I just got back from HL7 FHIR DevDays, a developer conference focused on Fast Healthcare Interoperable Resources (FHIR). I was there to talk about AI transparency in health data and using multi-agent AI to suggest useful care plans for patients. I have been part of the HL7 community for 6 years, working to make sharing health data a reality. But I have been a software architect for a lot longer, almost 30 years in the industry. I have never been as excited about the possibility for computers to work with us to solve real problems than I am now, but there are going to be real challenges. That is why I am thrilled to have joined Red Hat, a company that enables enterprise innovation at scale.
Image of Lego® version of Red Hat computer desk and HL7.org / FHIR server rack with Lego figures working on both. The potentialWe hear about AI almost constantly. Every day there is a new model or a new company selling for millions of dollars. A lot of what we hear is hype, inflated promises of replacing all employees with bots. But under all that is a real revolution in how we work. We are seeing a fundamental shift in the kinds of problems computers can address. For a long time we have pushed computers to be more reliable and predictable. If the computer didn’t do what we expected, we called it a “bug” and sent it back to the developer with reprimands. This served us well for solving certain problems. For example, keeping track of bank account balances or tracking marketing trends. We have gotten very good at manipulating massive data sets and providing near instant calculations, solving problems like, "where is the closest car that can take me downtown?" or "how do I watch my favorite movie from the 80s?" (It’s “The Princess Bride,” if you want to know.)However, there has always been a limit to the sorts of problems computers could solve. To use a computer to solve a problem you needed to be able to describe all the possible permutations of solutions ahead of time. You need to know that negative numbers subtract from the bank balance and when the balance goes below zero the account is frozen and the person needs to pay a fee before it is unfrozen. You needed to have these kinds of hard and fast business rules. There are many problems that don’t fit, especially in healthcare. For example, you can’t say that any diagnosis, with the possible exception of death, is final. Nor can you say that any particular treatment is always the best. “Best” depends on the patient and their circumstances. I would argue that AI has brought us closer to solving these kinds of problems. For the first time, by embracing a little randomness, computers can start making reasonable guesses. I can ask a generative AI system what the best course of action is and it will give me a reasonable, if not always correct, answer. It will do a better job if I ground it in facts and other relevant information. I can build systems that can, most of the time, generate reasonable responses to novel situations. This opens the door to addressing all kinds of problems:Operating room utilization: Helping hospitals so procedures happen on time and ORs aren’t sitting vacant, costing $100 a minute. Patient discharge: Once a patient is ready to go home, figuring out how we can get them there faster, freeing hospital beds and improving outcomes for patients.Personalized care plans: Providing clinicians with the tools and insights to provide the highest standard of care in challenging circumstances. And many others… The challengeAs excited I am about the potential of AI, I am very much aware that it comes with challenges. I firmly believe that its ability to “hallucinate” is actually AI’s superpower, but it means we have to approach its use more like we would another employee than a computer program. By hallucinate, I mean that the results from AI are sometimes inconsistent with its inputs. This allows AI to respond in novel ways to new situations. However, it also means that there is always a chance that it will do the wrong thing and, further, that it will do it with confidence. I would argue that this is not unlike most of the systems we deal with day in and day out. Many things in nature, not the least of them other humans, are unpredictable and will often do unexpected things with confidence. We have had thousands of years to learn how to deal with this. We have only had a few decades to complain about computers. Regardless, there are some things we need to think about differently when introducing AI into our solutions. Luckily, Red Hat is here to help. As a leader in providing enterprise-grade solutions, Red Hat is constantly looking at how to provide the controls needed to implement AI responsibly. AI and securityA wise professor of mine once said, “You can never go wrong answering any question in healthcare IT with security.” While healthcare is not the only industry where security matters, the combination of sensitive personal information and life-threatening situations mean that security always has to be front and center. The challenge is that AI is introducing new attack vectors every day. Today, bad actors are using AI to uncover and exploit vulnerabilities in traditional software. Just look at the explosion in the number of Common Vulnerabilities and Exposures (CVEs) reported to see this happening live. Red Hat, along with IBM, is responding with Lightwell, a $5 billion investment aimed at creating a dedicated hub for identifying and remediating software vulnerabilities. This is just the latest sign of Red Hat’s commitment to providing security at the level enterprises need. At the same time, the introduction of AI agents is introducing new security concerns. Having agents operating autonomously within a healthcare organization is the only way to achieve the promise of AI, but it brings with it new concerns such as how do we make sure the agent has the access it needs to do things, but not access to do things it should not. Projects like OpenShell, on which Red Hat is collaborating with NVIDIA, and MCP Gateway, from Red Hat, are looking to solve just this problem. They work together so an agent acts on behalf of the right identity and has the right permissions. AI and observabilityThere is a lot of talk about explainability in AI, the desire to be able to trace why an AI came to the result that it did. While it may be comforting to think that we can understand its reasoning, the reality is that we don’t really understand how any reasoning works. Sure, we can “explain” our own thinking, but we have no way of proving we aren’t just "hallucinating" an explanation after the fact. That said, it is critical to be able to communicate about what is planned to be done, where we are in that plan, and what actually happened. This is where observability comes in.Observability is why I am working with other volunteers at HL7 to write the AI Transparency on FHIR Implementation Guide. This provides guidance for how to tag health data that has been produced or manipulated by AI and document the model, context, and process involved. If fully implemented, it will provide organizations with the visibility they need to use the data when the risk profile of the use supports it and retrieve data in the future when problems are identified. Red Hat is working with Databricks on MLflow, which provides observability into what the agents are doing. It allows tracing and evaluation of results that provide insight into how models and agents are performing. This is critical to creating the improvement feedback loops necessary for these systems to evolve. This is the underpinning of establishing a true learning health system, which is what we have all been dreaming about for a long time. AI and sovereigntyAt FHIR DevDays there were a lot of interesting discussions about AI in healthcare. I saw demos of people using it to understand data better and make clinical insights more actionable. However, one thing I felt was absent from the conversation was the question of sovereignty. Sovereignty isn’t only about data. Yes, in healthcare protecting the privacy of patient data is paramount, and so control over where the data goes is important. The thing is that the systems that work on the data are just as important. A hospital’s emergency room can’t afford to go offline just because a major AI provider has a hiccup. While the reality is that today the most advanced and proprietary models, often called frontier models, are required for many tasks, smaller models are making significant advancements every day. Also, I believe we haven’t experimented enough with smaller models to see where we can get value from them. The fundamental principle of “divide and conquer” for problem solving is still true and my supposition is that if applied correctly it will enable smaller models to do great things. Regardless, healthcare organizations need sovereignty over their data and processes in the world of AI. They need this to run disconnected, in the event of an emergency or just because they are operating in place with limited connectivity. They also need this for security; they need to know what AI will run when and where without some outside organization being able to swap or throttle them unexpectedly. This last bit also highlights that they need not to be dictated to. The goal of healthcare always has to be delivering the best care possible. This is only possible if those organizations have independence that comes from sovereignty over their systems. Red Hat’s commitment to open source underpins its commitment to supporting sovereignty. An organization running Red Hat products is not beholden to Red Hat because those products are all open source and can be maintained by anyone. At the same time, the combination of Red Hat Enterprise Linux, Red Hat OpenShift, and Red Hat AI provide the platform for any company to own their AI future. Whether running in the cloud, on premise, or in a hybrid mode, Red Hat helps organizations use the resources best suited for the job. But more than this, it enables them to run those services disconnected if needed. The opportunity In the end, I joined Red Hat for 3 reasons:I believe that AI will fundamentally change how we work and live and that change can be for the better if done responsibly. I believe healthcare is the best place to realize this future. As they say, "necessity is the mother of invention,” and nowhere is there more necessity than healthcare. No other field has the proliferation of problems that traditional computing has failed to solve. I believe that open standards and open source are the best way to get to that future responsibly. Healthcare needs the sovereignty and collaboration they foster to drive to better outcomes for all. I would love to talk to you more about my vision for an agentic future in healthcare and how Red Hat plays a role in that. Reach out to me on LinkedIn and check out my YouTube channel.
