Artificial Intelligence Implementation and Governance in Healthcare: A Qualitative Study of Cybersecurity Professionals

Hospitals and clinics are increasingly turning to artificial intelligence to help doctors make decisions, manage patient records, and predict health outcomes. These tools are powerful, but they operate within complex digital systems that hold sensitive personal information. Just as a new building needs a solid foundation before people move in, these digital systems need strong rules and protections before they are fully trusted with patient care. The challenge is not just about the technology itself, but about the organizations that use it. A hospital's ability to use these tools safely depends on its leadership, its staff, and its resources. If a hospital adopts a new system without a plan for how to watch it or who is responsible for it, the technology can become a risk rather than a help. This is where the people who guard digital security come in. They are the experts who understand how to protect data from theft or corruption, and their perspective is crucial for understanding how to introduce artificial intelligence without breaking the trust patients place in their caregivers.

A team of researchers set out to understand exactly how these security experts view the process of bringing artificial intelligence into healthcare. They interviewed twenty professionals who work in cybersecurity, data infrastructure, or digital security within or around healthcare systems. The interviews took place between May and August 2025, with each conversation lasting between 45 and 60 minutes. The researchers asked these experts about their roles, their experiences with healthcare technology, and how they see organizations handling the risks of artificial intelligence. The goal was not to test the technology itself, but to listen to the people who are responsible for keeping it safe and to understand the real-world conditions that make that job easier or harder.

The interviews revealed that the success of artificial intelligence in healthcare depends on five connected areas: how ready an organization is, how well they train their staff, how they keep watching the systems, what resources they have, and the specific safety strategies they use. A recurring theme in the experts' stories was a tension between how fast new technology arrives and how slowly organizations build the capacity to manage it safely. Often, hospitals bring in the technology first and only think about security and rules after the system is already running. One expert noted that this approach is backwards, comparing it to trying to build a foundation after the house is already built. When security is an afterthought, it creates avoidable weaknesses that could put patient data at risk.

Readiness was described as more than just having the right computers. It involves having a clear plan from the leaders, a way to manage data that is not scattered across many different departments, and a culture where staff understand why these rules matter. If the leadership does not see cybersecurity as a core part of operations, artificial intelligence becomes just another short-term project rather than something that needs long-term care. Similarly, if the staff does not understand why the new tools are important, they may not follow the safety processes, no matter how good those processes are.

Training emerged as a critical bridge between technical rules and daily work. The experts emphasized that safety cannot be taught in a single session. Because technology and threats are always changing, staff need to be retrained regularly. The most effective training was described as ongoing and adaptable, often happening through informal conversations or short workshops rather than just long lectures. Security experts often have to translate complex technical ideas into simple terms that doctors and nurses can use in their busy schedules. If the guidance is too complicated, staff will tune it out, and the system becomes unsafe.

Once the systems are running, continuous monitoring is essential. Security is not something you set up and forget. The experts described a routine of regular checks, testing, and reviewing what happens when things go wrong. This process allows organizations to learn from mistakes and fix problems before they affect patient care. It also requires clear rules about who gets notified when something breaks and how quickly they must respond. This kind of oversight works best when security teams, IT staff, and clinical leaders work together, sharing the responsibility for keeping the system safe.

However, the ability to do all of this depends heavily on resources. The interviews highlighted a stark difference between large hospitals and smaller clinics. Big hospitals can afford dedicated security teams and advanced tools, while smaller clinics often rely on a single IT person who is already stretched thin. This gap means that the level of protection a patient receives can vary depending on where they go for care. Some organizations have to rely on outside vendors to manage their security, which can limit their control over their own systems. The experts noted that these financial and staffing differences create unequal levels of safety across the healthcare system.

To manage these risks, the experts described practical strategies that work in the real world. They suggested starting with strong data protection, such as encryption and strict access controls, before adding any artificial intelligence. They also stressed the importance of involving security teams from the very beginning of a project, not waiting until the system is live. Another key strategy is to design systems with the expectation that they will eventually fail, planning ahead for downtime or breaches so that patient care is not disrupted. These approaches rely on collaboration across different departments, ensuring that everyone from the administration to the clinical staff has a role in maintaining safety.

The study suggests that safe artificial intelligence is not just a technical problem but an organizational one. It requires a coordinated effort where leadership, training, monitoring, and resources all work together. Without this coordination, the same safety rules can lead to very different results depending on the hospital's capacity. The researchers concluded that for artificial intelligence to be safe and fair, healthcare organizations must involve security experts early, build processes that can detect and respond to risks, and acknowledge that not all hospitals have the same resources. By focusing on these organizational conditions, healthcare systems can better protect patient information and ensure that new technologies improve care without introducing new dangers.