Issue 27 | Daniel C. Pettus | 22 October 2026
Part of a day at the HIMSS AI in Healthcare Forum in San Diego. Everyone agreed on the problem. Nobody is holding the ladder. We built one for the electronic record twenty years ago and it worked. AI needs its own, and most of the parts already exist.
I spent part of Thursday at the HIMSS AI in Healthcare Forum at the Omni in San Diego [1]. Part, not all. I had to leave early and I cannot be there for day two, so what follows is one person’s read of a morning and an afternoon of talks and a lot of hallway conversation, not a report on the whole event. The opening keynote came with a request for no photos and no recordings, and some of the speakers after it felt the same way. I honored that, so the pictures in this issue are of a stage and a panel slide, and the keynote is described, not shown. I came home with three things I expected and one I did not.
The problem everyone agreed on
Supply and demand. The world is getting older and the people who take care of it are not multiplying. The AAMC projects a shortage of 13,500 to 86,000 physicians in the United States by 2036, with the number of Americans 65 and older growing 34 percent in the same window [2]. The World Health Organization puts the global shortfall at 11.1 million health workers by 2030 [3]. Add the cost constraints every health system is living under and you have the subject of nearly every talk I heard: use AI to take time out of a process so the people we have can see more patients.
Nobody disputed it. I did not either. I spent forty years watching clinicians work around systems that were supposed to save them time, so I am sympathetic to anyone who finally wants to measure that.
The 3 AM argument
The panel that drew the most attention was titled “Human in the Loop: Myth or the Essential Path Forward” [4]. Several speakers across the day were all in on autonomous AI, and their argument was not ideology. It was arithmetic. A patient with a problem at 3 AM, facing eight hours in an emergency department waiting room, is not helped by a policy that says a human must review everything. For a large share of the interactions between a patient and a health system, these people believe there is a place for AI with no human in the loop. In the same breath they said a human must be reachable when it matters. I think both are right. Which brings us back to supply and demand.
My own view is that “human in the loop” has become a reassurance rather than a design. Julia Zarb made the point at HIMSS26 in March: the question is not whether a human is present, it is whether the workflow is built so the human can realistically do the job they have been handed [5]. A clinician clicking accept on forty AI drafts an hour is in the loop the way a speed bump is in traffic enforcement. The honest version of autonomous AI is bounded. Say which tasks. Say what the machine may finish alone. Say what it must hand off, and to whom. Then measure it. That is a stage question, and I will come back to it.
What I did not expect
The lack of coordination. I listened to the speakers, each sharing their own experience with their own pilot, their own governance committee, their own checklist. Good intentions, all of them. All over the map, all of them. Nobody on that stage was wrong, and that is the problem. Thirty right answers that do not add up to one.
Back at the hotel I looked at the policy picture, and it has the same shape as the room.
The states are writing it themselves. Becker’s counted thirteen state healthcare AI laws on 9 October, six of them signed since April, three of those in Rhode Island alone [6].
Washington is arguing about who gets to write it. The Senate stripped a ten year moratorium on state AI laws by a vote of 99 to 1 in July 2025 [7]. In December the President signed an executive order sending the Justice Department after state AI laws, and a House preemption draft has been stalled since June [8].
The one federal rung is being pulled. HTI-1 required a model card, 31 source attributes, for every predictive decision support tool inside a certified EHR, effective January 2025. HTI-5 proposes to delete it, on the grounds that nobody has shown the disclosure improved care [9]. As this issue went to draft the final rule was at the Office of Management and Budget [10].
The accreditor is asking nicely. The Joint Commission and the Coalition for Health AI published guidance in September 2025. It is voluntary, and a voluntary certification is promised for the 22,000 organizations the Joint Commission accredits [11].
The ladder does not exist. HIMSS runs six maturity models. None of them is for AI. The analytics model mentions AI once, at Stage 6 [12][13].
So the organization that built the adoption ladder for the electronic record has not built one for AI, the federal government is removing the one rung it had, and thirteen states are each nailing up their own. That is what “all over the map” looks like on paper.
I have seen this movie
Paper to electronic. I lived through it from the device side, and it did not happen because the industry woke up one morning and decided to change. Healthcare is painfully slow to change on its own. It happened because three forcing functions arrived, and it took all three.
The standard. HIPAA in 1996 wrote the electronic transaction formats. For years I told people HIPAA forced claims electronic. Close, but not right. The Administrative Simplification Compliance Act of 2001 did that: from 16 October 2003, an initial Medicare claim had to arrive electronically, with exceptions for practices under ten people [14]. Submit on paper and you waited for your money, which is a forcing function everyone understands.
The lever. HITECH in 2009. By May 2016 the Meaningful Use programs had paid $34.7 billion to more than 500,000 providers [15]. Stage 1 began in 2011, Stage 2 in 2014, and Medicare penalties started in 2015 at 1 percent, then 2, then 3 [16][17]. Hospitals with a basic electronic record went from 9 percent in 2008 to 99 percent with a certified one in 2024. Office-based physicians went from 17 percent to 91 [18].
The ladder. EMRAM, from HIMSS Analytics in 2005. Eight stages, 0 to 7, with a site visit before anyone gets to say Stage 7. By the end of 2015 about 4.2 percent of 5,400 US hospitals had earned it [19]. And the ladder came before the money. CCHIT was certifying electronic record products from 2006, three years before HITECH, so when the incentive arrived there was already something to attach it to [20]. I have been on the inside of that ladder. On the second day of HIMSS17 in Orlando, in February 2017, I co-presented the EMRAM medication management criteria update with John Daniels of HIMSS Analytics. Our slides proposed CPOE-enabled infusion pumps as a Stage 7 requirement, and the 2018 criteria added bidirectional smart pump interfaces to Stage 7 [21]. Adding one line to one stage took the better part of a year and a notice period to the market. It was worth it.
Meaningful Use had critics then and has them now. It paid for a lot of bad software. It put clinicians in front of screens instead of patients. It made a few companies very rich. All true. It also did the thing it was aimed at, in under a decade, in an industry that does not do anything in under a decade. I would take that trade again.
Kaiser already wrote the principles
The opening keynote was Daniel Yang, Kaiser Permanente’s vice president of AI and emerging technologies. One slide stuck with me. Kaiser has seven principles it uses to decide which AI projects get resources and how they are judged afterward, and they spell PROTECT: privacy-protecting, reliable, outcome-driven, transparent, equitable, customer-focused, trustworthy. Yang published them in March 2025, and Healthcare IT News reported the acronym from the keynote the same afternoon [25][26]. They are good. If every health system in the room had seven principles that clear, the map would be a lot less crowded.
But notice what the principles are. They are what one organization requires of itself. Nobody outside Kaiser checks them, nobody outside Kaiser is measured against them, and a hospital in Rhode Island cannot borrow Kaiser’s credibility by printing the same seven words. That is the difference between a principle and a stage. Meaningful Use did not ask hospitals to be thoughtful about electronic records. It asked whether more than 30 percent of your patients on a medication had at least one order entered through CPOE, and someone could check [28]. Kaiser’s seven are the right values. The ladder is where an independent body turns values into a number that travels, and I have borrowed from PROTECT freely in what follows. Credit where it is due.
The AI Adoption Model, Stages 0 to 7
So let me propose the ladder. I am not proposing a law. Legislation is not my trade, and the current administration is taking rules out, not putting them in. I am proposing the thing that has to exist before a payment rule or a certification can attach to it, the way certified EHR technology existed before HITECH. Eight stages, 0 to 7, because that is the shape this industry already knows how to validate. Each stage is one yes or no question an auditor can answer on a site visit, and I have drawn it in the EMRAM layout on purpose. HIMSS Analytics, consider it a first draft.
Two things to notice. First, autonomy is not a Stage 0 decision or a Stage 7 decision. It enters at Stage 5, for administrative work, where the supply and demand relief actually lives, and it reaches clinical work only at Stage 7, after the organization has shown it can watch its own tools and has published what happened to its patients. The 3 AM argument and the human in the loop argument are both on the ladder. They are just on different rungs.
Second, no stage asks which vendor you bought. The ladder measures the organization, not the product. EMRAM did the same thing, and it is why EMRAM has outlived every product cycle since 2005.
Who holds the ladder
Three roles, and all three are already cast. HIMSS Analytics validates maturity for a living; this would be a seventh model next to the six it has. The Joint Commission has told the organizations it accredits that a voluntary AI certification is coming; certify to the stage. And CMS pays. Promoting Interoperability is still 25 percent of a MIPS score in 2026, with up to 9 percent of Medicare Part B on the line [22]. Nothing in it asks about AI. But look one category over: for 2026, CMS added a single AI improvement activity, IA_PSPA_34, which asks practices to record AI-attributable harm and near misses in their patient safety system [23]. That is Stage 4 of the ladder, written by CMS, in a rule that already exists. A line that says “attest to your AIAM stage” is a rulemaking cycle away. It is not an act of Congress.
Two objections I heard in my own head on the drive home. First: without a law, who says you met the criteria? Healthcare answered that one in 1965. The Joint Commission is a private body, and its survey counts for Medicare because CMS grants it deemed status under section 1865 of the Social Security Act: accredit with an approved organization and CMS considers you to have met its conditions [27]. The verification machinery is sixty years old, private, and already paid for by the organizations it surveys. It needs a new checklist, not a new agency.
Second: should the AI companies chip into an incentive fund to get it started? No. A ladder paid for by the people being graded is how rating agencies ended up grading mortgage bonds in 2008. The organizations climbing the ladder pay for their own survey, the way they pay the Joint Commission and HIMSS Analytics today, and the vendors stay on the other side of the table where they belong. If the incentive money comes, it comes from CMS, the way it did last time.
I know the money is not coming this year. Build the ladder anyway. CCHIT was voluntary for three years before the money showed up. The money shows up when the harm shows up, and at the pace this room is deploying, it will. The FDA authorized 331 AI-enabled devices in 2025, the most in its history [24], and that count does not include a single ambient scribe or inbox assistant, because those are not devices.
Ai MedAgent, and a lesson
I talked to several people about Ai MedAgent. Almost nobody got it. Not because it is hard to understand. Because every person in that building was measuring everything against one problem, staff, and a system that reasons across the whole record and catches the drug interaction before the pharmacist does was interesting for about a sentence. Then I tried a different sentence: it lets you run more clinical therapy with the staff you have. Different conversation. Same software.
The lesson is old and I should not have needed it again. Lead with the problem the person is in, not the one you are in. I built it for the patient and I will keep building it for the patient. I will just describe it as what it also is: the Stage 6 rung, the one where the machine reasons across the record and a named human, with the time and the standing to act, closes the loop.
It was about the data
The room was right about the problem. It was right about the 3 AM patient. And it was spread across the map on how to get there without hurting anyone. Twenty years ago the room looked the same, and three forcing functions got it moving: the standard, the lever, and the ladder. The ladder is the one piece nobody at the forum owns, and the one piece that needs no vote.
HIMSS, if you are reading: you have six models. Build the seventh. I will draft Stage 0 for free. I already did.
It was about the data then. It is about the reasoning now. And it is still about the data.
About me
Daniel Pettus spent forty years in medical device and health IT leadership at Alaris, CareFusion and BD, was a founding member of the iMetrikus team, and contributed to IHE Patient Care Device interoperability standards. He is co-inventor on US patent 7,375,647 and has filed five provisional applications on the reasoning method behind Ai MedAgent™. He writes Inside the Loop from Murrieta, California.
The serious version of the day job is a book. The Technology Was Never the Problem: forty years of trying to connect medical devices to the record, and what finally changed. pettusbook.com.
Ai MedAgent™ is a research demonstration of a patent-pending method. Advisory only. Not a medical device. Not FDA cleared. Synthetic patients and simulated feeds. See it at aimedagent.net. Ami is an unreleased experiment and is not available to download.
Notes
[1] HIMSS. AI in Healthcare Forum San Diego, 22 to 23 October 2026, Omni San Diego Hotel at the Ballpark. https://www.himss.org/events-overview/ai-in-healthcare-forum-san-diego/
[2] AAMC. New AAMC report shows continuing projected physician shortage. Press release, 21 March 2024: a shortage of up to 86,000 physicians by 2036, with the population aged 65 and older growing 34.1 percent. https://www.aamc.org/news/press-releases/new-aamc-report-shows-continuing-projected-physician-shortage. The low end of the range, 13,500, is from the report summary in Chief Healthcare Executive, 22 March 2024, https://chiefhealthcareexecutive.com/view/physician-shortage-could-reach-86-000-aamc-projects
[3] World Health Organization. Health workforce: projected shortfall of 11.1 million health workers by 2030. https://www.who.int/teams/health-workforce/about/30
[4] Panel, Human in the Loop: Myth or the Essential Path Forward. HIMSS AI in Healthcare Forum, San Diego, 22 October 2026. Panelists as shown on the session slide: Amy Sitapati (UC San Diego), Fahad Razak (St. Michael’s Hospital, Ontario Health), Evan Collins (Houston Methodist), Anne Snowdon (HIMSS). The summary of positions is from my own notes across the day; no recording was made and no speaker is quoted.
[5] Jessica Hagen. Rethinking the human in the loop as AI scales across healthcare. MobiHealthNews, March 2026. Interview with Julia Zarb ahead of her HIMSS26 session. https://www.mobihealthnews.com/news/rethinking-human-loop-ai-scales-across-healthcare
[6] Naomi Diaz. 13 state healthcare AI laws to know. Becker’s Hospital Review, 9 October 2026. https://www.beckershospitalreview.com/healthcare-information-technology/ai/13-state-healthcare-ai-laws-to-know/
[7] Nextgov/FCW. Senate overwhelmingly passes amendment removing state AI moratorium. July 2025. The vote was 99 to 1. https://www.nextgov.com/artificial-intelligence/2025/07/senate-overwhelmingly-passes-amendment-removing-state-ai-moratorium/406448/
[8] CASRAI. Federal AI preemption fight: where it stands. 20 September 2026. Executive Order 14365, 11 December 2025, directed a Justice Department litigation task force against state AI laws; the House preemption draft of 4 June 2026 had not been introduced as a bill. https://casrai.org/news/federal-ai-moratorium-state-preemption-fight-2026
[9] ASTP/ONC. Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity (HTI-5), proposed rule. Federal Register, 29 December 2025. https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity. For the 31 source attributes HTI-1 required at 45 CFR 170.315(b)(11) and what HTI-5 would remove: Pacific AI, HTI-5 removes 34 of 60 certification criteria, https://pacific.ai/hti-5-removes-certification-criteria/
[10] Ruth Reader. Scoop: interoperability final rule drops info blocking fixes. Second Opinion, 10 September 2026. Reports the HTI-5 final rule at OMB and ONC’s Thomas Keane saying finalization would come within weeks. https://www.secondopinion.media/scoop-interoperability-final-rule-drops-info-blocking-fixes/
[11] Coalition for Health AI. Joint Commission and Coalition for Health AI (CHAI) release initial guidance to support responsible AI adoption across U.S. health systems. 17 September 2025. https://www.chai.org/news/joint-commission-and-coalition-for-health-ai-chai-release-initial-guidance
[12] HIMSS. Digital maturity models: EMRAM, AMAM, INFRAM, C-COMM, DIAM and CCMM. https://www.himss.org/maturity-models/
[13] HIMSS. Analytics Maturity Assessment Model (AMAM). Stage 6, Real-time data and responsible analytics, is the only stage that names AI. https://www.himss.org/maturity-models/amam/
[14] First Coast Service Options (Medicare administrative contractor). Discover the basics of the Administrative Simplification Compliance Act (ASCA). Mandatory electronic submission of Medicare claims from 16 October 2003; small-provider exceptions at fewer than 10 full-time employees for Part B. https://medicare.fcso.com/edi/discover-basics-administrative-simplification-compliance-act-asca
[15] Rajiv Leventhal. Report: Meaningful Use payments total $34.7 billion. Healthcare Innovation, 27 June 2016. $34,698,047,312 through May 2016 to more than 500,000 unique providers. https://hcinnovationgroup.com/policy-value-based-care/news/13027074/report-meaningful-use-payments-total-347-billion
[16] CMS. Medicare and Medicaid EHR Incentive Programs, Stage 2 final rule fact sheet. 23 August 2012. Stage 1 from 2011, Stage 2 from 2014, Medicare payment adjustments from 2015. https://www.cms.gov/newsroom/fact-sheets/cms-medicare-and-medicaid-ehr-incentive-programs-stage-2-final-rule
[17] Medical Economics. $44K incentives available for EHR usage; penalties in 2015. 27 February 2009. Medicare reductions of 1 percent in 2015, 2 percent in 2016 and 3 percent from 2017. https://www.medicaleconomics.com/view/44k-incentives-available-ehr-usage-penalties-2015
[18] ASTP/ONC. National trends in hospital and physician adoption of electronic health records. Hospitals 9 percent (basic EHR) in 2008 to 99 percent (certified EHR) in 2024; office-based physicians 17 percent to 91 percent. https://www.healthit.gov/data/quickstats/national-trends-hospital-and-physician-adoption-electronic-health-records
[19] Rajiv Leventhal. EMRAM 2.0: HIMSS Analytics raises the bar in its push for hospitals to reach Stage 7. Healthcare Innovation, 5 October 2016. EMRAM created 2005; eight stages, 0 to 7; about 4.2 percent of more than 5,400 US hospitals at Stage 7 in Q4 2015. https://www.hcinnovationgroup.com/cybersecurity/article/13026905/emram-20-himss-analytics-raises-the-bar-in-its-push-for-hospitals-to-reach-stage-7
[20] Alisa Ray, CCHIT. Testimony to the ONC Health IT Policy Committee certification hearing, 7 May 2014. CCHIT founded 2004, federally recognized 2006, more than 250 products certified in the following three years. https://www.healthit.gov/sites/default/files/facas/Certification_Hearing_AlisaRay_CCHIT_Testimony_2014-05-07_0.pdf
[21] John H. Daniels and Dan Pettus. EMRAM Criteria Update: Medication Management. HIMSS17, Orlando, February 2017, presented with HIMSS Analytics; author’s copy of the deck. The 2018 criteria, effective 1 January 2018, added non-scored Stage 7 criteria for smart pumps that interface bidirectionally with the EMR: Healthcare IT News, HIMSS Analytics announces new EMRAM criteria for 2018, https://www.healthcareitnews.com/news/himss-analytics-announces-new-emram-criteria-2018-focus-security-digital-imaging
[22] Renée Freyer. MIPS 2026 changes: TEFCA, AI and the penalty guide. HIT Consultant, 24 February 2026. Promoting Interoperability at 25 percent of the MIPS score; payment adjustment of up to plus or minus 9 percent of Part B. https://hitconsultant.net/2026/02/24/mips-2026-changes-tefca-ai-penalty-guide/
[23] CMS Quality Payment Program, 2026 improvement activity IA_PSPA_34, Patient Safety in Use of Artificial Intelligence (AI). Text via MDinteractive. https://mdinteractive.com/mips_ia/2026-mips-IA_PSPA_34-patient-safety-in-use%20of-artificial-intelligence-ai
[24] MedTech Dive. Tracking the FDA’s AI-enabled device authorizations. Updated 27 May 2026, from the FDA list current to 30 December 2025: 331 authorizations in 2025, more than 1,400 since 1995. https://www.medtechdive.com/news/ai-medtech-track-new-devices-fda/748397/
[25] Daniel Yang, MD. AI in health care: 7 principles of responsible use. Kaiser Permanente, 25 March 2025. Privacy, reliability, outcomes, transparency, equity, customers, trust. https://about.kaiserpermanente.org/news/ai-in-health-care-7-principles-of-responsible-use
[26] Healthcare IT News. Time to invest in the human stack to foster trust in health AI. 22 October 2026. Reports Yang’s keynote at the HIMSS AI in Healthcare Forum and the PROTECT acronym. https://www.healthcareitnews.com/news/time-invest-human-stack-foster-trust-health-ai
[27] CMS. Accrediting Organizations (AOs): deemed status under section 1865(a) of the Social Security Act; nine approved organizations including the Joint Commission and DNV. https://www.cms.gov/medicare/health-safety-standards/quality-safety-oversight-general-information/accrediting-organizations-aos
[28] CMS. Eligible hospital and CAH Meaningful Use core measures, Stage 1: CPOE for medication orders. Measure: more than 30 percent of all unique patients with at least one medication in their medication list have at least one medication order entered using CPOE. https://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/1_CPOE_for_Medication_OrdersEH.pdf