Shadow AI prevalent, as 72% of health orgs deploy without IT approval

Agentic AI adoption is rising

Healthcare organizations are racing to deploy agentic AI, with 28% of survey respondents saying their organization has already deployed these tools and 44% reporting their facility is conducting pilots or proof-of-concept projects. Another 21% of leaders said their organization expects to deploy agentic AI within the next year.

Survey respondents estimated that agentic AI is involved in about a third of clinical operational workflows. A majority of respondents expect the technology to have a "transformative" impact on clinical workflows (79%) and operational workflows (73%).

Overall, healthcare leaders expect widespread benefits from using agentic AI, with 90% citing operational, efficiency or productivity gains, 70% clinical or patient impact gains and 60% security, governance or compliance benefits.

AI security gaps persist

Despite the positive outlook towards agentic AI, 57% of healthcare leaders said that security ranked among their top three concerns of deploying the technology. 

The security gaps are already present, according to the survey. Not only did 72% of respondents say that agentic AI tools are implemented without IT approval occasionally, 37% said their organization has an ad-hoc or unapproved approach to AI agent provisioning, that is, the process of assigning a unique digital identity and permission limitations.

Further, having a leader dedicated to AI governance does not ensure security. About 73% of leaders in organizations with a chief AI officer reported that agentic AI can be deployed without IT approval, as did 54% of leaders in organizations with a CIO.

Healthcare leaders also remain concerned about potential compliance or regulatory violations (50%) and unauthorized access to protected health information (48%) as agentic AI use grows.

Still, most healthcare leaders (88%) expect AI to operate autonomously to some extent across clinical and operational workflows, and 86% are confident that they have or will soon have visibility into AI agents' activity.

How leaders will gain that visibility from an identity and access management perspective is still an open question. The survey shows that 48% of leaders believe their current AI agent identity approach is mostly sufficient but needs to be adapted. About 20% said AI agents need dedicated identities within existing frameworks, while 12% said they require a new identity class with distinct controls.

"For many healthcare organizations, the conversation about agentic AI is focused on where it can have the greatest impact and how it can scale across the organization," said Sean Kelly, chief medical and growth officer and senior vice president, customer strategy, healthcare at Imprivata. "As AI agents act on behalf of clinicians and staff, organizations need to understand what those systems can access, what they're authorized to do, and how their activity can be monitored and reviewed."

Anuja Vaidya has covered the healthcare industry since 2012. She currently covers healthcare IT and innovation, including artificial intelligence, digital healthcare, EHRs and interoperability.