Navigating AI Adoption and Governance in Medical Groups

What's your board's focus right now?

The board is really concerned about the use of shadow AI. If you're using AI tools that are not through our enterprise platform, it creates an opening for threat actors to get access to sensitive data again as well. And the bad guys are going to be able to use this stuff too. And healthcare is a huge target as it relates to cybersecurity threats. And well, now AI is a member of that team and it makes mistakes. And it's easy to just accept what's returned and not do your additional diligence. And we still don't know everything we need to know about AI.

We really are like that, candid and essential partner in how you're embracing the regulatory world and healthcare, how you're embracing the new trends and the new demands from your seat, whether you're an operator, an executive, a visionary, a strategic officer, however, you think about it, we help break down the new regs. We help you understand what other folks are doing and how to become the best of the best of your particular role. Today we're talking about medical groups and AI. There seems to be a flurry of activity in AI across the healthcare industry, but really in medical groups, they're all trying to be very efficient, very thoughtful, very pro-physician, very pro-patient. And so what we want to talk about today is really as we think of this from a compliance officer seat, we're gonna have Tim Burke here, who is Chief Compliance Officer of Radiology Partners, and he's gonna walk us through kind of what the last 24 months have been like in his seat and how he's really trying to become the partner to this CISO and the chief financial officer and the and new CEOs because everyone's putting pressure in the organization for AEI, but we have to be really thoughtful and disciplined as we embrace it. So please welcome my guest, Tim Burke. Tim, we want to introduce yourself?

Sure. Thanks, Ryan. I'm Tim Burke. I'm the chief compliance officer for Radiology Partners. We're a the largest radiology medical group in the United States. We also have a health tech med device division that's relatively relatively new and really to support our mission to transform radiology. So happy to be here.

Thank you. And it's really exciting to have an opportunity to sit with you because obviously radiology is really embracing AI, both from a physician standpoint, from a clinical standpoint, from a business standpoint. So walk us through kind of what you were doing two years ago, which will feels very different than today, and what you're working on now. It seems like you you need a lot of a lot of focus, a lot of discipline, a lot of caffeine, perhaps a little sugar to get through the the world that's created um your weight now.

AI has certainly been a game changer and it did kind of just explode about 24 months ago, it seems. So radiology has always been a little bit of the tip of the spear as it relates to clinical, the use of clinical AI. Um, but what was really interesting was the explosion of the use of AI for business processes. So I have to balance between those two things. So with on the clinical side of things, we've, as I mentioned, we've you know developed a med device health tech organization, which really is going to support our technology needs for radiology. And there's a huge team that's really focused on not just the AI components, but the other technology components there. But as it relates to the business use, like what we needed to do as an organization was realize that we needed to quickly understand how we could use AI from a business perspective, separate apart from the delivery of clinical care, in order to be more efficient, be more effective, and drive innovation through the organization. So what kind of exploded for us two years ago was okay, what AI is out there? What are people already using? We need an enterprise platform. We need to create some governance and some new and policies and new internal controls and some monitoring around all of this. And so, what does that look like? What does that framework look like? And so that that really started the journey. The flip side of all that is I use AI and my team uses AI. So that's been like an exciting journey as well in figuring out how we can be more efficient, how I can actually use AI as a as a data analyst, how I can use AI as a consultant to do what I might otherwise have asked a law firm or a consulting firm to do research for me. I can now do on my own with my buddy, my buddy and co-pilot. So it's been an interesting journey on both sides, both as a user of AI and then in the compliance officer seat.

This is I'm busy though. So, and I know you well, and that's a delight of mine. But as you think about it, you kind of have to think about this from an enterprise standpoint, as you said. And so I imagine you've had to create some type of execution checklist or implementation checklist to kind of help you sort through what your organization is embracing, which level, whether it's business or clinical or you know, clinical within the professional company and then in the device. So, how do you how do you manage all that?

Yeah, I'd like to say that I was quick on the draw. I probably wasn't the slowest, but maybe not the fastest. You know, we started a year over a year ago with training. So we implemented uh responsible use of AI, uh, content in our compliance training, which was just, hey, you know, here is the enterprise platform that we use. Please use this. This is what you need to use with sensitive with sensitive data like PHI, trade secret, which was also very important as we were starting our our health tech company. And so there was really just awareness that AI is out there, people are using it. This is this is kind of the rules of the road at a high level. Um, and then we built it from there. So it was really identifying the right partners within the enterprise, of course, IT. Uh, we have a transformation office, and so the leader there was a big partner to me, really kind of has a responsibility for a lot of the back office sort of administrative functions, which truthfully will be the heavy use of AI and is now both in terms of our our direct employees as well as vendors. Um, so you know, those those two functional leaders were really, as well as my CISA, my chief information security officer, the four of us really collaborated to create this governance process. And it really started with a framework, like, you know, number one, let's get the executive team and the board to buy in on this, which we've got we've got a very engaged board and compliance committee as well as an audit committee. And so they were all over this, you know, frankly, every step of the way, asking us questions. And then the executive team was very supportive as well. And it wasn't like anyone asked us to do this, we just kind of stepped in to set up this governance process. There was certainly because of the, I think, the evolution of the larger enterprise to include technology as a product, the idea was like, hey, let's operate like a tech company, and of course we're going to use AI. And so because that was sort of an initiative broadly on both sides of the house, governance just seemed like just sort of a natural outgrowth of that. So we've we've established an intake process, we've established an entire group that will run through that. We're really in the early stages of that process. That'll also include an inventory of everything that's already out there, who our superior users are internally, what vendors are using AI, and then that'll be an assessment of what we've got already, and then anything new will run through that process and ultimately be approved. We've got decision makers. I can veto stuff, so can our CC our CISO. So there's strong governance and accountability, I think, in what we've set up. But again, it's new. We got to make sure that we're documenting it all in the right way. And but we're off to the races at least.

It sounds like you have a really expansive governance model. So I appreciate all the work that you've put into that. It sounds again like you've built awareness across the enterprise. You've put in training. I mean, you've created an intake process, you've created not just responsibility, but accountability and ownership. So that's a nice marriage that we don't see in a lot of folks that we have worked with at Healthworks. It sounds like you have a really mature vetting process for both your own build versus your what you're buying and things like that. And then you're gonna have to continue consistently maintain that and monitor performance and things like that as you think about, you know, two different questions. So you can take them in the order that you prefer. But you mentioned the CEO and the board. What are they asking of you these days? Now that they see that you have this robust program, are there certain questions that they continue to ask? I know at HealthWorks we've created an output for our clients and it's on our website the 12 questions that your board should be asking and continue to ask. Um, what are what's your board's focus right now?

The board is really concerned about the use of shadow AI. And so not using our enterprise tools and individuals leaking sensitive proprietary information out there and out there and on the internet in particular. And and the board's also interested in what could go wrong, what should I be worried about? And so those are sort of the two questions we get from the board. Like, how do we make sure people are using the tools we want them to use and so that we're not losing important information, especially in where we are as a as an enterprise with with with so much tech and innovation in our specialty? And then what do I need to worry about? How are you staying on on top of this? Whether it be new disclosure requirements for the use of AI and clinical services or a new state privacy laws that are coming up. So it's like, what's the next big thing that we need to be worried about in addition to just how do we actually operationalize the use of AI? The C-suite is a little bit more strategic and pragmatic around balancing innovation and the cost savings that likely will come with that innovation with compliance risk and privacy and security risk. Everyone knows that security issues are on the rise. If you're using AI tools that are not through our enterprise platform, it creates an opening for threat actors to get access to sensitive data again as well. So that's really why the four of us that I mentioned before really kind of banded together to create this governance process. Because you've got IT, which is which is has to deliver on the technology for the business. You've got our CISO who has to make sure that our data is secure and and all the doors are locked. And then you've got the transformation office, which is really, which is really looking to ensure that we've got the most efficient and effective uh workforce and collection of both internal and external resources supporting the business. And then myself as compliance officer. So that that's why I was all for was was sort of because we raised our hand to do it and recognizing that that was really the strategic and tactical focus of the C-suite.

You want to walk us through your partnership with their CISO a little bit deeper just so that we can understand how you guys kind of modify and shift responsibility, accountability in your organization.

Yeah, absolutely. He's a good partner. We text quite a bit, we still text. And, you know, the way I think about it is, you know, he kind of puts all the locks on the doors and and the alarms, and I kind of write the manual on how to how to get in and out of the house using those locks and using those alarms. Um so so a lot of what I focused on specifically as related to AI governance that we've been talking about was drafting a charter for that governance process, which then is actually currently in review by by the Transformation Office in IT. Um it's it's establishing a a policy around responsible use for AI. And then my CISO created the technical aspects of of that policy, really. So and then and then collectively together we've got sort of a fact sheet and job aid for folks. So the idea is how can I use AI? Which AI can I use? And then sort of as I interact with AI, what are the things I need to think about from a from a security perspective? So great partnership there in terms of policies and documentation. And then on the back end, really kind of the alarm piece for for IT security is we have the ability to kind of see where people are going relative to the use of AI and AI tools. So if someone's using something other than our our enterprise platform, we'll have some alerts to be able to see and we'll be able to understand if something uh inappropriate gets uploaded. And that'll help then inform me in terms of what we might need to do by way of more training that I mentioned before, and by way of increased policies and or controls. So it's kind of just a partnership where we're trying to both get the front-end awareness and and education out, and then on the back end sort of confirm how well that that worked and how well our whether our monitoring and auditing is is working as we intended to.

And as you think about it, as the regs come out, both federal, state, and and you guys are actually international with some of your practices in Canada. Well, that's that's quite a laundry list of regs to look at. But it seems like all of them are kind of demanding an inventory, like where is your AI? How are you auditing? So are you and the CISO working together to kind of compile that inventory and then monitor it and audit it? Or how do you think about your inventory demand?

Yeah, on the clinical services, on the tech side, which is where we just established an a tech office in Canada, you know, that inventory is is pretty well defined relative to the to the overall operating system that that work that we're creating for radiology. And it's mapped by our regulatory leaders and as part of our quality monitoring system. So we actually have great uh controls in place and and a good process map around each of the different components of the technology, what vendors maybe supported that versus what's in-house, et cetera. And you know, have that all pretty well locked down. That's that's really the most paramount part of that is making sure that we're ensuring sort of the quality and safety of the clinical care through that technology. On the business side of things, again, yeah, this is where we're we're just getting started with the the new intake process related to governance and the review. So we're spinning up that inventory now. We we probably know 80% of that already just from vendor our vendor risk assessment that we've had in place. Again, a partnership between myself and the CISO evaluating vendors and what their IT security structures and frameworks look like, as well as those privacy frameworks. So we kind of know already if they're using AI. A lot of our a lot of our clients, our hospitals will ask us about that, of course, whether it's clinical use or administrative use. In fact, often a lot of hospitals are really interested in how we what administrative functions we actually outsource and whether or not AI or what or the security of our data. So we've been doing that, that piece for years now. But I think it's getting to the getting over the hump and get that additional 20% of like what are innovators within the organization might be doing? What are some vendors doing that maybe haven't fully explained their AI? Because we might not have been talking to the right people on the vendor team when we were doing the risk assessment. Um, and so it's really crafting those additional questions to be able to ask and really do a deeper dive and a drill down to really get to the root of like what is actually being used, how is it being used? Is it in internal AI? Are you leveraging some of the larger commercial tools? So that's been something we've added to that risk assessment process. And then I think we'll capture all the other innovation use within the organization through through the intake process.

You're actually ahead of most people in the marketplace, most people in the industry when I ask them, and when we we come in and we look at where they've kind of began, it's kind of a mess of all things vendor. And then they've launched multiple different pilots, and some of them have kind of carried through and become sustainable and scalable. Uh, most are kind of at this very fragile point.

You mentioned in in earlier in the conversation that you actually have the ability to veto who besides you can veto it, and have you guys actually practiced that that discipline within your certainly practiced it outside of the world of AI relative to other aspects of technology. And and so, yeah, we have practiced that. We and typically the venue in which we do that is we have a management compliance committee, which is a group of executives, including our CEO, our our two presidents for both technology and clinical services, our CFO, our general counsel, legal the chief legal officer, myself and and and my CISO. And so we bring issues as it relates to technology. AI was one of them where we this was very, very early on, when all of a sudden you could start recording teams and you'd be getting an AI summary of everything that everyone said on that on that recorded, recorded call. Question is, do you want those types of recordings? Are those helpful? And then what do you have to think about in terms of data retention? And is that considered ephemeral data that has certain requirements for a lot of the regulators here domestically? So we beat all that up and came up with basically a policy. We we continue to allow it. It's a great tool and a time saver for many. And I'm somewhat in the balance sort of tightrope that we all have to walk is providing the right level of tools to folks so they may be able to use them without going outside of our enterprise framework that we can monitor. So that's the kind of conversations that we have in that that management compliance committee is really trying to work that balance of risk management, really on sort of a risk-adjusted basis. Yeah. So I'm certain that there'll probably be some tools that are coming across that are going to be higher risk for us. Likely it'll be with a vendor that just doesn't have the right IT security uh associated with it and and we'll pass. We've certainly done that in uh in history where we've we've evaluated a vendor from a risk assessment perspective with privacy and security and had to make that recommendation and it was accepted. With AI, I can only imagine there's gonna be more to look at and probably more of those more of those considerations.

Yeah, I find that I mean health plans are obviously very different than medical groups, and I find that sometimes when you're walking through the vending process um within health plan, it is really hard to say no, or it's hard to kind of take a pilot and and prove failure because everyone, you know, invested in it, and probably both in your organization and health plans, it takes like 18 people to make a decision. And so if they all voted yes to launch this opportunity or the vendor or the pilot, you know, they really want to see it successful. So oftentimes I see a piece of the pilot continue or try to push be pushed through the enterprise. So I appreciate that you guys have the discipline to say no. I think that's a rare quality. And I think it it's kudos to you sitting in that chair. The other thing that I think r we have to face is that, you know, there's so much regulatory change and and you know, the federal government's coming out with new AI expectations and rules and mandates and audits. And then state by state, we see California and New York and Illinois and others coming out from a technological standpoint, but you know, now we're gonna start mapping the consumer protection kind of areas also. How do you keep up? And what's your regulatory review process?

Yeah, we've there's a lot. And so we a few years ago actually now, we actually established an internal process for a monthly regulatory review. So we we basically mine different data sources. We do have a service that provides us with a listing of any proposed or passed legislation in all the states as well as the federal government related to specific categories uh related to our business. So when we, you know, AI, privacy, IT security, scope of practice considerations, we've got a whole a pretty broad list of criteria for which we get information from. And then we we mine existing data like other listservs, information that consultants and our law firms produce, sort of, you know, email updates and alerts. We compile all that and then we do a multi multi-lane review once a month. Myself participates and my team, we have legal counsel involved and the different sort of functions. So labor unemployment, litigation, regulatory, of course. So among that sort of leadership group, we kind of decide what needs to go where. Like, you know, this is not important, this is important, this is kind of important, let's send this to this person, let's actually implement a new policy because of this. And so, you know, a great example that was you know, California CPO. We were, you know, we implemented changes related to those enhanced restrictions very, I must say starting Q3 of 2025 when the new rules didn't go into place until 2026. We knew about it because we've been tracking it, and that's something we're really focused on. And a topic like that is also something that would be a topic of a process that we've implemented with outside council called Horizon. About two to maybe three times a year, we actually engage with three or four of our sort of strongest partner law firms, and we come up with a couple questions, regulatory questions, or something that we think is coming, coming out, or where we're seeing a lot of activity, either through the regulatory process that I mentioned, or or just through just through our normal day-to-day. And we beat beat up that question. How big is the risk? What should we what do we think how we think that risk is gonna evolve? What what should we be doing today and putting in place? And that all gets again brought up to the managing appliance committee, and we share kind of the findings and the proposals that come out of that. And that's been super helpful. And as you might imagine, the we have one coming up, and the topic of disclosure, a patient disclosure is is on the list. There's some states, you know, Texas has one, and I'm quite certain that other states are f I know states are following, and so the so the The question is, do you want to get in front of that and disclose everywhere? Or do we need to be more thoughtful about how we how we approach that a state by state? Great question. And I'm looking forward to the conversation.

Again, it sounds like you guys have a really nice process. One from a regulatory review standpoint, from accountability and ownership. Different committees are taking different pieces, a lot of new responsibilities. And so as you think about this, I think you guys are really buttoned up. And even though, again, you said 80%, I think you're ahead of everyone else working with. So is there anything though that keeps you up at night that makes you think that, you know, you and your fellow compliance officers really need to have it? I mean, sounds like you're looking around the corner, right? So as you're doing the horizons and things like that, you're probably planning on the 2027s and the 2028 demands for your position and your organization's, you know, security and and innovation. But what's what's the challenge that you s feel like you're just beginning to undertake?

Yeah, I mean, you know, the 80% is because I'm a bit of a pessimist, right? It kind of comes goes with the gig, and that's violence officer. And so that's what keeps me up at night is like what what's happening in that 20% or what's around the corner that I don't know, which is why I've made it a priority to try to be as prospective and proactive as as possible. Um, you know, for us as an organization and and sort of my seat, you know, we're expanding and growing really rapidly, which is incredibly exciting. And and for me as as as an executive in the organization, I'm learning a ton. And I'm leveraging AI to do it in a ways that have been much quicker and and way help more helpful than I've ever been able to do before. Um, but yeah, what what kind of keeps me up at night is the pace of what's happening. And we still don't know everything we need to know about AI. It makes mistakes. You, you know, we've always had, and we still do have a human in the loop mentality as an organization, especially on the clinical side. It's always rad plus AI. But you think about it from a business perspective, you know, you always had, as a leader, you always had a team and you always had to provide oversight and leadership of that team. Well, now AI is a member of that team and it makes mistakes. And it's easy to just accept what's what's returned and not do your additional diligence. So, you know, I encourage my team when we use it, is we we try to we try to take different cuts on asking AI the question, especially as we're doing research. We actually will sometimes support that by asking a different model. I mean, what's nice in Copilot is you can actually choose from from several different models within their platform and you get different responses. Um that's something that I think is really gonna be important as we leverage AI a lot more. And so that's kind of where I'm at. And the biggest thing that I'm worried about is how technology is going to evolve and do we have the right human in the loop of controls relative to its use. The other piece of that is the bad guys are gonna be able to use this stuff too. And healthcare is a huge target as it relates to cybersecurity threats. So that's also something that uh is top of mind for me. Again, I've got a great partnership with my CISO, and we talk, you know, probably almost every day at least, um, if not more than once a day. But yeah, I I think I think the technology risks, both to healthcare in terms of uh clinical service delivery, and then of course, with the the added responsibility we'll have as a technology company is is is really what I think about every morning when I wake up.

Well, Tim, thank you very much for your time today. I really appreciate you walking us through how you personally think about this, how you professionally think about it. And what I find extraordinary is I think you've really done a great job of laying it in, building that awareness, building the training, weaving the accountability through the organization, aligning it through committees. Um, again, I I feel like what you've built and what your organization and enterprise has built is really rare. It seems like you've looked at technology both from the patient perspective and the physician perspective, which is obviously a point. Well, what I've seen is people love to embrace technology, love to embrace AI, but they've just kind of done this little re-org and shifted people that might not be best in class for that particular role. Or, and so by just re-orging and and adding a new vision or adding a new strategy, they really didn't redesign. It feels to me like you guys have redesigned how you think about it, how you embrace it. Probably hired some folks and inside and outside to build again and best in breed. So I appreciate your sharing your point of view and all the hard work that you've put into this particular area.

Absolutely. And thank you, Rand, for always you've always been a great friend and partner to be able to brainstorm ideas and and uh and challenges with. So I I appreciate I appreciate you.

Yeah.

And so what we actually did at Healthworks to kind of complement this conversation is we created some board questions that you can find on the website. We created a regulatory update around AI because it is really hard to keep all those things in motion as far as awareness from international, national, and state. So there's a couple of downloadable opportunities there. And what I found is that people and my clients usually say, Oh, yeah, we're super ready. We got this, you know, we got this. What we also built to kind of test that we got this attitude is on the uh Healthworks website, there's a maturity assessment, an AI maturity assessment. It's just for you know, all the audiences to use individually for their own organization. It's just lives within your organization. It's not something you need to share with anybody, but it kind of helps you understand that if you didn't write this down, if you don't have a committee monitoring it, if you don't have a way to audit your vendors, if you don't have a vetting structure, you might not be as ready. You might not get this in the same way that some other entities do. So after today's conversation with Tim, again, hopefully you understand what a truly mature organization is doing and how they look around the corner and how they think about it from each of their seats. And then if you need some help within your organization, again, just jump on the Healthworks website and download whatever you might need, the assessment, the board questions, or the regulatory update. So appreciate your time today. Thank you, and we'll see you next time.