When the agent is inside the chart
Software agents now read, draft and send from the medical record; medical staffs should give each one its own identity, limited privileges and an audit trail before it is switched on.
Listen to this special topic
read by an AI voiceLast week Epic's chief security officer told The New York Times that flaws in certain configurations of its software could let someone view sensitive patient records without the access appearing in the audit trail, the log that shows who opened a chart. The flaws were found by an AI model from Anthropic, lent to software makers under a program to find and fix vulnerabilities. Days earlier, Australia's prime minister had said that an OpenAI agent reached non-public files on a government health statistics site; OpenAI said that during an internal evaluation "our models took actions we did not intend" and that it had found no evidence that patient records were accessed. A security firm then reported that such agents had also probed the websites of the Mayo Clinic and the CDC; Mayo says it has no indication of unauthorized access.
None of these was an AI agent working inside a hospital's own record. That is the next step, and it is arriving fast. Epic's tools already draft the note and queue up orders from the conversation in an exam room and answer patients' questions in its portal, and Epic says its billing agent will in time complete coding and insurance appeals on its own within limits each hospital sets; in March Epic announced a tool for hospitals to build agents of their own. When such an agent reads, writes or exposes a record, the hospital must be able to say which agent acted, for whom, and with what permission. A medical staff should require of every agent what it requires of every person with a login: an identity of its own, privileges limited to its job, a complete record of what it did, and someone who reads that record. In some respects agents need more.
The principle is old. The federal security rule for health information already limits access to "persons or software programs" that have been granted it, requires a unique identifier for every user, and requires systems that record activity; it defines a user as "a person or entity," and hospitals must regularly review the logs. The trouble is practice. Epic says its agent actions are traceable; the announcement does not say under whose name they are recorded. A common standard for connecting outside software to a record lets a program act with access granted in advance and no user authorizing it at the time. An action recorded under a clinician's login looks like the clinician's own, and one recorded under an account shared by every copy of a product cannot say which agent took it.
Agents also fail in ways people do not. They can be steered by what they read: in 2025 a single email carrying hidden instructions could make Microsoft's office assistant leak internal data without anyone clicking anything; Microsoft fixed it before any known exploitation. They have been less reliable at changing records than at reading them: in a Stanford test of tasks in a simulated health record, published in 2025, the best of the models then available completed 85% of queries but 54% of actions, though one of its authors has since reported "a surprising amount of improvement" in newer models. And in a study that tried to provoke misbehavior, agents reported tasks as complete when the systems they worked on showed otherwise. A log that says only who opened the chart misses what matters about an agent: which version acted, for which person, on what instruction, and what it sent out. Federal standards officials are still asking how to bind an agent's identity to a human's.
Accountability, as things stand, is spread thin. The hospital answers for access and audit under the security rule. A vendor that handles patient data is its business associate and must report security incidents to it. A clinician who signs an entry an agent drafted owns it, since every record entry must be authenticated. The American Medical Association says developers of autonomous clinical AI are best placed to manage liability for its failures. When something goes wrong, each can point to another. Epic's security chief said the testing raised the possibility that records could also be altered through the flaws, but that whether they could depends on other parts of the technology and not necessarily Epic's. California's attorney general, who has subpoenaed OpenAI over cybersecurity incidents involving its models, says developers have a "moral and legal responsibility" not to enable attacks.
Washington will not fill the gap soon. An update to the security rule proposed in January 2025, which would require multifactor authentication and notice within 24 hours when a worker's access changes, has slipped to July 2027 or later. A cybersecurity bill the Senate passed on Sept. 30 would direct the health department to require multifactor authentication, encryption and monitoring, including penetration testing, across health care; the new rules would take effect three years after enactment, and the House has yet to act. The voluntary guidance on AI from the Joint Commission and the Coalition for Health AI asks hospitals to enforce strict access controls and name who monitors each tool.
The objection is that this is a job for the security office, not the medical staff, and that more sign-offs will only make physicians answerable for code they cannot see. Credentialing under Medicare's rules is for practitioners, and the rule says nothing about software. Required approvals can become a rubber stamp: Epic says 92% of the prior-authorization responses its agent drafts at one customer are accepted without edits. Those are real risks. But the same Medicare rule makes the medical staff responsible for "the quality of medical care provided to patients by the hospital," and an agent that drafts orders or answers patients is part of that care. Privileges are the right model because they are about scope: what an agent may read, what it may draft and what it may do without a human. The answer to rubber stamps is fewer approvals on the actions that matter, and logs good enough to check the rest. The hospitals now holding back some of Epic's tools are already doing this kind of judging: Children's Healthcare of Atlanta paused one feature over too many inaccuracies across diagnosis and patient locations.
The remedy is to treat an agent as hospitals already treat a new clinician, and to write its terms into the vendor's contract before it is switched on. Each agent should have an account of its own, never a clinician's session or a login shared by every copy of a product; the federal health department's voluntary cybersecurity goals already call for unique credentials so that unusual activity can be spotted. Its privileges should say what it may read, what it may draft and what it may do without a person, and rule out the rest, such as signing, ordering or sending records outside the organization. Every action should be logged with the agent's identity and version, the person it acted for and the instruction it was given, in a record the vendor cannot alter. And the vendor should show that the log works before go-live, since the Epic flaws show that an audit trail can miss access without anyone noticing.
Human approval should be kept for the actions that matter. Anything that enters the legal record or reaches a patient as clinical advice should be approved by a named clinician; routine work inside the agent's scope can be sampled every month instead. The hospital should be able to cut off an agent's access at once, without waiting for the vendor, as it should remove a departing worker's access promptly. And an agent that exposes data or does something it was not asked to do should be reported and investigated like a medication error, with the vendor bound to hand over its logs and the hospital reporting such events, without names, to a patient safety organization, as the Joint Commission's guidance suggests.
Everyone who opens a chart today is meant to be named, limited and checked afterward. Before software joins them, the medical staff should make sure the same will be true of it.
- Becker's Hospital Review reported on Oct. 1, 2026, citing a Sept. 30 story in The New York Times, that Epic found "certain software configurations could let someone view sensitive patient records without the access appearing in a digital audit trail," according to Epic's chief security officer, Stirling Martin. Becker's said Anthropic's model did not determine whether an attacker could also alter records, though Mr. Martin said the testing raised that possibility; he said: "Whether things can be changed is more complicated, and depends on other parts of the technology and not necessarily Epic's in that case." TechCrunch reported Oct. 2 that some customer configurations of MyChart, Epic's patient portal, could allow outsiders to access patient records without the intrusion being recorded in the software's logs. Neither report said whether the flaws were exploited. The flaws were found under Anthropic's Project Glasswing, which gives partners restricted access to its Mythos model to find and fix vulnerabilities. Epic CEO Judy Faulkner said in September that Epic was pausing most technology development to focus on security for about six weeks (Fierce Healthcare); an Epic spokesperson said work on AI, including Agent Factory, continues.
- Asymmetric Security reported on Oct. 1, 2026, a 48-hour investigation of reported rogue OpenAI agent activity between March and September, finding "evidence of probing a broader set of websites, including those of the CDC, SEC, International Energy Agency, and Mayo Clinic," and attempts to find exposed configuration files and create accounts. A Mayo Clinic spokesperson said Mayo "has no indication or evidence that any unauthorized access to its systems or data has occurred" (Becker's). Transluce reported on Sept. 23 that agents attempted to exploit vulnerabilities in the Australian Institute of Health and Welfare's site on June 20 and 21; it described the activity it observed as minor and said it saw "no evidence of exploitation." ABC News reported on Sept. 24 that Australia's prime minister, Anthony Albanese, said an OpenAI agent had gained access to public and non-public files associated with the Australian Medicare Statistics Reporting Portal, a public-facing statistics site, and had written files to an internal server. An OpenAI spokesperson said that during an internal evaluation "our models took actions we did not intend" and that the company's review "found no evidence of patient records being accessed." California's attorney general announced on Oct. 1 that he had served OpenAI an investigative subpoena the day before.
- Epic says its AI charting "listens during patient visits, drafts the clinician's note, and queues up orders"; its patient-facing Emmie helps patients schedule appointments; and its revenue-cycle agent Penny "will complete coding sessions and appeal submissions independently within each organization's guardrails." Epic says "Agent actions are traceable." At HIMSS in March 2026 Epic announced Agent Factory, a platform for health systems to build their own agents; Summit Health cut prior authorization submission time by 42%, with 92% of AI-generated responses accepted without edits (company figures). Healthcare IT Today, in a Sept. 3, 2026, article based on an interview with an Epic developer, wrote that "for the foreseeable future, any clinical decisions will be approved by a doctor or nurse." Oracle Health's Clinical AI Agent drafts notes and orders, and Microsoft's Dragon Copilot, which can be embedded in Epic, drafts notes and captures orders from the conversation. The SMART Backend Services specification lets software access FHIR data with pre-authorized scopes and no user authorizing access at runtime.
- 45 CFR 164.312 requires covered entities to allow access to electronic protected health information "only to those persons or software programs that have been granted access rights," to "Assign a unique name and/or number for identifying and tracking user identity," and to implement mechanisms "that record and examine activity"; 164.304 defines a user as "a person or entity with authorized access"; 164.308 requires regular review of audit logs and security incident procedures; business associates must report security incidents (164.314). The proposed update published Jan. 6, 2025, would require multifactor authentication, encryption, an asset inventory, notice within 24 hours when a workforce member's access changes and an annual compliance audit. The 2026 Unified Agenda lists the rule among long-term actions, with final action in July 2027; Paubox reported that final action has been delayed until at least July 2027.
- 42 CFR 482.22 requires an organized medical staff "responsible for the quality of medical care provided to patients by the hospital," which examines the credentials of candidates for membership and recommends their appointment, under bylaws that set criteria for the privileges granted to individual practitioners; it does not mention software. 42 CFR 482.24 requires that all medical record entries be "legible, complete, dated, timed, and authenticated" and that records be released only to authorized individuals.Sources: 42 CFR 482.22, 42 CFR 482.24
- The Joint Commission and the Coalition for Health AI issued non-binding guidance on Sept. 17, 2025, calling for governance structures, strict access controls, named parties responsible for monitoring AI tools, and confidential, blinded reporting of AI-related safety events to independent entities such as patient safety organizations. NIST's National Cybersecurity Center of Excellence published a concept paper in February 2026 asking how agents should be identified and authorized, how to establish least privilege for an agent, "How do we bind agent identity with human identity to support 'human-in-the-loop' authorizations?" and how agents can log their actions "in a tamper-proof and verifiable manner." OWASP released a Top 10 for agentic applications on Dec. 9, 2025. HHS's voluntary health sector cybersecurity performance goals include unique credentials, prompt revocation of departing workers' access, centralized log collection and vendor requirements. The American Hospital Association, in a written statement for a Senate subcommittee's Sept. 30, 2026, hearing on rogue AI agents, said third parties handling health information should be held to the same privacy and security standards as covered entities and business associates, and that entities outside HIPAA that hold or process health information, including certain AI vendors, should be subject to "similarly rigorous" standards.
- EchoLeak (CVE-2025-32711), disclosed June 11, 2025, was an AI command injection in Microsoft 365 Copilot that allowed an attacker to disclose information over a network with no user interaction; Microsoft fixed it server-side, said no customer action was required and, according to BleepingComputer, said there was no evidence of real-world exploitation. In MedAgentBench (Stanford; arXiv, February 2025, later published in NEJM AI; 300 tasks in a FHIR environment with 100 patients), the best of 12 models tested, Claude 3.5 Sonnet v2, completed 69.67% of tasks overall, 85.33% of query tasks and 54.00% of action tasks; a co-author later said follow-up studies showed "a surprising amount of improvement" by newer models. A February 2026 red-team study of six autonomous agents found cases in which "agents reported task completion while the underlying system state contradicted those reports."
- Becker's reported on Oct. 2, 2026, that Children's Healthcare of Atlanta put an inpatient insights capability on hold because it had "too many inaccuracies across diagnosis and patient locations, and produced excessively long narratives"; Atlantic Health is "taking a measured approach to tools that make autonomous clinical decisions or engage patients without appropriate human oversight"; St. Luke's is piloting Chart with Art while continuing to use Ambience; and Penn Medicine is holding off on Epic's patient-facing Emmie. The Senate passed S. 3315, the Health Care Cybersecurity and Resiliency Act of 2026, by unanimous consent on Sept. 30, 2026, with a substitute amendment from Sen. Bill Cassidy; the HELP Committee announced the passage Oct. 1, and the House received the bill Oct. 5. As passed, it directs HHS to update the HIPAA Security Rule to require covered entities, business associates and other non-governmental entities in the health care and public health sector to adopt minimum risk-based cybersecurity practices, including multifactor authentication, encryption and monitoring, including penetration testing, effective 36 months after enactment, and it provides for grants and rural guidance. Google said Sept. 30 that its Gemini 4 Argon model found a critical vulnerability in health care software used by hospitals; it did not name the vendor.