Generative AI, Cybersecurity Among Top Risks for Healthcare Provider Organizations in 2025

Overseeing the use of generative artificial intelligence, enhancing cybersecurity and ensuring compliance with a host of federal healthcare regulations headline the Top Risks health systems face in 2025, according to an annual study by Kodiak Solutions.

Kodiak Solutions develops its annual Top Risks list based on discussions with leaders of many of the largest U.S. hospitals and health systems, and risk assessments or audits at hundreds of hospitals, health systems, medical practices and other provider organizations.

“Our annual Top Risks report illustrates the wide range of risks that are keeping leaders of hospitals and health systems awake at night,” said Dan Yunker, senior vice president, risk and compliance, at Kodiak Solutions. “The ripple effects these risks can cause across a provider organization underscore the need for vigilance to keep problems from becoming entrenched in processes and systems.”

Generative AI leads financial/operational risks

Generative AI, machine learning and other forms of AI offer great promise to health systems to enhance efficiency, offer greater convenience to patients and reduce burdens on clinicians. The growing use of AI comes with many significant potential risks that must be avoided or mitigated. Internal auditors should consider audits in several areas to gauge their preparedness, including:

  • Quality and integrity of existing data sets
  • Cross-functional process development and oversight
  • Testing, governance, policies and legal frameworks for the use and fairness of generative AI
  • Resource training and support of AI-driven processes for adoption of safe and responsible use to ensure patient safety and security
  • Kodiak’s risk management experts also identified revenue cycle and workforce challenges as other financial/operational challenges that deserve heightened oversight.

Cybersecurity threats continue to rise

Hospitals, health systems and medical providers face rising cybersecurity risks directly to their own information systems and, increasingly, from their exposure to attacks made on their vendors. The Change Healthcare data breach, and resulting shutdown of payments for many healthcare providers, illustrated the significant financial losses that provider organizations can sustain during a third-party cyberattack.

Other information technology top risks identified by Kodiak Solutions also are related to cyberattacks. Business continuity capabilities are needed to aid in recovery from cybersecurity incidents. System access management and biomed device security are both aspects of preventing attacks.

Compliance risks in No Surprises Act, price transparency, 340B

Kodiak’s audits and discussions with leaders over the past year highlighted the growing, fast-changing compliance risks with the No Surprises Act, the 340B drug discount program and price transparency regulations. Failing to maintain compliance in any of these areas can lead to significant monetary penalties. In the case of the 340B program, poor compliance can lead to repaying discounts to drug makers and even expulsion from the program.

“Robust internal auditing serves as the last line of defense before small issues grow into large problems that can threaten the health of the enterprise,” Yunker said. “Internal auditing also provides the road map for enhancing training, policies and processes to ensure greater compliance going forward.”

Featured

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

  • Report: Cyber Attackers Continue to Turn to AI-Based Tools to Avoid Detection

    Comcast Business recently released its 2025 Cybersecurity Threat Report, a comprehensive analysis of 34.6 billion cybersecurity events detected between June 1,2024 and May 31, 2025. Now in its third year, the report offers business leaders a unique perspective into the evolving threat landscape and provides actionable insights to help organizations strengthen their defenses and align cybersecurity with business risk. Read Now

  • Axis Communications Creates AI-powered Video Surveillance Orchestra

    What if cameras could not only see the world, but interpret it—and respond like orchestra musicians reading sheet music: instantly, precisely, and in perfect harmony? That’s what global network technology leader Axis Communications set to find out. Read Now

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.