Clearwater Healthcare AI Security & Governance Webinar
October 22, 2026
Executive Summary
Healthcare organizations are rapidly adopting artificial intelligence, but many are struggling to demonstrate that their AI governance programs are working in practice. While policies, committees, and governance frameworks are becoming more common, the technical controls needed to discover, monitor, and validate AI systems are not keeping pace.
In Clearwater’s webinar, Closing the AI Governance Gap: 2026 Healthcare Benchmark Findings, Harry Lu, Vice President of AI Solutions at Clearwater, examines findings from Clearwater’s 2026 Healthcare AI Security & Governance Benchmark Study, which surveyed 105 organizations across the healthcare ecosystem.
The findings reveal a significant gap between documented AI governance and technical assurance. Only 8.6% of surveyed organizations reported being able to verify their AI inventories through automated discovery, while third-party AI risk, agentic AI oversight, and insufficient security investment remain major challenges.
The central takeaway is that healthcare organizations need to move beyond establishing AI governance policies toward demonstrating that their security controls, vendor oversight, and risk management practices are effective.
In This Discussion
This webinar explores questions including:
- What does Clearwater’s 2026 Healthcare AI Security & Governance Benchmark reveal about industry readiness?
- Why are healthcare organizations struggling to validate their AI inventories?
- How does third-party AI introduce new security and governance risks?
- Why are AI policies insufficient without technical controls?
- What security frameworks can help healthcare organizations govern AI?
- How should organizations manage the risks associated with agentic AI?
- Why is dedicated AI security investment lagging behind adoption?
- How can healthcare organizations move from documenting AI controls to demonstrating their effectiveness?
What Does Clearwater’s 2026 Healthcare AI Benchmark Reveal?
Clearwater’s 2026 Healthcare AI Security & Governance Benchmark examines how healthcare organizations are governing, securing, and validating their use of artificial intelligence.
The study includes responses from hospitals, health systems, physician groups, health plans, and healthcare technology companies.
Harry Lu explains that while many organizations have established governance policies and oversight structures, fewer have implemented the technical capabilities necessary to verify that those controls are functioning as intended.
The benchmark identifies five areas where this disconnect is particularly evident:
- AI inventory visibility and validation
- Third-party AI risk management
- Technical security controls and guardrails
- AI governance and security frameworks
- Dedicated AI security investment
Together, these findings highlight a broader challenge: healthcare AI adoption is advancing faster than organizations’ ability to independently verify and secure it.
Why Is AI Inventory Validation a Major Challenge?
One of the benchmark’s most significant findings concerns organizations’ limited visibility into the AI systems operating within their environments.
<text strong={true}>8.6%</text> of surveyed organizations reported being able to validate their AI inventories through automated discovery.
Many organizations continue relying on spreadsheets, manual reporting, and departmental assessments to document AI applications. These approaches can become outdated as employees adopt new tools, vendors introduce AI capabilities, and existing systems evolve.
Harry emphasizes that maintaining an AI inventory requires more than documenting known applications. Organizations need to independently validate which AI systems are operating, what information they can access, and whether they have been approved.
The benchmark also found that approximately 30% of organizations identified unauthorized employee AI use as a major risk, while approximately 42% cited sensitive data exposure through AI tools as a leading concern.
For healthcare organizations, these findings reinforce the importance of continuous AI discovery, monitoring, and validation.
Why Is Third-Party AI One of Healthcare’s Biggest Governance Risks?
Healthcare organizations increasingly inherit AI capabilities through existing technology vendors, software platforms, and service providers.
These capabilities may be introduced through routine product updates or embedded directly into software that organizations already use.
Harry identifies third-party AI as a significant governance concern because healthcare organizations often lack the visibility needed to independently verify vendor security controls.
Harry Lu: “Third-party AI should be a top concern.”
Traditional vendor questionnaires and point-in-time assessments may not adequately address how AI models process information, make decisions, or interact with sensitive systems.
Healthcare organizations should evaluate how vendors use and protect organizational data, whether customer information can be used for model training, and what safeguards exist to govern autonomous AI behavior.
The discussion reinforces the importance of incorporating AI-specific requirements into third-party risk management programs and moving toward more continuous vendor assurance.
Why Are AI Governance Policies Not Enough?
Many healthcare organizations have already developed acceptable use policies, governance committees, and procedures for reviewing AI applications.
However, documented policies do not necessarily translate into effective technical safeguards.
Harry explains that organizations frequently focus on preventing sensitive information from being shared with AI applications through data loss prevention (DLP) controls.
While these protections are important, AI security also requires identity and access management, monitoring, visibility into AI activity, and controls governing autonomous systems.
Harry Lu: “Policies largely exist today. However, what’s not keeping up with policies is the technical guardrails.”
This becomes especially important as healthcare organizations introduce AI agents capable of accessing enterprise applications, retrieving sensitive information, and performing tasks with limited human intervention.
Organizations need technical mechanisms that enforce established policies rather than relying solely on employees or AI systems to follow documented guidelines.
The central challenge is moving from defining acceptable AI behavior to demonstrating that the necessary controls are operating effectively.
How Can Healthcare Organizations Strengthen AI Security Frameworks?
The benchmark highlights growing awareness of AI governance frameworks, including the NIST AI Risk Management Framework (AI RMF).
Harry explains that broad governance frameworks provide valuable guidance for managing AI risks, but organizations also need security-specific requirements that can be translated into technical controls.
The webinar discusses emerging guidance from organizations including the Healthcare and Public Health Sector Coordinating Council (HSCC), The Joint Commission, and NIST.
These resources can help healthcare organizations evaluate AI cybersecurity risks while building on existing security and risk management programs.
Harry recommends identifying the security requirements most relevant to an organization’s AI use cases and determining whether existing technologies can enforce them.
Rather than treating AI governance as an entirely separate discipline, healthcare organizations can extend established cybersecurity practices to address new risks introduced by AI systems.
How Should Healthcare Organizations Govern Agentic AI?
Agentic AI introduces additional governance challenges because AI agents can perform tasks, interact with systems, and make decisions with varying levels of autonomy.
As organizations deploy these capabilities, security teams need to understand what each agent is authorized to do and what safeguards limit its behavior.
The discussion highlights several questions healthcare organizations should be able to answer:
- What AI agents are operating within the environment?
- What information, applications, and systems can they access?
- What actions can they perform without human approval?
- What technical controls restrict their permissions?
- How are their activities monitored and documented?
- Can the organization intervene or stop an agent when necessary?
Harry emphasizes that AI governance must account for the actual capabilities and permissions granted to AI agents, not simply their intended purpose.
Strong identity management, access controls, monitoring, and human oversight are essential as organizations introduce increasingly autonomous AI technologies.
Why Is AI Security Investment Not Keeping Pace With Adoption?
The benchmark also identifies a disconnect between growing AI security concerns and the resources organizations dedicate to addressing them.
Although security and privacy remain significant barriers to AI adoption, many organizations have not established dedicated funding for AI-specific cybersecurity initiatives.
This creates challenges for security teams responsible for evaluating AI applications, implementing technical safeguards, and monitoring emerging threats.
Harry emphasizes that security should be incorporated into AI planning and investment decisions from the beginning.
Harry Lu: “Security can be an enabler for innovation, rather than a barrier.”
Organizations that establish clear ownership, dedicated resources, and defined AI security priorities can better support innovation while managing the risks associated with expanding AI capabilities.
The discussion reinforces that effective AI security requires sustained investment rather than relying exclusively on existing cybersecurity resources.
How Can Healthcare Organizations Move From AI Policies to Proven Controls?
The webinar concludes by emphasizing the importance of demonstrating that AI governance programs work in practice.
Healthcare organizations do not necessarily need to rebuild their governance programs. Instead, they should evaluate existing policies and identify where technical enforcement, continuous monitoring, and independent validation are missing.
Practical priorities include:
- Establishing reliable AI discovery and inventory validation processes.
- Expanding third-party risk assessments to address AI-specific security requirements.
- Implementing technical guardrails for data access, identity management, and autonomous AI behavior.
- Applying security-specific frameworks to establish measurable controls.
- Allocating dedicated resources to AI cybersecurity initiatives.
- Regularly reviewing whether established safeguards are operating as intended.
As healthcare AI adoption continues to accelerate, organizations will increasingly need evidence that their governance programs can withstand operational, security, and regulatory scrutiny.
The goal is to establish a defensible approach to AI governance that supports responsible innovation while protecting sensitive information, critical operations, and patient care.
Key Takeaways
- AI governance is outpacing technical assurance. Many healthcare organizations have established policies and oversight structures but lack the ability to independently verify their effectiveness.
- AI inventory visibility remains limited. Only 8.6% of surveyed organizations reported being able to validate their AI inventories through automated discovery.
- Third-party AI introduces additional risk. Organizations need stronger visibility into embedded vendor AI capabilities and independently verifiable security controls.
- Policies must be supported by technical safeguards. AI security requires enforceable controls for data protection, identity, access, monitoring, and autonomous behavior.
- Agentic AI requires greater oversight. Organizations must understand what AI agents can access, what actions they can perform, and how their activities are governed.
- AI security investment needs to align with adoption. Dedicated resources and clearly defined priorities can help organizations implement security controls without unnecessarily slowing innovation.
- Effective governance requires evidence. Healthcare organizations should focus on demonstrating that AI controls work, not simply documenting that they exist.
Questions This Discussion Answers
- What are the biggest AI governance gaps in healthcare in 2026?
- What percentage of healthcare organizations can validate their AI inventories?
- Why is automated AI discovery important for healthcare cybersecurity?
- What are the security risks associated with third-party AI vendors?
- Why are AI governance policies insufficient without technical controls?
- How can healthcare organizations apply the NIST AI Risk Management Framework?
- What security controls are needed for agentic AI?
- How should healthcare organizations manage AI agent permissions and access?
- Why is dedicated AI security funding important?
- How can organizations demonstrate that their AI governance controls are effective?
About This Webinar
Closing the AI Governance Gap: 2026 Healthcare Benchmark Findings is an on-demand Clearwater webinar examining the findings of the company’s 2026 Healthcare AI Security & Governance Benchmark Study.
Presented by Harry Lu, Vice President of AI Solutions at Clearwater, the session explores the challenges healthcare organizations face in discovering, securing, and validating AI systems as adoption accelerates.
Drawing on survey responses from 105 healthcare organizations, the discussion provides healthcare executives, CISOs, security leaders, compliance professionals, and technology teams with an evidence-driven perspective on AI governance maturity and practical steps for strengthening AI security.
Watch the full webinar replay to explore the benchmark findings and learn how healthcare organizations can move from documenting AI governance controls to demonstrating their effectiveness.