The Outsourcing Pattern Has a Limit
Healthcare systems have spent two decades outsourcing technology. EHR to Epic or Cerner. Revenue cycle management to Waystar or R1 RCM. Credentialing to VerityStream. Supply chain to Vizient.
Each outsourcing decision made sense individually. The health system didn't have the capability in-house, the vendor had economies of scale, and the technology wasn't core to clinical care.
AI is different. And the health systems that treat AI outsourcing like EHR outsourcing are about to learn why.
Why SaaS Doesn't Work for Healthcare AI
The SaaS model works when the data being processed isn't clinically sensitive, when the vendor's errors don't create patient safety risks, and when switching costs are manageable.
Healthcare AI fails all three conditions.
PHI creates a fundamentally different data risk. When a hospital outsources its scheduling software, the data involved is operationally important but not clinically sensitive.
When a hospital outsources AI that processes clinical notes, medication lists, and diagnostic data, every API call carries PHI. Every conversation log is a potential HIPAA violation if improperly stored. Every vendor breach is a health system breach.
The average healthcare data breach costs $10.93 million — more than any other industry. Adding AI to the breach surface by sending PHI to third-party SaaS platforms is a quantifiable risk that most health system boards haven't explicitly accepted.
Clinical decision support creates liability that SaaS vendors won't absorb. When an AI tool suggests a medication adjustment and the patient has an adverse reaction, the malpractice claim names the prescribing physician and the health system.
The AI vendor's terms of service explicitly disclaim clinical liability. The health system bears the risk while the vendor bears none.
This asymmetry is tolerable when the health system fully controls the AI system — choosing which models to use, defining clinical guardrails, maintaining oversight protocols.
It's intolerable when the health system is relying on a black box operated by a vendor whose primary obligation is to their shareholders.
BAA complexity compounds with every AI vendor. A BAA isn't a simple contract. It's an ongoing compliance obligation that requires the covered entity to verify the business associate's safeguards.
Each AI SaaS vendor requires its own BAA. Each vendor's subprocessors — the model providers, the cloud platforms, the analytics services — add layers of BAA dependency.
A health system with four AI SaaS tools might have a dozen BAAs to monitor and enforce. When one of those vendors changes their cloud provider or model supplier, every downstream BAA needs review.
What Sovereign AI Means for Healthcare
Sovereign AI is a straightforward concept that sounds more radical than it is: the health system runs its own AI platform on its own infrastructure.
No BAA needed for the AI platform, because PHI never leaves the health system's environment. No third-party breach surface, because there's no third party. No vendor pricing leverage, because the health system owns the software and controls the compute costs.
This isn't a return to building everything from scratch. Modern AI platforms can be deployed on a health system's infrastructure — on-premise or in a dedicated cloud tenant — in weeks, not years.
The health system gets enterprise-grade AI capabilities while maintaining complete control over data, models, and governance.
ibl.ai provides this architecture. Health systems deploy the full platform in their own environment, with source code access, HL7 FHIR integration, and LLM agnosticism. The result is AI capability without AI dependency.
The HIPAA Simplification
Here's the part that makes sovereign AI compelling for health system CISOs and compliance officers.
Traditional AI deployment (SaaS model):
- PHI sent to vendor's cloud
- BAA required with AI vendor
- BAAs required with vendor's subprocessors
- Ongoing verification of vendor's security controls
- Breach notification dependency on vendor cooperation
- Annual security assessments of vendor infrastructure
Sovereign AI deployment (owned infrastructure):
- PHI stays in health system's environment
- No BAA needed for AI platform
- No subprocessor chain to monitor
- Security controls managed by health system's own team
- Breach scope limited to health system's own infrastructure
- Security assessments use existing institutional processes
The HIPAA compliance burden doesn't just decrease — an entire category of compliance work disappears. The health system's existing security infrastructure, policies, and audit processes extend to cover the AI platform without creating new vendor dependencies.
For a health system CISO managing dozens of vendor relationships, eliminating the AI vendor from the compliance portfolio is operationally meaningful.
How IT Management Changes
Running your own AI platform changes the health system IT team's role, and this transition requires honest assessment.
What IT gains. Complete visibility into how PHI is processed. The ability to inspect, modify, and audit every component. Control over model selection, cost management, and performance optimization. No dependency on vendor support queues for clinical-impacting issues.
What IT takes on. Infrastructure management — servers, GPU allocation, platform updates. Model deployment and testing. Integration maintenance for Epic, Cerner, or other EHR connections via FHIR.
This isn't trivial. But here's the counterargument health system IT leaders should consider: you're already managing infrastructure for your EHR, your imaging systems, your lab systems, and your network.
AI infrastructure isn't categorically different. It's another clinical system that needs uptime, security, and maintenance.
The question isn't whether your IT team can manage AI infrastructure. The question is whether the alternative — entrusting PHI to a third party whose incentives don't align with your patients' interests — is actually easier.
Most health system CIOs, when they examine the total burden of managing vendor BAAs, security assessments, compliance monitoring, and contract negotiations, find that managing their own infrastructure is comparable in effort and superior in control.
The Modernization That Matters
Healthcare modernization conversations typically focus on digital front doors, patient portals, and telehealth. Those matter. But the modernization that will define the next decade of healthcare is whether health systems own their AI or subscribe to it.
Consider the trajectory. AI will increasingly assist with clinical documentation, diagnostic support, medication management, care coordination, quality improvement, and patient communication.
The health system that outsources all of this to SaaS vendors has outsourced its clinical intelligence to parties it doesn't control.
That's not modernization. It's a new form of dependency that makes EHR vendor lock-in look manageable by comparison.
True modernization means the health system builds institutional AI capability — the expertise, infrastructure, and governance to run AI as a core clinical function rather than a collection of subscriptions.
What the NextGen Health System Looks Like
The health system of the near future doesn't use AI. It runs AI.
Clinical intelligence is internal. The AI that assists physicians with diagnostic reasoning, helps nurses with patient education, and supports coders with medical coding runs on the health system's own infrastructure.
No PHI leaves the building. No BAAs for AI processing. No vendor pricing leverage.
Model selection is a clinical decision. The CMIO chooses which AI models handle which clinical workloads based on accuracy, cost, and appropriateness — not based on which vendor locked them into a specific model provider.
Experimentation is continuous. Departments create and refine AI agents for their specific workflows without waiting for governance committees to evaluate individual vendor products. The platform provides the secure foundation; departments provide the clinical expertise.
Data stays sovereign. Patient data is processed, analyzed, and used to train clinical AI models — all within the health system's own infrastructure. The insights derived from that data benefit the health system's patients, not the AI vendor's product roadmap.
Integration is through open standards. FHIR connects the AI platform to Epic, Cerner, Allscripts, athenahealth, and Meditech through standardized interfaces.
When the health system acquires a new facility with a different EHR, the AI platform extends through another FHIR connection rather than a vendor-specific integration project.
The Decision Framework
Health system leaders evaluating AI strategy face a binary architectural decision that will compound over the next decade.
Path A: Subscribe to AI. Faster initial deployment. Vendor manages infrastructure. But PHI leaves the health system. BAAs multiply. Per-clinician costs scale linearly. Clinical AI strategy is bounded by the vendor's roadmap. Switching costs increase annually.
Path B: Own AI. Slightly longer initial deployment. Health system manages infrastructure. But PHI stays sovereign. No BAA needed. Costs are infrastructure-based, not headcount-based.
Clinical AI strategy is bounded only by the health system's ambition. Switching costs are zero because there's nothing to switch from.
The health systems choosing Path B today will have institutional AI capability that compounds over years. The health systems choosing Path A will have vendor subscriptions that get more expensive and harder to leave.
The Real Risk
The risk isn't that AI won't work in healthcare. It will. It already does.
The risk is that health systems will outsource AI the way they outsourced EHR — and then spend the next two decades managing vendor dependencies, negotiating escalating contracts, and working around platform limitations.
Healthcare systems learned this lesson with EHR. The ones that recognize the pattern aren't repeating it with AI.
The NextGen health system runs its own AI. Not because it's trendy. Because the alternative — outsourcing the technology that processes PHI and influences clinical decisions — is a risk that no health system should accept without exhausting the alternatives first.