← Weekly AI Healthcare NewsAugust 28 - September 04, 2026
Two stories ate this week: OpenAI wiring ChatGPT directly into Epic's EHR, and the growing body of evidence that AI scribes carry real malpractice exposure. Those two stories are actually the same story told from opposite ends. On one end, OpenAI is racing to own the clinical data layer before Epic locks it down with its own Agent Factory. On the other end, clinicians and legal experts are starting to document exactly how ambient AI documentation fails quietly and dangerously. Add GPT-6 Astra dropping with 'AGI era' claims, the FDA's TEMPO pilot letting generative AI devices reach patients before full authorization, Deloitte launching a healthcare restructuring venture, and UnitedHealthcare cutting 1,700 prior auth codes, and you have a week where the infrastructure of clinical AI shifted in three directions at once. The question for health system leaders isn't whether to adopt. It's whether your governance can keep up with the speed at which these systems are being deployed into patient-facing workflows.
OpenAI now has read access to Epic records covering 325 million patients. That changes who controls the clinical data layer, and every health system CIO needs a position on this before their clinicians start using it on their own.
OpenAI just wired ChatGPT for Healthcare into Epic's EHR, and every health system CIO is going to get a vendor deck this week telling them the pre-visit workflow problem is solved. It's not. Here's the thing. The integration is read-only. Clinicians can pull patient context into ChatGPT before a visit, cross-reference public health data, and get AI-generated summaries. That's genuinely useful. But the story underneath the story is about who owns the clinical data layer going forward. Epic shipped its own Agent Factory the same week. That's not a coincidence. Epic is telling health systems: build your AI agents inside our walls, on our platform, with our governance. OpenAI is saying: your clinicians are already using ChatGPT anyway, so let's make it official and give it real data. These are incompatible visions. One treats the EHR as the platform of record. The other treats the LLM as the platform of record and the EHR as a data source. Health systems that don't have a deliberate position on this will find it made for them by whichever vendor moves faster. The AI context window just got access to 325 million patient records. That makes AI clinical context cheap to generate, which means fake clinical context also gets cheap. A clinician who doesn't verify the AI summary before a visit is making decisions on potentially stale, hallucinated, or misattributed data. The liability question hasn't been written yet. It will be. So here's my challenge. If you run a health system and you're evaluating this integration: one, demand a written governance policy before any clinician accesses patient data through ChatGPT Health. Two, require audit logging of every query, not just for compliance but for clinical quality review. Three, treat this as a platform decision, not a feature decision. Who you let build agents in your clinical workflow today determines who you're negotiating with in five years.
Risk angle: It's read-only, pre-visit prep framing right now. But read-only is how every data relationship starts. OpenAI now has a documented integration pathway into the most important health record system in the country. Epic's own Agent Factory, launched the same week, is a direct counter-move. Your health system is about to become a battleground between two companies fighting for workflow ownership.
AI scribes are being deployed at scale across health systems right now. The malpractice exposure from silent documentation errors is real, growing, and almost entirely unaddressed in current deployment contracts.
Experts are now on record saying AI scribes create malpractice exposure, and the mechanism is exactly what makes them feel safe: they produce fluent, confident, well-structured clinical notes that contain errors which are genuinely hard to detect. This is the productivity ratchet problem. Health systems buy ambient AI to give clinicians their time back. Burnout falls. Satisfaction scores go up. JAMA Network Open published data showing burnout dropped from 51.9% to 38.8% in a six-system study within a month of adoption. Nobody argues with those numbers. But here's what's also true. Ambient scribe makes note-writing cheap. Which means fake legibility also gets cheap. The Potemkin note just got easier to build. A clinician reviewing an AI-generated note under time pressure is not reading it the way they'd read their own dictation. They're scanning. Approving. Moving on. The note looks right. The note sounds right. The note may be wrong in ways that only surface when the patient deteriorates three days later and opposing counsel subpoenas the chart. The liability question comes down to one thing: who signed the note? The clinician. Not the vendor. Not the AI. The clinician who hit 'approve' on a note they didn't write and may not have fully read. Current vendor contracts almost universally place liability with the provider. Health systems need to renegotiate that or at minimum build mandatory clinical QA checkpoints into the workflow. The concept to name here is 'silent error propagation.' It's distinct from obvious hallucination. It's a plausible error in a fluent note that bypasses clinical review because it reads correctly. Every health system deploying ambient AI right now needs a silent error audit protocol. Most don't have one.
Risk angle: Ambient scribe makes note-writing cheap. Which means the bottleneck is no longer the note. It's the clinician who stops reading what the scribe wrote. Silent errors in AI-generated notes are harder to catch than typos because they're grammatically perfect and contextually plausible. A misattributed medication, a wrong laterality, a missed allergy buried in a fluent paragraph. No red flags. Full liability.
FDA is letting generative AI medical devices reach patients before receiving marketing authorization through its TEMPO pilot. Cadence and Limbic are already in. This changes the risk calculus for any health system considering clinical AI procurement.
FDA's TEMPO pilot quietly changes the game for generative AI medical devices. Cadence and Limbic are among the first four companies accepted, meaning their AI products can now reach patients without full marketing authorization. The framing is 'expedited pathway.' The reality is 'deploy first, validate later.' For health systems, this creates a procurement blind spot. You may be evaluating a clinical AI product that is technically deployed under TEMPO, which means it has not passed the full FDA gauntlet, but it looks like a cleared device in a vendor slide deck. The distinction matters enormously when something goes wrong. FDA clearance is not a liability shield in isolation, but its absence makes the hospital's position significantly weaker in litigation. The pattern here is predictable. Regulators create an expedited pathway with good intentions. Vendors rush to use it because time to market is everything. Health systems adopt without asking the right questions. Adverse events accumulate. Congress holds hearings in two years. In the meantime, the organizations that deployed TEMPO-track products without explicit governance documentation are exposed. Call this 'regulatory cosplay': a product that looks authorized, operates in clinical settings, affects patient care, but hasn't passed the standard evidentiary bar. Every clinical AI procurement process needs a mandatory field: FDA status, and specifically whether that status is full clearance, 510(k), de novo, or a pilot program exemption. If your team doesn't know the answer for every tool currently deployed, that's the first thing to fix.
Risk angle: This is a trap. TEMPO is being sold as innovation-friendly regulation. It's actually a regulatory gap that health systems will be expected to fill with their own governance. When an unauthorized AI device harms a patient in a TEMPO pilot, the FDA approval shield doesn't exist. The health system that deployed it carries the exposure. Pre-authorization deployment means pre-authorization liability.
Mercy Health is the first system to deploy ambient AI documentation for nurses on Android devices. This is the nursing workflow beachhead that the ambient AI vendors have been targeting for two years. If it works at scale, it reshapes nursing documentation across every health system.
Mercy just became the first health system to deploy ambient AI documentation for nurses on Android. This is a bigger deal than it's being covered as. Ambient AI for physicians has been the dominant story for 18 months. Nuance, Ambience, Abridge, DAX. All physician-first. Nursing has been the promised land because nurses spend even more time on documentation, and nursing shortages make that time even more expensive. But nursing documentation is structurally different from physician documentation in ways that make AI more dangerous, not less. Physician ambient AI captures a conversation and generates a note that one clinician reviews and signs. Nursing documentation feeds medication reconciliation workflows, care handoff protocols, fall risk scores, and regulatory compliance reporting. An error in a physician note is bad. An error in a nursing note that propagates into a medication order is a patient safety event. The Android deployment is notable because nursing is an Android-dominant environment. Most clinical ambient AI launched on iOS because that's where physicians are. Android-first is a signal that this deployment was designed for nursing workflows from the start, not retrofitted. Watch Mercy's outcomes data. If they publish infection rates, medication error rates, or regulatory compliance scores alongside the documentation time savings, that's a genuine clinical outcomes story. If they publish satisfaction scores and time-per-note, that's pilot theater. The nursing ambient AI market will be worth watching into 2027. The vendor that cracks nursing documentation with real safety data wins a very large contract pipeline.
Risk angle: Physician ambient AI adoption has clear ROI stories around documentation time and burnout. Nursing is different. Nursing documentation is interlocked with medication administration, care handoffs, and regulatory requirements in ways that physician notes aren't. A silent error in a nursing note doesn't just affect one clinician's chart. It propagates across the care team.
GPT-6 Astra is OpenAI's most capable model and ships the same week they wired ChatGPT into Epic. The capability jump in clinical reasoning, coding, and professional work translates directly into more powerful clinical decision support tools in the next six to twelve months.
GPT-6 Astra just landed and OpenAI is calling it a generational capability leap for professional work, science, and cybersecurity. It's the first model they've designated as meeting their 'critical cybersecurity capability threshold,' which sounds alarming and probably should. But for healthcare, the more immediate implication is what a materially more capable foundation model means for every clinical AI product built on OpenAI's API. The Epic integration, announced the same week, now has GPT-6 Astra underneath it. OpenEvidence's new model family, also announced this week, is operating in the same capability environment. The entire stack of clinical AI tools just got a capability upgrade, whether those vendors have tested it or not. Here's the second-order problem. GPT-6 Astra makes impressive clinical reasoning cheap. Which means impressive-looking clinical reasoning also gets cheaper. The synthetic demo problem in healthcare AI gets materially worse with every foundation model jump. A vendor can now show you GPT-6 Astra reasoning through a complex oncology case with apparent sophistication. That demo is not evidence that the deployed product performs equivalently on your patient population, your EHR data quality, your note structure, or your clinical edge cases. The capability ceiling of foundation models is rising faster than the validation infrastructure of health systems can track. That's the real story of GPT-6 Astra for healthcare. Not AGI. The widening gap between what AI can do in a demo and what health systems can verify it does in deployment.
Risk angle: OpenAI is calling this the 'AGI era.' That framing is marketing. But the underlying capability improvement is real and it will hit healthcare vendor demos before it hits clinical validation studies. Health systems will be shown GPT-6 Astra doing impressive things in synthetic demos long before there's outcomes data. The gap between demo performance and deployed performance in noisy clinical environments is where the bodies are buried.
UnitedHealthcare is removing 1,700 prior auth codes effective October, part of a pledge to cut 30% of utilization management controls. For health systems with high UHC payer mix, this reduces administrative burden on specific service lines. But the question is which 1,700 codes, and what replaces them.
UnitedHealthcare is cutting prior authorization requirements for 1,700 codes this October, which sounds like a big win for providers. It's worth examining more carefully. The prior auth problem in healthcare has never really been about low-acuity, high-volume codes. Those are annoying. The ones that generate physician burnout, delayed care, and adverse outcomes are the complex surgical, specialty, and oncology cases. Those are expensive. Those are the ones payers scrutinize most heavily. And those are not the 1,700 being cut. The 1,700 removed codes are almost certainly lower-complexity services where UHC's internal data showed the approval rate was already near 100%. Removing them costs UHC almost nothing in claims exposure while generating significant positive press coverage and regulatory goodwill. That's not cynicism. That's payer strategy. The net effect for health systems is real but limited: less administrative work on low-acuity cases, no change on high-stakes cases. The AI prior auth tools that matter, the ones doing clinical synthesis for peer-to-peer reviews and denial appeals, still have a full pipeline of work. Xsolis launched a GenAI Peer-to-Peer Synopsis product this week specifically targeting the 24-to-72-hour peer review window. That product would have zero market if UHC's cuts were actually addressing the hard cases. The fact that tools like Xsolis are getting traction tells you where the real prior auth pain lives. Watch what happens to UHC's overall denial rate after October. If it goes up on the remaining codes, that's your answer on whether this was reform or optics.
Risk angle: Prior auth reform makes approval easy on low-risk codes. Which means payer scrutiny concentrates on the codes that remain. AI-assisted prior auth tools get even more important for the complex, high-cost cases that UHC is keeping. Meanwhile, cutting volume-level PA doesn't touch the cases that actually drive denials and physician burnout. Those are the high-cost specialty and surgical cases, and they're staying right where they are.
Mayo Clinic in Jacksonville is deploying Rainfall Health's AI platform to manage compliance and reimbursement under CMS's mandatory TEAM alternative payment model. This is exactly the kind of VBC infrastructure play that health systems need but most don't have.
Mayo Clinic in Jacksonville is implementing Rainfall Health's AI-driven compliance and reimbursement platform specifically to manage care coordination and quality reporting under CMS's Transforming Episode Accountability Model, TEAM. This is the type of deployment that should be getting more coverage. TEAM is a mandatory five-year alternative payment model covering selected hospitals across the country. It's not opt-in. It's not a pilot. Hospitals subject to TEAM are financially at risk for episode costs, and the reporting requirements are real and consequential. Most health systems attempting to manage TEAM compliance are doing it with care management teams, manual chart review, and whatever analytics their EHR vendor shipped. That is not a competitive approach at scale. AI platforms purpose-built for episode payment model compliance, like Rainfall Health, automate the identification of at-risk episodes, flag care coordination gaps in real time, and generate the regulatory quality reporting that CMS requires. The Mayo deployment is notable for two reasons. First, Mayo Jacksonville is a recognized high-performing health system, not a struggling community hospital taking a flier on new technology. If it's good enough for Mayo's risk tolerance, it signals real product maturity. Second, it's deployed in the context of a mandatory payment model, which means there's a hard financial outcome to measure against. This is the kind of deployment that produces actual ROI data. Watch for Rainfall Health to publish outcomes data from this deployment. If they show measurable reduction in episode cost variance and improvement in quality reporting accuracy, it becomes a reference case for every hospital in a mandatory APM.
Risk angle: TEAM is a mandatory five-year model with real financial consequences. Health systems that try to manage TEAM compliance with existing staff and spreadsheets are going to lose money. The question is whether Rainfall Health's platform actually automates the right things or just creates a more expensive dashboard.
Epic Research analyzed 550 million healthcare encounters and found that Medicaid coverage loss is directly shifting patients to self-pay status. For health systems with high Medicaid payer mix, this is a revenue cycle and population health emergency hiding in plain sight.
Epic Research just published an analysis of more than 550 million healthcare encounters showing that Medicaid coverage losses are pushing low-income patients directly into self-pay status. This is important for three reasons. First, the dataset is enormous. 550 million encounters through Epic's research division is among the largest real-world evidence bases in existence. This isn't a single-system study or a Medicare claims analysis. It's a cross-system view of actual encounters. Second, the finding is actionable for health systems right now. Patients losing Medicaid coverage don't disappear from the health system. They show up in the ED. They delay primary care until they're acute. They present with conditions that are more expensive to treat and harder to bill. Third, this connects directly to value-based care performance. The patients cycling off Medicaid are disproportionately the high-risk, high-need patients who anchor quality scores in risk-bearing contracts. When they lose coverage and disengage from care, gap closure rates fall, quality measures miss, and shared savings evaporate. Health systems that want to protect VBC performance need real-time Medicaid eligibility monitoring integrated into care management workflows. This isn't an analytics project. It's a care management workflow project. The AI application here is automated eligibility checking at every touchpoint, proactive outreach to patients flagged as at-risk for coverage loss, and streamlined re-enrollment support. Most health systems don't have that infrastructure. Epic's data makes the cost of not having it legible.
Risk angle: Epic Research data is real-world evidence at massive scale. When it shows a structural payer shift toward self-pay, that's not an analytical artifact. Health systems without automated Medicaid eligibility monitoring and redetermination support tools are already losing reimbursement on patients they think are covered.
Scan.com just raised $220M to build out a US medical imaging network with agentic AI and API infrastructure at its core. This is infrastructure-layer imaging, not a radiology AI point solution, and it's being built to sit between payers, providers, and imaging centers.
Scan.com raised $220 million to expand its US medical imaging network and build out agentic AI and API infrastructure. The headline number is big but the strategic framing is what matters. Scan.com is not building a radiology AI tool. It's building a network. The distinction is important. A radiology AI tool sits inside a health system's existing imaging workflow and adds intelligence. A network aggregates imaging capacity across health systems, independent imaging centers, and payers, and becomes the coordination layer that everyone routes through. If Scan.com executes on this, they become a platform company in the imaging space, not a vendor. Platform companies have pricing power. They have data moats. They have the ability to build AI training datasets that no single health system can replicate. The agentic AI infrastructure they're investing in is what makes this dangerous to competitors and interesting to watch. Agentic AI in imaging coordination means automated scheduling, prior auth handling, routing to the right facility, and potentially AI-assisted reads at scale. That's not a feature set. That's an operating system for medical imaging delivery. Health systems with significant imaging revenue should watch this closely. If Scan.com routes enough volume, they become a necessary partner for any payer doing imaging benefit management. And necessary partners set the terms.
Risk angle: A well-funded imaging network with agentic AI infrastructure becomes a data aggregator at scale. Health systems that route imaging through Scan.com are building a dependency on a third party that holds longitudinal imaging data and the AI pipeline that interprets it. That's a negotiating position health systems may regret in five years.
OpenEvidence is launching specialized AI agent models for oncology subspecialties, moving from general clinical decision support toward domain-expert AI. This is the product direction that will define which clinical AI companies survive the foundation model commoditization wave.
OpenEvidence is launching a new AI model family and deepening its oncology push with subspecialty AI agents. The strategic bet here is important: as foundation models like GPT-6 Astra commoditize general medical knowledge retrieval, the companies that survive are the ones with domain-specific models trained on specialty-specific clinical literature, validated against subspecialty patient populations, and integrated into specialty-specific workflows. General clinical AI is becoming table stakes. Subspecialty AI is where the moat gets built. OpenEvidence's vision of 'medical super-intelligence' through agentic subspecialty models is actually the right architecture bet, even if the marketing language is overwrought. The question is execution. Building an AI agent that's genuinely useful to an oncologist in a complex treatment decision requires three things: first, training data that reflects the actual complexity and recency of oncology evidence; second, validation studies that show the agent's recommendations align with expert oncologist judgment on real cases; third, workflow integration that puts the agent's output in the right place at the right time in the clinical decision process. Most clinical AI companies have the first. Few have the second. Almost none have the third built at subspecialty depth. Watch OpenEvidence's validation data from this oncology push. If they publish head-to-head accuracy data against oncologist judgment on treatment selection cases, that's a real clinical AI milestone. If they publish adoption numbers and physician satisfaction scores, that's pilot theater.
Risk angle: Subspecialty AI agents for oncology need to be validated against real patient populations, not just medical literature retrieval. The jump from 'answers questions about cancer' to 'supports clinical decisions in cancer care' is a regulatory and liability cliff that most general clinical AI companies have not cleared.
Yale New Haven Health and Endeavor Health are investing directly in an AI coding platform. Health systems co-investing in AI revenue cycle tools signals a shift from vendor-client relationships toward strategic ownership stakes in the tools they depend on.
Yale New Haven Health and Endeavor Health are co-investing in an AI coding platform, joining the growing trend of health systems taking direct ownership stakes in the technology tools that run their revenue cycle. This is an interesting strategic move that deserves scrutiny from both directions. On the upside, health systems that invest in AI coding platforms have aligned incentives to see those platforms succeed. They provide clinical validation environments, real-world data, and operational feedback loops that pure venture-backed companies can't access from the outside. That partnership model can accelerate product development in ways that benefit the whole market. On the downside, the conflict of interest is real. When a health system owns equity in a coding AI vendor, the procurement decision is no longer a pure capability evaluation. The board-level incentive is to use the product you own equity in. The clinical and operational incentive is to use the product that performs best. Those two incentives may not point in the same direction. More importantly, if the AI coding tool has accuracy problems, the health system that owns equity in it has a financial disincentive to escalate those problems publicly or pursue contract remedies aggressively. That's a governance gap. Health systems considering vendor co-investment need explicit conflict-of-interest policies in their AI governance frameworks before they close these deals.
Risk angle: Health system investment in AI coding tools creates a conflict of interest in vendor selection and governance. A health system that owns equity in a coding AI vendor has an incentive to deploy that vendor's product regardless of performance, and an incentive not to scrutinize its accuracy as aggressively as they would a pure vendor relationship.
Deloitte is launching a dedicated venture to restructure how healthcare organizations operate. This is not a new practice area. This is Deloitte betting that AI-driven healthcare restructuring becomes a major revenue stream, and positioning early before McKinsey, BCG, and Accenture fully commit.
Deloitte just launched a dedicated venture focused on restructuring how healthcare organizations operate. That sentence sounds mundane. It is not mundane. Deloitte is the largest professional services firm in the world by revenue. When Deloitte builds a dedicated venture around a market segment, it's committing internal investment, partner attention, and brand credibility at a scale that reshapes the competitive landscape for everyone else in that space. The healthcare AI consulting market has been a collection of teams and practice areas within the Big Four and strategy firms. Deloitte building a dedicated venture signals they believe AI-driven healthcare restructuring is a large enough market segment to justify separate organizational infrastructure. That's a significant bet. The 'restructuring' framing matters. This isn't an innovation or strategy venture. Restructuring means operational redesign, cost reduction, and workforce transformation. In the AI context, that means Deloitte is positioning to help health systems figure out which jobs AI can replace, which processes AI can automate, and how to capture the cost savings from both. That's a politically and operationally complex engagement that requires deep clinical and operational trust. The firms that will win this market are the ones that can credibly advise on both the AI capability and the human change management. Deloitte's scale gives them reach. Whether they have the clinical depth to back it up in the room is a different question. For independent and boutique firms: this is your differentiation window. Deloitte will sell transformation programs at health system scale. You can sell the thing Deloitte can't: trusted advisor relationships with CMOs and CNOs who won't talk candidly to a Big Four team. Use that window before Deloitte builds the relationship infrastructure to close it.
Risk angle: Deloitte's 'restructuring' framing is worth reading carefully. Restructuring in consulting means cost reduction, organizational redesign, and workforce transformation. In the AI era, that means headcount displacement justified by AI productivity gains. Health systems engaging Deloitte on this should know exactly what the restructuring recommendations are likely to look like before they sign the engagement letter.
Mayo Clinic's own AI chief is publicly saying AI maintenance costs are far higher than expected. That's the most credible possible source for the hidden cost of enterprise AI deployment, and it's the conversation every health system CFO needs to have before the next AI contract is signed.
Mayo Clinic's chief AI officer just said publicly that AI maintenance costs are far higher than expected. Read that sentence again. This is not a struggling community hospital that bought an AI tool without vetting it. This is Mayo Clinic, with arguably the most sophisticated AI program of any health system in the country, and their top AI executive is saying the maintenance cost reality is not what they budgeted. The implication for the rest of healthcare is serious. If Mayo didn't anticipate the full maintenance cost, the average health system is almost certainly running a materially understated AI total cost of ownership. Maintenance costs in healthcare AI are multi-layered. Model drift requires retraining when patient populations change, coding patterns shift, or clinical protocols update. Data pipelines break when EHR vendors update their API specifications. Clinical QA requires physician time to review AI output quality on an ongoing basis, which is not a one-time implementation cost. Regulatory and compliance requirements change, requiring product updates. Integration layers with EHRs, scheduling systems, and billing platforms require ongoing engineering support. None of these are fully captured in a vendor's implementation proposal. And many of them scale with deployment breadth: the more patients touch the AI system, the more validation burden the health system carries. The consulting implication is clear. Build maintenance cost modeling into every AI business case you deliver. It should include model retraining cadence and cost, EHR integration maintenance, clinical QA staff time, and regulatory compliance update cycles. If the ROI model doesn't hold with realistic maintenance costs embedded, the AI investment doesn't hold. Better to surface that in the business case than in year two of the contract.
Risk angle: AI vendors sell on implementation cost and first-year licensing. Maintenance costs include model retraining, data pipeline upkeep, clinical QA, integration updates, and staff time for ongoing validation. None of those are fully priced into the ROI models vendors present. Mayo's chief is saying they weren't priced in for one of the most sophisticated AI programs in the country either.
GPT-6 Astra Claims the 'AGI Era' Has Started
GPT-6 Astra is OpenAI's latest and most capable model, positioned as a leap in capability for cybersecurity, professional work, software engineering, and science. OpenAI is calling it the first model that meets their 'critical cybersecurity capability threshold,' which is a new internal benchmark they've defined for tracking progress toward more powerful AI. The AGI framing is marketing, but the capability improvement is real. For healthcare specifically, GPT-6 Astra is now the underlying model for ChatGPT for Healthcare and the Epic EHR integration that launched this week. That means any health system evaluating OpenAI's clinical products is evaluating products built on a significantly more capable foundation than what existed six months ago. The practical implication: vendor demos for clinical AI products powered by GPT-6 Astra will look materially more impressive than what's currently deployed in production environments. Model capability and deployed clinical performance are different things. GPT-6 Astra can reason through complex clinical cases with apparent sophistication in a controlled demo environment. Whether it performs equivalently on your EHR's data quality, your clinical note structure, and your patient population's edge cases is a different question that requires independent validation. The gap between demo performance and real-world performance in healthcare AI has historically been large. GPT-6 Astra makes that gap wider and harder to see.
AI Agent Oversight Is Healthcare CIOs' Next Headache
AI agents are different from AI tools. An AI tool answers a question. An AI agent takes action: it schedules, it orders, it routes, it communicates. Epic's Agent Factory, launched this week, is explicitly designed to help health systems build agents that take actions within clinical workflows. OpenAI's integration with Epic is a step toward agentic clinical decision support. As agents proliferate, the oversight question becomes critical. CIOs are raising three specific concerns. First, accountability: when an AI agent makes an error in a clinical or administrative workflow, who is responsible? The vendor? The health system? The clinician who didn't override it? Second, auditability: AI agents that act autonomously may not leave the same audit trail as human decisions. If an agent re-routed a patient referral or flagged a medication interaction and a bad outcome resulted, can you reconstruct exactly what the agent did and why? Third, interoperability: agents built inside one platform (Epic's Agent Factory) may not communicate cleanly with agents built in another (ChatGPT Health). Multi-agent healthcare environments are coming, and the governance frameworks to manage them don't exist yet. The 'who's minding the machines' question is not rhetorical. It's the governance gap that will produce the first major AI agent healthcare liability case. Health systems deploying agents need explicit oversight policies, not just implementation plans.