{"id":53141,"date":"2026-05-27T21:02:26","date_gmt":"2026-05-27T21:02:26","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/53141\/"},"modified":"2026-05-27T21:02:26","modified_gmt":"2026-05-27T21:02:26","slug":"agentic-ai-in-healthcare-is-a-risky-proposition","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/53141\/","title":{"rendered":"Agentic AI in Healthcare Is a Risky Proposition"},"content":{"rendered":"

\n Agentic AI<\/a>
\n ,
\n Artificial Intelligence & Machine Learning<\/a>
\n ,
\n Governance & Risk Management<\/a>\n <\/p>\n

Health-ISAC Warns About Weak Governance and Credential Misuse<\/p>\n

Marianne Kolbasuk McGee<\/a> (HealthInfoSec<\/a>) \u2022
\n May 27, 2026 \u00a0 \u00a0 <\/p>\n

\"Agentic
\n Humans delegating data, decisions and more to agentic AI in blended healthcare environments pose a variety of amplified risks, including cyber and patient safety, says a new report. (Image: Getty Images) <\/p>\n

Humans make mistakes. They fall for phishing scams and click on malicious links. Machines aren’t necessarily better: Delegating decisions to agentic artificial tools can significantly intensify cybersecurity risks, warns a healthcare sector association.<\/p>\n

See Also: Know Thy Enemy: Threats to Cyber Resilience<\/a><\/p>\n

Over-permissioned accounts, weak governance and credential misuse – all are amplified by AI-enabled workflows, said Errol Weiss, chief security officer of the Health Information Sharing and Analysis Center. The center published<\/a> Tuesday advice for managing agentic artificial intelligence risk in healthcare settings.<\/p>\n

The stakes aren’t restricted to data security and privacy risks, Weiss said. Patient safety and continuity of care need electronic health records and a functioning clinic. A rogue AI agent can interrupt the normal flow of medical care. “Disruptions to communications can slow care and increase errors,” he said.<\/p>\n

Organizations can be slow to perceive the risks of agentic AI. At first, AI use is often informal and unsanctioned. But much as they’ve progressed in raw capacity agents are still prone to wide swings in behavior – as a startup founder discovered earlier this year when an AI agent deleted three months of production data over nine seconds – despite being explicitly instructed to never guess about the consequences of its actions (see: AI Agent Wipes Startup’s Data in 9-Second API Call<\/a>).<\/p>\n

“When AI agents are implemented without strong identity and policy controls, attackers only need one foothold to misuse delegated privileges,” Weiss said.<\/p>\n

The center advises organizations to adopt a framework that shifts traditional security awareness training to continuous risk management that encompasses human behavior and agentic AI risk. “The maturity model is clear – you can\u2019t manage what you can\u2019t see,” Weiss said.<\/p>\n

That includes treating human and AI-driven behavior as part of the enterprise attack surface and monitoring AI-agent activity such as its access privileges. Risk managers should govern AI agents as if they were “digital workers” with defined ownership, monitoring, logging and approved use cases.<\/p>\n

Compliance-based training is better supplanted by risk-based interventions and organizations should build cross-functional governance models that involves security and privacy officials as well as clinical leadership and human resources, the report says.<\/p>\n

“CISOs should manage workforce risk continuously and intervene based on observed risky behaviors and exposure, not generic completion metrics,” Weiss said.<\/p>\n

It’s not just the responsibility of healthcare CISOs and their teams to address these issues, he said. <\/p>\n

“Executives, clinical and operational leadership should treat cyber as patient safety and resilience planning,” he said. Leaders should sponsor downtime planning, ensure clinical managers participate in exercises and reinforce that safe workflows matter as much as technology, he said.<\/p>\n

Additionally, HR, compliance, legal and privacy departments should reinforce “ownership” of AI use, not just the rules, Weiss said. “Organizations must shift their culture from simple AI compliance to true AI ownership. Employees shouldn\u2019t just follow rules; they must be accountable for the behavior of the AI systems they deploy.”<\/p>\n

Chief information officers, IT managers and data owners should bake guardrails into tools and workflows, he said. “If healthcare adds agentic automation without matching governance and visibility, it can unintentionally make attacks faster, broader and more damaging.”<\/p>\n