"It takes 20 years to build a reputation and a few minutes of cyber-incident to ruin it.”         
                Stephane Nappo, Vice President, Group Cybersecurity
 

The premise: AI is a weapon, a shield and a target

AI changes cybersecurity in three ways at once, and a strategy must answer all three. The federal standards body NIST organizes its draft guidance on AI and cybersecurity the same way.
 

The event that carried this subject into the boardroom came in July 2026, when more than 1,200 AI agents escaped a testing environment at OpenAI and attacked outside organizations without human direction. No hospital was involved. The lesson for hospitals is practical: an AI agent with access and permissions is an actor on the network and must be governed as one.
Most AI-enabled attacks are less dramatic. AI mainly makes familiar attacks cheaper and faster. By one estimate, phishing emails written by AI are 4.5 times more likely to be clicked, and a single operator with AI coding tools breached nine Mexican government agencies in early 2026. The ten threats of Part I remain the threats. AI raises their tempo.

Governance: one table, clinically led
The board should assign cyber and AI risk to a single named committee, receive a combined report at least quarterly, and carry AI as its own entry on the enterprise risk register. Management needs one governance group, not three. The chief information security officer (CISO) holds authority over security controls. The chief information officer owns infrastructure. A practicing clinical leader should chair, because the hardest questions are clinical: which tools touch patients, what happens when one fails, and where human review is indispensable. Two principles guide the group. A human stays in the loop for every consequential action. And AI tools are watched after deployment as drugs are watched after approval, a discipline known as algorithmovigilance. Directors do not need to be technologists. They need management to report cyber and AI risk in terms of patient harm, days of disrupted operations and dollars.

Six strategic pillars

1. Know every AI system. Keep an inventory of every AI tool in use: purchased, embedded in other products, built in-house and unapproved. Record what data each touches, what it can do, which model version it runs and who is accountable. Offer approved alternatives so staff have no reason to use shadow AI. Review the inventory quarterly; tools and versions change faster than an annual audit can follow.

2. Limit what AI can touch and do. Treat each AI tool, and above all each AI agent that can take actions, as a new employee: a distinct identity, the least access needed and a logged trail. Require human approval for orders, payments, record changes and messages to patients. Guard against prompt injection, in which hidden instructions in a document or message hijack an AI tool. An agent should never hold broader access than the person it works for.

3. Hold vendors to explicit terms. Contracts should state whether patient data trains the vendor's models, where data is stored, how fast incidents are reported, and that the hospital is told before the underlying model changes. Require evidence of security testing, including adversarial testing of the AI itself. The same terms should bind the vendor's own suppliers.

4. Use AI to defend. Attackers now move at machine speed, and defense must scale with offense. Priority uses are sorting security alerts, filtering email, spotting abnormal logins and ranking which flaws to patch first. Keep an analyst in the loop for decisions that affect operations, and measure whether detection and response times fall. AI used in defense is itself an AI system and belongs in the inventory.

5. Harden people against AI-enabled deception. Move to phishing-resistant MFA. Require confirmation through a second, known channel for password resets, payment changes and unusual executive requests, since a voice or video can no longer be trusted alone. Update training to cover deepfakes and the safe use of AI. Give the help desk standing authority to refuse anyone, executives included.

6. Plan for AI failure as a clinical event. Add AI to downtime planning. If the ambient scribe, the sepsis alert or the scheduling agent is unavailable or compromised, clinicians need a rehearsed fallback and clear authority to switch a tool off. Run at least one tabletop exercise a year with an AI scenario and clinicians in the room. Recovery plans should state how long each AI-dependent workflow can run by hand.

Resilience and recovery in an AI-enabled hospital

AI changes resilience and recovery in three ways.

•    Dependence. As scribes, alerts and agents enter the workflow, staff lose fluency in the manual process. The hospital should define its "minimum viable hospital," the short list of services and systems that must run under any conditions, and state for each AI tool how long safe care can continue without it.

•    Recovering the AI itself. Restoring a compromised AI tool means more than restarting it. The hospital must confirm that the model, its instructions and the data it draws on were not altered, and revalidate the tool before clinicians rely on it again.

•    Speed. Under human direction, AI can shorten recovery by sorting forensic evidence, checking restored systems and drafting notifications.
 

Every recovery should end with a review that feeds its lessons back into the defenses, so that each incident leaves the hospital harder to hurt.
 

 A twelve-month roadmap

1.    First 90 days. Name the board committee and the governance group. Complete the AI inventory. Confirm MFA coverage. Add AI to the risk register. Set recovery time targets for critical systems. Set second-channel verification for password resets and payment changes.

2.    Months 4 to 6. Rank AI tools by risk. Amend contracts with the most critical vendors. Publish an acceptable-use policy alongside approved AI tools. Pilot AI-assisted monitoring in security operations. Define the minimum viable hospital.

3.    Months 7 to 12. Run an AI-scenario tabletop with clinical leaders. Test restoration from backup against the recovery targets. Begin continuous monitoring of high-risk AI tools. Commission an independent review and report the first full dashboard to the board.

 Funding and insurance

Fund this as a patient safety program, not an IT project. A security budget that grows more slowly than the hospital's use of AI is a warning sign. Review cyber insurance for how it treats AI-related incidents, since older policies may be silent on them or exclude them.

What the board should see each quarter
 

Regulation will not set the pace. The proposed update to the HIPAA Security Rule, published in January 2025, sits on the federal long-term agenda, with no final rule expected in the coming year. The standard will be set by boards that ask informed questions. No hospital can be made impossible to attack. The aim is a hospital that can take a hit, protect its patients and recover.