AI Is Already in Your Practice: Michael Ducsak on Governing What Comes Next

On this episode of the MGMA Insights Podcast, host and senior editor Daniel Williams sits down with Michael Ducsak, chief information security officer at Anatomy IT, to discuss AI governance, cybersecurity and the practical safeguards medical practices need as employees adopt increasingly powerful technology. Ducsak draws on nearly 30 years in information security to explain how organizations can identify existing AI use, protect sensitive information and build policies that preserve productivity without introducing unnecessary risk.

Episode Takeaways

Assume AI is already in use. If employees have access to browsers, smartphones or common digital assistants, they likely have access to AI tools, whether leadership has formally approved them or not.Begin with discovery. Practice leaders should work with internal IT teams or external specialists to identify which AI platforms employees are using, what information is being entered and where organizational data could be exposed.Connect AI adoption to a defined business need. Administrative work, correspondence, meeting notes and other repetitive responsibilities may offer immediate opportunities to improve efficiency, but each use case should be evaluated before implementation.Treat public AI platforms cautiously. Information entered into open or consumer-grade tools may be retained or used beyond the organization’s control. Practices should verify licensing terms, privacy settings and data-handling protections before allowing employees to use a platform.Protect patient and organizational information. AI governance should reinforce safeguards around protected health information, personally identifiable information, financial records and intellectual property.Put expectations in writing. A formal policy should identify approved tools, prohibited data, acceptable use cases and employee responsibilities. Blocking every AI platform is unlikely to stop adoption, so clear and workable boundaries are essential.Match access to employee roles. AI tools should follow the same permission principles used elsewhere in the organization. Employees should only be able to retrieve or process the information required for their responsibilities.Create a culture of prompt reporting. When an employee clicks a suspicious link or shares information with the wrong platform, reporting the mistake quickly gives cybersecurity teams the best chance to limit damage.Resources

Learn more about Anatomy ITConnect with Michael Ducsak on Linked