Across the healthcare sector, IT departments are quietly adopting a practice often called “vibe coding,” where software development gets a boost from artificial intelligence. While executive leadership might not always see the specifics, the shift is undeniable. The concept relies on AI tools generating applications based on user direction. It promises speed, but it brings specific security challenges that health IT managers must address before these tools become ubiquitous.
The Hidden Cost of Automated Speed
The margin for error is thin when AI writes code. These tools might seem intuitive, almost reading the user’s mind, but they require significant groundwork. Users must feed the AI detailed information about organizational network security, data privacy standards, and preferred databases. If this context is missing, the resulting software might behave inconsistently. That inconsistency poses a direct threat to data security and regulatory compliance. Furthermore, AI coding solutions typically rely on pre-existing open-source libraries. This inevitably lengthens the software bill of materials. While useful, this introduces new dependencies and technical debt that organizations must document for risk management purposes.
The Shadow IT Parallel
Programming is still a technical skill. Just because nontechnical users can generate applications using AI tools doesn’t mean these apps are ready for wider use. If a nurse or administrator uses AI to build a small app for a clinic, the result might be helpful, yet it is not ready for wider distribution without a technical programmer reviewing it first.
Related: Healthcare Innovation Requires Strong Data Foundation
This surge in accessible development tools mirrors earlier challenges of shadow IT, where employees brought unauthorized software into the workplace. Just as those unauthorized cloud storage accounts once bypassed corporate oversight, AI-generated apps created by non-experts can easily circumvent established security protocols without proper governance. The risk is less about the tool itself and more about the lack of oversight.
Legacy Friction and Modern Fixes
AI models are trained on modern code and existing standards. This training creates friction when the tools interact with legacy systems like old HL7 electronic health record databases. Organizations must adopt modern DevSecOps practices to utilize AI effectively. Going full continuous integration is not required, but rapid deployment strategies for fixes are necessary.
Guiding the AI Toward Safety
AI does not solve security problems on its own. It makes writing secure systems easier by encouraging best practices like keeping credentials out of configuration files or using encryption for network traffic. However, these tools lack awareness of healthcare-specific regulations. They won’t automatically know to use FHIR guidelines or integrate with a specific single sign-on system. A security-aware developer must provide these prompts. Applying a consistent set of security instructions for every coding session is a necessary step to reduce risk.