HealthDataCon Panel Puts Infrastructure at the Center of Healthcare Innovation

Healthcare technology leaders at HealthDataCon 2026 identified late security reviews, unknown data flows and unreliable networks as warning signs that innovation projects are moving faster than hospitals can support them. During an Oct. 15 panel, they argued that readiness for artificial intelligence and automation depends on decisions about ownership, capacity and clinical workflow made before a product reaches the organization.

The session, “Foundation Before Innovation: Building the Infrastructure Healthcare Transformation Requires,” brought together Sepi Browning, founder of Brighthour Foundation and senior director at HIMSS; Kenan Atkins, manager of cybersecurity operations and physical security at ECU Health; and Murtada Sidahmed, a network engineering and security professional. Browning moderated a discussion that connected infrastructure investment to patient care, workforce demands and financial performance.

“If nobody owns the data, nobody owns the risk,” Atkins said. The panel offered practical experience and a framework for assessing readiness, rather than comparative research establishing that a particular technology or investment model produces better clinical outcomes.

Readiness begins with ownership and visibility

Atkins described three areas leaders should examine: infrastructure, data and workforce. Networks need capacity, resilience and redundancy, supported by an accurate inventory of connected assets. Data must be reliable, standardized and governed, while clinicians and frontline staff need involvement early enough to shape implementation. Deploying a tool does not establish that the organization can sustain its use.

“Without a clear decision authority, a readiness assessment becomes a checkbox instead of a real gate,” Atkins said. His concern was operational: an assessment has limited force if nobody can require corrective work before deployment. Browning similarly described foundational capabilities as “part of the strategy, not only when it becomes a problem.”

The Department of Health and Human Services’ voluntary cybersecurity goals provide a concrete reference for several of those capabilities. They include asset inventories, supplier risk assessment, incident preparedness and network segmentation. An inventory identifies what requires protection; an accountable owner determines who must respond when the assessment uncovers a gap.

Sidahmed added that readiness extends to the vendor. A promising pilot still requires scrutiny of reliability, security, data quality, clinical oversight and ongoing support. Browning emphasized matching a partner’s capabilities to the institution’s needs, including understanding how embedded AI features use data beyond the hospital’s own systems.

Infrastructure competes for money until care depends on it

Sidahmed described the difficulty of securing investment for infrastructure that executives expect simply to work. Adding connected devices can require greater network capacity, new equipment and configuration changes. Maintenance and replacement costs remain part of the service even when the most visible budget request concerns a new application.

Infusion pumps illustrated the dependency. Atkins asked whether the network could support the devices and their updates, and whether medical equipment was appropriately separated from guest traffic. Sidahmed stressed that segmentation requires a broader security design than merely assigning devices to different virtual networks. HHS identifies segmentation as a way to limit an attacker’s movement after an initial compromise.

The regulatory distinction matters. HHS’s proposed changes to the HIPAA Security Rule include explicit segmentation requirements, technology asset inventories and network maps. The agency states that the current Security Rule remains in effect during rulemaking. Implementation deadlines should therefore be checked against final requirements rather than inferred from a proposed standard.

Recurring outages also consume the people assigned to innovation projects. When an operational failure occurs, “you leave everything and you focus on that,” Sidahmed said. In his account, reliability affects the organization’s ability to deliver its strategic agenda because the same specialists supporting new capabilities must restore essential services when they fail.

Measure the effect on care and work

Atkins acknowledged the temptation to report uptime and support-ticket counts because those measures are familiar to technical teams. He proposed connecting them to fewer disruptions in care, faster access to clinical systems and fewer delays caused by slow applications or outages. From a security perspective, he highlighted the time required to detect an incident; financially, he pointed to the staff capacity consumed by repeated downtime.

Sidahmed cautioned that a high network-availability percentage alone does not prove a better outcome. Leaders should trace an investment through the technical change it enables, the resulting workflow change, and its relationship to care, cost and risk. The panel did not provide outcome data demonstrating those links, making them proposed measures for evaluation rather than established benefits.

For Browning, that measurement problem is also a communication problem. Technical metrics can matter to a chief nursing officer or hospital executive, but their significance must be explained in terms of the work each audience oversees. She called for “communicating the right information at the right time to the right people,” with language that makes the operational consequences understandable.

Sidahmed urged technical teams to explain upcoming changes before staff encounter them in practice. “This is how this investment is going to impact you,” he said, describing the message users need. Changes to wireless access or device configuration can alter daily work even when the underlying project appears to be entirely technical.

Bring security into the purchasing decision

Atkins identified a particularly costly warning sign: security and governance teams entering the process after a vendor has effectively been selected. A late risk review may uncover conditions that require renegotiation, additional controls or a decision against connecting the product. Unclear data flows and an incomplete rollout plan were further signals that essential preparation had been missed.

The cloud discussion exposed a related concern about visibility and control. Atkins compared entrusting sensitive information to an outside provider with entrusting children to a caregiver: transferring responsibility does not remove the consequences of harm. That analogy expressed his concern about oversight; it did not establish that keeping systems on premises is inherently safer.

HHS’s cloud guidance permits covered entities and business associates to use cloud services for electronic protected health information when applicable HIPAA requirements are met, including appropriate business associate agreements. It also calls for understanding the service sufficiently to conduct risk analysis. The relevant assessment therefore includes the specific architecture, safeguards, responsibilities and data uses.

Data integrity belongs in the same conversation. “Validate the data and more importantly, validate the source of the data,” Atkins said. The National Institute of Standards and Technology’s voluntary AI framework likewise addresses trustworthiness throughout design, development, use and evaluation. Installing an AI capability leaves the organization with continuing questions about its inputs and performance.

A roadmap needs authority and recurring review

Atkins described roadmapping as a matter of governance and discipline. An accountable owner needs authority to hold an initiative until fundamental dependencies are addressed, particularly when a newer project competes for attention. His warning was that, without that authority, a roadmap becomes “just a document.”

Sidahmed described starting with a system inventory, identifying equipment that will need replacement and incorporating those needs into upcoming budgets. Workforce capacity and the sequence of work also constrain delivery. He said he reviews progress with leadership every three to four months. NIST’s organizational profiles offer a related method for describing current and target cybersecurity outcomes and identifying gaps.

“These are not once a year conversations,” Browning said. Clinical participation can also reveal requirements technical teams would otherwise miss. Atkins described engaging clinical staff in physical-security initiatives and receiving ideas that changed how his team approached improvements, making communication part of the design process.

The panel’s practical test of readiness was whether an organization can identify its dependencies, assign responsibility and explain the expected effect on care and work. Evidence of improvement would require following those commitments through implementation: whether disruptions decline, staff can use the systems effectively and the intended benefits are measured. A purchase decision begins that evaluation; sustaining the service makes it meaningful.