Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Who Owns the Data When AI Touches Patient Records? A Health System CFO on AI Governance
From HAL: Who Signed Off on This?, with Jim Sinkoff, Deputy CEO and CFO of Sun River Health
Episode: Healthcare AI Governance: Who Owns the Data? Jim Sinkoff, Sun River Health. Listen on Libsyn. The show is also on Spotify and YouTube.
In brief
-
If your organization is the one that gets sued after a breach, the data is yours, and every AI contract should say so.
-
When an AI moves money, the first people accountable are the owners of the finance process: the controller, the senior vice president of finance, the CFO and the bank. The CIO answers for the defenses around them.
-
Administrative AI tools can read nearly everything on a screen once they are launched. On the clinical side, the API layer around the EHR is the point to watch.
-
Sun River keeps its billing robots outside the EHR. They receive instructions, do the work and post a transaction back.
-
The board position is all in on AI, on three conditions: it meets policy, it is secure, and the organization co-creates the tool.
About the episode
Jim Sinkoff sits on both sides of the healthcare AI market. As Deputy CEO and CFO of Sun River Health, a community health system with about 240,000 patients across 50 clinical sites in the greater New York area, he buys AI. As head of Solutions 4 Community Health, which helps community clinics deploy technology, he also sells it. On HAL: Who Signed Off on This? he explains how a leader who signs for both the money and the systems decides what AI is allowed to touch.
His organizing idea is ownership. A covered entity that can be sued for a breach owns the data, and that ownership should shape every contract, data feed and verification step. The rest of the conversation follows from it: who is accountable when an AI moves money, what AI tools can read on a staff screen, why billing robots sit outside the clinical record, why trust still requires a person, and the conditions behind his decision to go all in on AI.
Highlights from the conversation
If an AI moved $100,000 out of the organization, who is responsible?
Chris Sowa: In your role in charge of such a large organization, if an AI moved $100,000 out of the organization tomorrow, who would you say was responsible?
Jim Sinkoff: From a cash management perspective, just in terms of my environment, we deploy no AI tools or agents in anything in our financial world. Nothing to do with accounting, procurement. We have digital solutions, but we don't deploy any AI solutions. But if in fact we got a hack, an AI hack, and $100,000 was moved, the folks that would be directly responsible would be the controller, the senior vice president of finance, the CFO, and our banking partner.
The other individuals that would be indirectly responsible for that would be our chief information officer, who has built what we hope will continue to be a very, very strong system of denying penetrations. So that would be a second layer, an individual that would be very involved in diagnosing how this happened.
His list starts with the people who own the financial process, and the CIO comes second, as the owner of the defenses. Many AI deployments run in the opposite order and treat an agent's actions as a technology question first. If an agent can touch a payment, the names on that list should be agreed before the agent goes live.
What can AI tools actually read on a staff screen?
Chris Sowa: Whether they're logging in through a browser tab or using their phone, some staff are doing it at most organizations. Based on talking to your staff right now, what can AI actually read off of their screens?
Jim Sinkoff: I think we need to break it down between the administrative processes. Administratively, the AI tools, whether it's Copilot embedded in Microsoft tools or folks using Gemini or other layered agents, they can pretty much read anything once they're launched. They are reading the full dossier. And we know they're reading the full dossier because everybody wants the notes post meetings from an administrative point of view. So we know that while it looks like they're just giving us the transcript, they are able to provide a great deal more information if we prompt it. So we're aware that they can read everything.
That's not the case in the clinical environment. The clinical environment is much more rigid. Our core electronic health record does not have any embedded AI in it itself. It has third-party vendors that have maybe ambient listening tools. And then there's an API layer that is built in order to effectuate some of the workflows and some of the dynamics. That API layer is obviously the most sensitive point of penetration where AI can begin to spread, if you will, in ways that are unintended.
Two halves of one organization, two different answers. On the administrative side, the working assumption is that the AI sees whatever the person sees. On the clinical side, the control point is the integration layer. Both lead to the same operational question: for this task, what should the AI be able to see?
How do you take cost out without putting automation inside the clinical record?
Chris Sowa: I've never spoken to somebody who was a CEO that was in charge of a large health system like you and heard that there was not pressure from a cost perspective, and this constant need to do more with the people that you have or with fewer people.
Jim Sinkoff: If you look at the arc of AI, everything from neural networks to even more advanced forms of AI today, all the way to robotics […] where we have deployed for the purposes of cost savings is really a great deal of robotics. If you're billing a medical claim, it's very routinized. There are a number of steps that you need to go through in order to go from beginning to end. And that can be done robotically. And so we have deployed a great deal of robots to actually consummate those transactions.
The way the environment is secure is the robots don't sit natively within the EHR, they sit outside the EHR, and the instruction is then fed to the robot. The robot completes the work, and then there is a transaction back into the native system. And that has helped us from a cost perspective, in not having to recruit and hire those human beings that once used to do that.
The automation works at the edge of the system of record, under instructions, and comes back in through a defined transaction. The same pattern fits AI agents: let the agent work outside the core record, limit what it receives, and make every write back a controlled and logged step.
Who owns the data?
Jim Sinkoff: I do encourage in my conversations with my colleagues and others to really think about data governance from this very core perspective: who owns the data? And when organizations really understand who owns the data, I think they can begin to craft policies, procedures, procurement policies, testing verification over their data. And the reason why I say this, Chris, is very simple. If there's a cyber breach, the covered entity is the entity that's sued. And therefore, if that's true, then if you can be sued for the breach of that data, that means you own that data. And therefore, you should be doing everything from a risk management perspective, including AI, to not just secure that data, but make sure that all of your contracts make it very clear with all the third parties you're working with that it's not their data.
When you deploy those AI tools, oftentimes there'll be provisions for subrogation, there'll be provisions for data use agreements, and a variety of important documents that frame and define the relationship between the parties. Often what happens is organizations don't ask for bi-directional feeds to make sure that they're getting all of their data back into their central repository. It's an outbound transaction. And then that company is using that data for research and other things to perfect products. And when you want the data back, they often say, well, it'll cost you X number of dollars for us to build an API for you to get it back.
Before signing an AI contract, three questions are worth answering in writing. Does the contract say the data belongs to us? Does the data come back to us in a usable feed? Can the vendor use it to train or improve its own product? An organization that cannot answer all three is carrying the liability for data it no longer fully controls.
Why does trust still require a person?
Chris Sowa: On the one hand, you have become very knowledgeable and expert in AI. On the other hand, when we were coming into this conversation, you mentioned to me you actually prefer a lot of the analog. If you could maybe just expand a little bit on why you think that's important for people.
Jim Sinkoff: What I think is the most important thing is trust. So you asked me early on about who would be responsible. Well, if I told you it was a series of robots that were responsible for it, I have no way to manage from a place of trusting my colleagues' ethics, trusting my colleagues' integrity. I have no way of imbuing ethical discernment in the work that we're doing.
Now, I work in the healthcare space, and I fundamentally believe that healthcare is a human endeavor. Regardless of how much AI can tell us about cancer cells or too much calcium buildup in plaque, all good, all great, stuff that should be done. But at the end of the day, when somebody is losing a loved one or is frightened about a potential outcome or is not understanding their medication, that human touch is of so much value and it creates the kind of trust that I think is so important.
Accountability depends on someone whose judgment and integrity can be trusted and questioned. That is why the approval for a consequential AI action has to carry a person's name, not a system's.
What should a board decide about AI this year?
Chris Sowa: If you were giving counsel to a peer or to the board as a group, and there are two key things that we need to decide before the end of the year as it relates to AI, or we're going to regret not talking about them, what would be that key decision that they ought to be making as a team and as an organization?
Jim Sinkoff: Let me start from a philosophical perspective or policy perspective. What I have said to my board is that we are all in on AI resources and AI solutions. As an organizational strategic imperative, we will continue to innovate, explore, and deploy AI tools as quickly and as fast as we can with this proviso. So long as it's done in a way that we believe meets our policy, which we've crafted, and is secure. And last but not least, is that we are a co-creator in the development of that AI. We very rarely take an off-the-shelf product and deploy it because it's very hard to verify.
What are the data sets that they're pulling from? Are they relevant to us? Not relevant? There are a number of things that we interrogate before we do the work. We want to engage, we want to find these great solutions, but we're not just opening the vault and saying, go forth.
All in, with conditions, is a position a board can hold management to, because each condition can be tested. The vault line is the part many organizations skip. Going all in on AI does not mean giving every tool access to everything.
What leaders who sign for AI can take from this conversation
-
Name the finance owners accountable for any AI that can move money, and agree on the list before an agent is deployed.
-
For each AI tool, write down what it can read on screen, task by task, and treat the integration layer as a control point.
-
Put data ownership, return feeds and training rights into every AI contract.
-
Keep automation at the edge of the system of record, with a defined and logged handoff.
-
Move fast, on conditions the board can check: policy, security and co-creation.
Where RedactSure fits
RedactSure is built around the question at the center of this episode: what should the AI see for this piece of work? Patient and account identifiers become tokens before the model reads the screen, so an agent can complete a billing or coding task without the real values entering the model. A named person approves each consequential action, and a record of what the AI saw and did is kept for the organization. The work gets done. The data stays hidden from the AI.
Frequently asked questions
Who is responsible when an AI agent moves money in a health system?
In Jim Sinkoff's view, the owners of the finance process are directly responsible: the controller, the senior vice president of finance, the CFO and the banking partner. The CIO is responsible at a second layer, for the defenses and for diagnosing what happened. The point is to settle that list before an agent can touch a payment.
What can AI copilots read on a staff member's screen?
On the administrative side, he assumes AI tools can read nearly everything once they are launched, because they produce meeting notes and more on request. In his clinical environment, the EHR has no embedded AI, and the API layer used for workflows is the most sensitive point to control.
What should an AI vendor contract say about data?
That the data belongs to the organization, that it comes back in a usable feed rather than flowing only outward, and whether the vendor may use it to train or improve its products. He also asks vendors which data sets their models draw on before deploying anything.