Ask a healthcare CIO in 2026 whether their organization is exploring agentic AI, and the answer will probably be yes. Ask how many have put an agent into a live clinical or operational workflow, however, and the number drops sharply.
Research from Microsoft and The Health Management Academy, published in the January 2026 issue of the New England Journal of Medicine AI, found that 43% of surveyed healthcare executives were piloting or testing agentic AI. Only 3% had deployed agents in live workflows.
That gap captures where healthcare IT stands today. It also defines the work embedded engineering teams must be ready to do next.
Agentic AI in healthcare has crossed from experimentation into execution, but progress is uneven. The most practical early opportunities are concentrated in high-volume administrative workflows: documentation support, coding, claims operations, prior authorization, scheduling, and contact-center work.
These processes have clear inputs, repeatable decisions, and measurable outcomes. They also impose a significant burden on clinicians, staff, and patients. That makes them better starting points than workflows in which an incorrect action could immediately affect clinical care.
The policy environment is moving in the same direction. The CMS Interoperability and Prior Authorization Final Rule requires affected payers to implement FHIR-based APIs for several kinds of data exchange, including prior authorization. Some operational provisions began in 2026, while most API requirements begin in 2027. As those foundations mature, teams will have better infrastructure for responsible automation across payer and provider workflows.
Clinical-facing and patient-facing use cases are also advancing. Scheduling, referral coordination, patient engagement, and voice-based assistance can all benefit from agents. Yet these applications need stronger controls because their errors can affect access, safety, and trust.
The organizations most likely to move from proof of concept to production share a consistent pattern. Their advantage is not simply the model or vendor they selected. It is the discipline surrounding deployment.
Safety must be designed in from the beginning. Teams need clear boundaries around the data an agent can access, the actions it may take, and the situations that require human approval. For workflows involving protected health information, HIPAA readiness also includes risk analysis, appropriate access controls, and ongoing review of system activity.
The HHS summary of the HIPAA Security Rule reinforces the need for role-appropriate access and regular review of records that track access to electronic protected health information. For an AI agent, those requirements should translate into least-privilege permissions, secure tool access, and a documented escalation path.
Agents create value when they work inside the systems that already carry the workflow. In healthcare, that usually means EHRs, practice-management platforms, payer systems, contact centers, and data exchanges.
Interoperability therefore becomes foundational. HL7 FHIR provides a standard for exchanging healthcare information electronically, but implementing it is only one part of the job. Teams still have to reconcile identity, terminology, consent, workflow state, and the quality of incoming data. An agent cannot reliably coordinate a process when the underlying data is incomplete or disconnected.
Every meaningful agent action should be traceable. A reviewer should be able to determine what the agent saw, which tools it used, what it decided, what it changed, and whether a person approved the action.
That means audit logging, versioned prompts and policies, role-based access, exception handling, and reproducible evaluations are product requirements—not optional extras. The NIST AI Risk Management Framework offers a useful structure: govern, map, measure, and manage risk throughout the system lifecycle.
A pilot should begin with a baseline and a decision rule. Teams can measure turnaround time, manual touches, error and exception rates, staff effort, denial rates, rework, and patient experience. They should also measure the cost of human review and integration, because automation that creates a larger exception queue has not reduced the real workload.
The evaluation window should fit the workflow rather than an arbitrary deadline. High-volume, rules-based processes can often demonstrate value quickly. Higher-risk workflows need longer observation, stronger evidence, and a staged expansion of autonomy.
For embedded engineering teams, this shift creates a specific skills agenda.
First, interoperability expertise becomes core engineering knowledge. Teams need to understand FHIR resources and APIs, but also the older interfaces, data contracts, and operational workarounds that remain common in healthcare.
Second, governance engineering becomes part of day-to-day delivery. Engineers must build approval gates, audit trails, policy enforcement, fallbacks, and kill switches into the workflow itself. They also need evaluation suites that test safety boundaries and business outcomes—not only whether a model produced a plausible answer.
Third, teams need stronger operational fluency. The best agent design begins with an accurate map of how work actually moves through the organization. That includes queues, handoffs, exceptions, compliance reviews, and the informal knowledge staff use to resolve edge cases.
Finally, embedded teams need to treat human oversight as an architectural component. People should not be added at the end as a vague promise that someone will review the output. Their authority, response time, escalation criteria, and feedback loop should be explicit.
Healthcare organizations are not pursuing agentic AI only because the technology is new. They are responding to persistent capacity pressure. The 2026 NSI National Health Care Retention & RN Staffing Report puts average hospital turnover at 18.5% for 2025 and staff RN turnover at 17.6%.
At the same time, patient demand and administrative complexity continue to strain already busy teams. Responsible automation can absorb repetitive coordination work and help staff focus on decisions that need human expertise. It should expand human capacity, not conceal an unsafe reduction in oversight.
The question for healthcare leaders is no longer simply whether to adopt AI agents. It is which agents they can trust with which workflows, under what controls, and with what evidence.
Embedded engineering teams that can answer those questions in architectural terms will be central to the next phase of healthcare automation. They will connect agents to real systems, define safe operating boundaries, prove value with measurable outcomes, and make every important action reviewable.
That is how agentic AI moves from an impressive pilot to infrastructure a healthcare organization can defend—to its clinicians, its patients, its leadership, and its auditors.
For a related look at how teams can preserve engineering discipline as AI accelerates delivery, read Tech Debt at Machine Speed: Managing the Hidden Cost of AI-Generated Code.
Healimpilo is a technology advisory firm working with companies across healthcare, fintech, life sciences, and SaaS on engineering strategy, talent, and delivery.
