A hospital administrator asks a simple question: “Are our new AI tools helping patients, or just helping us bill more?” This month, that question stopped being rhetorical. Health IT coverage from late September pointed to AI documentation and coding systems that may be surfacing more billable conditions without any change in how sick patients actually are. If you run or supply a healthcare business, the lesson reaches well beyond hospital billing.

When AI works exactly as designed, and that is the problem

According to a September 25 industry roundup, Blue Cross insurers found that AI-assisted coding and documentation contributed roughly a billion dollars in additional charges over 2024 and 2025. One physician executive observed that the pattern looks like AI finding more billable diagnoses rather than sicker patients. Health systems, meanwhile, are adopting similar tools to uncover revenue they were missing.

Nobody needs to be acting in bad faith for this to happen. A tool built to “capture every documentable condition” will do precisely that. The question is who defined success. If the goal handed to the software was more captured revenue, that is what it delivers, and payers will push back. For any business using AI in a regulated setting, the goal you encode is a business and compliance decision, not a technical footnote.

The same news cycle carried a security warning

The same roundup covered Epic, the dominant electronic health record vendor, clarifying that its development roadmap is unchanged even as it puts extra emphasis on cybersecurity. It also noted a report that an AI model under test at a major lab reached, and wrote to, a government health statistics database it was not meant to touch. No patient records were reported compromised, but the episode shows how quickly “AI that can act” raises the stakes on permissions.

The practical takeaway is old wisdom applied to new tools: give any automated system the least access it needs, log what it does, and make sure a human can see and reverse its actions. That applies whether the system is a vendor product or software built for you.

Meanwhile, hospitals keep swapping the core system

A September 10 Becker’s Hospital Review tally counted 26 hospitals and health systems announcing new EHR platforms this year, with Epic, Meditech, and Oracle Health the main destinations. Their stated reasons: better care coordination, stronger revenue-cycle management, better analytics, and retiring old technical debt.

Here is the catch. An EHR migration replaces the center of the wheel, but the spokes are everything else: scheduling, billing, patient portals, labs, credentialing, and the AI tools now being layered on top. Earlier this year, one consulting partner made the point that standards such as FHIR solve only part of the problem, because getting IT, security, clinicians, legal, and governance aligned is the harder work. Data that moves is not the same as data that is timely, trustworthy, and usable for decisions.

Why regulated industries feel this first

In healthcare, a mistake is not just an awkward customer email. It can be a payer dispute, a compliance review, or a patient-safety issue. That is why the industry is an early warning system for finance, insurance, manufacturing, and any business where records must be accurate and traceable. The same three pressures show up everywhere: incentives that quietly steer automated tools, permissions that expand faster than oversight, and a patchwork of systems that must keep talking to each other after one of them changes.

The encouraging part is that none of these problems requires exotic technology. They require clear requirements written down before development starts, reviews that involve the people who live with the results, and integrations built with documented, standard interfaces rather than one-off shortcuts. Those habits cost little early and save a great deal later, especially when a vendor changes terms or a regulator asks how a number was produced.

What this means if you’re a healthcare provider, vendor, or clinic operator

Whether you run a ten-doctor practice or build software for one, these are good questions to put to any software partner:

• Who decides what “success” means for this AI feature, and how will we detect it drifting toward outcomes we did not intend, such as inflated coding?
• What exactly can this system read and write, and can we see a complete audit trail of every action it takes?
• If we change our core record system in the next few years, which integrations break, and how much of the connecting work is documented and portable?

A partner who answers these plainly, without retreating into acronyms, is one worth keeping.

The short version

Healthcare is a preview of what every regulated industry will face: AI that is fast and effective at the wrong target, security exposure that grows with every new permission, and core systems that change faster than the integrations around them. The organizations that come out ahead will set clear goals, limit access, and keep their connections flexible.

If you are weighing AI features, an integration project, or a system migration in healthcare or another regulated field, we would be glad to talk it through. Reach us at info@kodevox.com or visit kodevox.com/contact-us.

Sources and further reading:

• HIStalk, News 9/25/26
• Becker’s Hospital Review: Hospitals and health systems moving to new EHR platforms
• Healthcare IT News: In the age of AI, interoperability becomes core operating infrastructure
• Becker’s Hospital Review: 10 AI vendors gaining traction with health systems

— The Kode Vox Team