The rise of AI-assisted coding is changing how IT teams build software, including in healthcare. These tools offer speed and efficiency but also introduce security risks that health IT managers must address.
AI’s margin of error in healthcare code
AI coding tools generate applications from user prompts, but their output relies on the quality of the input. Developers must provide detailed context, including network security protocols, data privacy standards, compliance requirements, preferred platforms, testing strategies, and documentation guidelines. Without this preparation, the AI may produce code that fails to meet necessary standards.
In healthcare, regulatory compliance is critical. Even minor errors can lead to significant issues, such as exposing patient data or violating HIPAA. A misconfigured app could turn a time-saving tool into a liability.
Nontechnical users and the shadow IT problem
AI lowers the barrier to coding, enabling nontechnical staff—like nurses or administrators—to create small applications. While this can improve efficiency at the clinic level, it also creates risks similar to shadow IT. An app built by a well-intentioned employee might work for one use case but fail when scaled.
Technical oversight remains essential. Before deploying any AI-generated app, a developer should review it for security flaws, scalability, and compliance. The same rules that applied to rogue Excel macros or unsanctioned cloud apps now extend to AI-built software.
Hospitals have spent years addressing problems caused by unvetted tools. AI risks repeating those mistakes on a larger scale.
Expanding the attack surface
AI coding tools use open-source libraries and frameworks, meaning every AI-generated app introduces new dependencies. A single project might include dozens of packages, each with potential vulnerabilities. The software bill of materials for even a simple app can grow quickly, creating technical debt and new attack vectors.
Documenting these dependencies is necessary. Regulatory frameworks like HIPAA and the FDA’s cybersecurity guidelines require transparency about third-party components. Skipping this step leaves organizations vulnerable to supply-chain attacks, where a single compromised library can disrupt an entire system.
Healthcare providers must ensure proper documentation to avoid these risks. Security tools alone are not enough to protect against evolving threats.
Legacy systems and the AI mismatch
AI coding tools are trained on modern codebases and development practices. This creates challenges for healthcare, where legacy systems—such as older HL7-based electronic health records—remain common. An AI might generate code that doesn’t integrate with a 20-year-old database.
Organizations must modernize their development environments to make AI work effectively. This doesn’t require abandoning legacy systems immediately, but it does mean adopting DevSecOps practices. Continuous integration and deployment pipelines help patch security flaws quickly, whether in AI-generated code or traditional software.
Security improvements—or false confidence?
AI coding tools can promote better security practices. They suggest encryption for network traffic, warn against hardcoding credentials, and flag potential vulnerabilities. However, these are general best practices, not healthcare-specific safeguards. An AI won’t automatically account for a hospital’s single sign-on system unless a developer provides explicit instructions.
Human developers must guide the AI. This means writing clear security instructions for every session, such as mandating HL7 FHIR compliance or integrating with existing identity management systems. Without these guardrails, AI can create a false sense of security, where teams assume “secure by default” is sufficient.
Medicare’s planned doctor pay cuts in 2027 add financial pressure to healthcare systems, making efficient IT solutions even more important.
For now, AI-assisted coding remains a tool, not a replacement. Teams that use it carefully will benefit. Those that don’t may face years of correcting mistakes.