Is Your Health System Ready for Agentic AI?

Section One

What agentic AI actually is (and why it's different from what you've already seen)

Every vendor at HIMSS this year said the word "agentic." None of them defined it the same way.

That's a problem — not because the word doesn't mean anything, but because when everyone uses it differently, the people making decisions about it stop being able to ask real questions. And the questions here are real.

So let me try to define it plainly, from the inside.

Type 1

Chatbot

Reactive. Answers a question when asked. Waits for the next prompt. Has no memory of what happened between sessions and takes no action on its own.

Type 2

Copilot

A sophisticated assistant sitting beside the human worker. Smart and fast — but it doesn't move until someone gives it a task. Every interaction is human-initiated.

Type 3

Agent

Given a goal, not a prompt. Plans a multi-step sequence, executes it, monitors outcomes, and adjusts — without waiting for a human at each step.

Most of the AI you've already seen in a health system is reactive. You type something, it responds. A nurse asks the ambient documentation tool to summarize the visit, and it summarizes. A physician queries a clinical decision support tool, and it surfaces a recommendation. These things are useful. They save time. But they're fundamentally tools that wait for a human to activate them.

Agentic AI is different in a specific way: it can plan, decide, and act across multiple steps without a human prompting each one. You give it a goal — "get prior authorization for this procedure" — and it figures out the sequence on its own: pull the clinical data from the EHR, check the payer's criteria, complete the form, submit it, monitor the status, notify the team when a decision comes back.

The practical distinction

With a copilot, the human is always in the loop because the system can't do anything without them. With an agent, the human decides where they want to be in the loop — and that decision has real stakes in a clinical environment.

That's the thing vendors don't always slow down to explain. And it's the thing you need to understand before any of the rest of this matters.

Section Two

Why most health systems aren't ready — and what "ready" actually means

A 2025 assessment by THMA and Microsoft looked at how 30 health system leaders across the C-suite, clinical, IT, and analytics roles were thinking about agentic AI. The findings were honest: most organizations remain early in their journey, not because they lack interest, but because the barriers are interdependent in a way that makes them hard to address one at a time.

The interdependence problem

Governance depends on having good data. Good data governance depends on having someone accountable for it. Workforce readiness depends on knowing what agents will actually do. And knowing what agents will do requires a governance policy that doesn't exist yet. Pull any thread and you find another one underneath it.

Most community hospitals are still trying to figure out what AI to buy. The more important conversation — the one that determines whether any of it will work — is about what's already in place before any contract gets signed.

What "Ready" Is Not	What "Ready" Actually Means
A sophisticated data science team	Someone who owns data quality for each domain
A large IT budget	A data environment you've actually mapped
A signed vendor contract	A governance policy that draws the line between autonomous and supervised actions
A general "AI strategy"	A pilot scope narrow enough to produce a measurable outcome
Executive interest in AI	A named human accountable for agent actions

Most community hospitals don't have all five of these foundations in place. Some have none. That's okay to acknowledge — the point is to know which ones you're missing before a vendor tells you that you're ready.

Section Three

The five readiness criteria

These aren't industry standards or certifications. They're what I've seen separate health systems that can actually absorb a real AI program from those that are buying pilots that will sit unused.

1

A single source of truth for your data

An agent is only as good as the data it acts on. If it's going to pull clinical documentation to support a prior authorization request, that documentation needs to be consistent, current, and accessible in one place. If patient records exist across three systems that don't talk to each other, the agent will either fail silently or make decisions based on incomplete information — and you may not know which one happened.

This is the issue that stops more agentic AI implementations than any other. It's not a vendor problem. It's a data infrastructure problem, and fixing it takes time. You don't need perfect data to start. But you need to know where your data actually lives before you give an agent permission to act on it.

2

Named ownership of agent actions

If an AI agent submits a prior authorization and it's wrong, who is responsible? If an agent schedules a patient appointment with the wrong provider, who owns that error and what's the remediation path?

Before any agent does anything in your environment, someone's name needs to be attached to its actions. Not the vendor's name. A human inside your organization who understands what the agent is doing, has visibility into its outputs, and can intervene when something goes sideways. Most organizations are comfortable assigning ownership of tools. Assigning accountability for autonomous actions is a different thing — and the discomfort that comes up around that question is usually telling you something important.

3

A governance policy — even a rough one

You don't need a 40-page framework before you start. You do need a document — even two pages — that answers three questions: What decisions can an agent make without human approval? What decisions require human review before action? What happens when an agent encounters something outside its defined scope?

Lower Risk — Human On the Loop

Passive oversight

Scheduling reminders, status updates, form pre-population. Someone reviews outcomes periodically, not in real time.

Higher Risk — Human In the Loop

Active review required

Anything touching clinical orders or escalation decisions. Review happens before the action is taken, not after.

A rough policy that draws that line clearly is worth more than a detailed one that hasn't been written yet.

4

Staff conceptual literacy about agents

Your staff doesn't need to understand how large language models work. But they do need to understand that an agent is not a faster version of a search box. They need to know that an agent can act on their behalf, that those actions have consequences, and that they're expected to catch things that fall outside normal parameters.

This is a different kind of literacy than "how do I use this tool." It's closer to "what is this thing doing when I'm not watching it?" A team that doesn't understand that distinction will over-trust the agent in the wrong places and under-trust it in the right ones. Thirty minutes of context with a clinical or operations team is enough to start. The goal isn't expertise — it's enough awareness that people know what questions to ask.

5

A pilot scope narrow enough to measure

The most common failure mode I see with AI programs in community hospitals isn't bad technology. It's scope creep before there's a baseline. A health system signs on for a broad "AI-enabled revenue cycle transformation" and six months later can't tell what changed or why.

For agentic AI, pick one workflow. Prior authorization is a strong candidate — it's high-volume, currently manual, and the outcome is easy to measure: approved or denied, and how long did it take? Define what success looks like before you start. Run it for 60 to 90 days. Then decide what comes next.

What a good outcome looks like

An agent that demonstrably reduces prior auth turnaround from 48 hours to same-day is a story you can build on. An agent that "transformed our revenue cycle operations" is a phrase that means nothing to a board or a CFO.

Section Four

Where to start if you're at zero

If you read those five criteria and recognized that you don't have any of them, that's useful information. It means the next step isn't buying a product. It's a short internal audit.

Step	What to Do	Why It Matters First
Weeks 1–2	Map your data environment. Where does patient data actually live? Which systems communicate and which don't? Who owns data quality for each domain?	Surfaces problems people have quietly known for years but haven't had a reason to say out loud. No agent can operate safely without this picture.
Week 3	Have the governance conversation at the leadership level — not as an IT project. Who in this organization is willing to put their name on an AI decision?	If that question creates discomfort, the accountability model isn't clear yet. That's the thing to fix before anything else.
Week 4	Identify your highest-volume manual workflows. Prior auth, scheduling, clinical documentation routing. Pick the one where the outcome is clearest and the downside of error is bounded.	This is your pilot scope. One workflow, one measurable outcome, 60–90 days. Nothing broader until you have a result.

The sequence matters

You don't need a vendor yet. You need a clear picture of where you are. A vendor conversation before that audit is complete will always favor the vendor's framing — not yours.

Section Five

What to watch for in vendor demos now that you know what "ready" means

Vendors will show you the best version of their product in a controlled environment with clean, structured data. That's not a criticism — it's what demos are. Your job, now that you understand readiness, is to ask questions that move the conversation from their environment to yours.

Question 1

"What happens when the agent encounters a record that's incomplete or coded incorrectly?"

A good vendor will show you the failure mode and explain how the agent handles it. A vendor who hasn't thought carefully about this will get uncomfortable. Either response is informative.

Question 2

"Where does the human-in-the-loop occur in your workflow, and how is that handoff designed?"

You're listening for specificity. Vague answers about "oversight" and "monitoring" usually mean the governance model hasn't been built — or has been left to you to design.

Question 3

"What data does your agent need to function, and in what format?"

Then compare that answer to what you actually have. The gap between those two things is your implementation risk. Any vendor who can't answer this precisely has not deployed in a real health system yet.

Question 4

"Who is liable when the agent makes an error?"

You won't always get a clear answer. But how the vendor responds to the question tells you a lot about how seriously they've thought about operating in a clinical environment. Hesitation here is a signal, not a dealbreaker — but it's information.

What to watch for

The best vendors in this space know that readiness is a shared responsibility. They'll be honest about what your organization needs to have in place before their product can deliver on its promise. The vendors to be cautious about are the ones who make it sound easy regardless of where you are.

Agentic AI will be a real part of how health systems operate in the coming years. For community hospitals, the opportunity is genuine — these workflows are manual, high-volume, and expensive. The technology is no longer theoretical.

The question isn't whether it will get good enough.

It's whether your organization will be ready to use it when it arrives.

That readiness starts with honesty about where you are. And with the five things above, you now have a way to find out.

References