group Reports Third Quarter 2025 Results and Raises Full Year 2025 Earnings Outlook
UnitedHealth Group announces Q3 results: revenue up 12%, adjusted EPS $2.92 versus $7.15, beating analyst expectations for earnings but falling short on revenue.
Merry Christmas and a Happy New Year to the HIStalk crowd. I wish you the joys of the season!