.png)
Six health system CEOs recently shared their approaches to healthcare AI metrics. Several argued AI should be judged by the outcomes systems already measure. The first question is whether leaders can see enough of their AI to trust those numbers.
Health systems are spending heavily on AI, and many still cannot show what it returns. In its 2026 survey of more than 60 health system technology leaders, including CIOs, Chief AI Officers and CMIOs, Qventus found that just 4% of health systems have scaled AI with measurable outcomes and that four in five IT leaders have trouble measuring AI’s return. Becker’s Hospital Review recently asked six health system CEOs which AI metrics deserve executive attention.
The healthcare AI metrics the CEOs named fall into two groups:
Much of the public conversation about AI value focuses on the first group. Having led hospital organizations, I give the second group equal time on the executive agenda, because governance is what allows a health system to measure AI’s impact, catch its errors and ultimately optimize it.
Ettore Palazzo, MD, CEO of EvergreenHealth, made a direct case for judging AI by the outcomes the organization already tracks. He told Becker’s that adoption is primarily an operational measure, not a measure of value, and that AI should be judged by the outcome measures his organization already applies to any change: quality and safety, patient experience, financial performance and employee engagement. With ambient documentation, the result that mattered was improved provider and patient satisfaction.
Bob Garrett, CEO of Hackensack Meridian Health, described a similar discipline. His system is building AI KPIs into its leadership incentive programs. He credits an AI agent that calls patients 48 to 72 hours after discharge with an 11% reduction in readmissions.
Chris Van Gorder, CEO of Scripps Health, organizes his list around three priorities: safety events and quality and access gains for patients, hours returned and administrative burden removed for caregivers, and validated financial benefit weighed against AI operating costs.
I agree with Palazzo that AI doesn’t need its own value scorecard. He also makes a point that is easy to skip: leaders must understand when a change was introduced before crediting it with a result.
For an AI tool, that means knowing when it went live, where it runs, who uses it and whether it behaved consistently across the measurement period. A readmission gain measured in the spring says little about the fall if the vendor changed the underlying model over the summer.
Cost has a similar gap. AI spending is spread across departmental budgets, enterprise licenses and AI features bundled into existing contracts, so operating cost is often understated before anyone calculates a return. That's where the governance KPIs come in. Five deserve a closer look.
Timothy Pehrson, CEO of Integris Health, said his leadership team reviews healthcare AI KPIs on a longer horizon than daily operations. His first question is whether the inventory is complete, including “AI embedded in existing products from vendors we never bought AI from.”
Inventories built from procurement records and department surveys tend to miss three kinds of AI:
None arrive through a contract review, and any of them can touch patient data. (We have broken down the different forms shadow AI takes in health systems.)
The Duke-Margolis Institute for Health Policy, in a March 2026 white paper on AI safety in health systems by Cameron Joyce, MPA, Nicoleta Economou, PhD, and Christina Silcox, PhD, notes that a central, searchable inventory of clinical AI in which every tool must be registered is essential. Registration reduces the risk that unknown tools enter clinical practice unnoticed.
What it takes to measure it. Completeness is a ratio, and the pace of AI adoption makes the denominator the hardest part to measure. A spreadsheet cannot count tools nobody has reported, so the denominator must come from observed activity: which AI applications are in use, by whom and where.
Across the health systems we work with, the discovered inventory routinely runs several times larger than the estimated one. Network-based AI discovery builds that denominator from logs the organization already generates, including AI that vendors add to approved tools. Once the denominator is accurate, leaders can identify two additional, critical metrics in the implementation workflow: how many discovered tools are still awaiting review, and how long review takes after discovery.
Pehrson’s second question is what share of the AI in use has a named owner, a documented purpose, a completed risk review and a monitoring plan. This turns a governance policy into a number a board can follow.
The Duke-Margolis paper observes that accountability at the level of individual tools is often missing in practice. It recommends that each tool have both a clinical or business owner and a technology owner, including tools supplied by vendors, so that ownership and accountability exist and can be reassigned when people change roles or leave.
What it takes to measure it. Three design choices give leaders the information they need to act:
Pehrson said AI issues reach his leadership team through Integris’ daily tiered escalation huddles, including reports that an ambient documentation tool is not working as it should or that an AI-related safety event or near miss has occurred. Van Gorder puts AI-related safety events first on his list.
The difficulty is that this count depends on detection. As I wrote last month, patient safety systems were built around human error, and AI fails differently. The Duke-Margolis paper notes that patients and families often act as early detectors of harm, but clinical AI is largely invisible to them. The reports that do get filed may never mention that AI was involved.
Consider an AI scribe that adds a similar-sounding but incorrect medication to a visit note. If the clinician signs the note without catching it, the error enters the record and no one files a report, because no one noticed. We’ve written about how AI hallucinations become part of the patient’s chart. In that environment, a low event count can mean the AI is safe, or it can mean the errors are not being identified.
The Joint Commission and the Coalition for Health AI guidance on the responsible use of AI treats AI-related safety events like other patient safety events and encourages organizations to capture them internally and report them on a voluntary, blinded basis.
What it takes to measure it. Treat this KPI as two streams. The first is reported events, made findable through an AI flag in the existing safety reporting system.
The second stream is detected signals: outputs flagged as inaccurate, drift alerts and policy violations caught as they happen. When real-time AI policy enforcement stops protected health information from reaching an unapproved tool, the organization records a near miss with a timestamp, a user, a tool and the specific policy attached. Every event in either stream should connect to a specific tool, version and workflow, which is only possible when the inventory is complete.
Then monitor the relationship between the two. The Duke-Margolis paper notes that near misses often occur more frequently than adverse events. When they do not, the gap usually reflects weak detection rather than strong safety.
None of the six CEOs named continuous validation as an AI KPI, but several described it. Palazzo’s team confirmed ambient documentation was functioning as designed. Pehrson’s huddles surface tools that are not working as they should. Van Gorder’s proposed index includes material inaccuracies and clinical overrides. Each asks whether an approved tool still performs the way it did the day it was approved.
As Georgy Kopanitsa reported in his July 2026 longitudinal study of clinical AI systems in routine use, acceptable validation results did not guarantee stable behavior after deployment. He concluded that validation should serve as a baseline for comparison rather than a lasting safety guarantee.
Performance shifts as patient populations, workflows and documentation practices change around a tool. The tool itself can change as well, because vendors may update the models behind approved tools, sometimes without detailed notice. The AI that was reviewed and validated in January may not be the same AI running in June.
What it takes to measure it. Start with a local baseline of how the tool performed against your own use cases and patient population before go-live. Re-test against that baseline on a schedule matched to risk, and continuously for high-risk clinical tools.
Define in advance the thresholds that trigger review, such as an accuracy drop beyond a set margin, a shift in override rates or a detected vendor model change. Name the person authorized to pause the tool. Read override rates with care. A rising rate can mean the tool is getting worse or that clinicians have stopped trusting it. A very low rate can signal automation bias rather than accuracy.
Continuous AI validation and monitoring keeps that baseline current and documents each test.
Pehrson said Integris’ AI governance council measures its progress against the NIST AI Risk Management Framework to keep the work aligned with national best practices. The framework organizes AI risk management into four functions: govern, map, measure and manage.
Framework alignment is easy to claim and harder to show. The KPIs above map to it directly:
Reporting progress with that evidence, rather than by self-assessment, gives a governance council something an auditor or accreditor can verify. That matters more now that Joint Commission has launched a voluntary Responsible Use of AI in Healthcare (RUAIH) certification, which counts monitoring, evaluating and validating AI safety performance among its five core areas. (Watch our webinar with Joint Commission on what to know about the RUAIH certification.)
Van Gorder proposed one of the most useful executive views in the article: a green, yellow and red AI Risk & Trust Index that combines clinical safety events, AI hallucinations or material inaccuracies, privacy and security events, patient complaints and significant clinical overrides. His goal is to know whether AI did anything the day before that should concern him.
Mark O’Bryant, CEO of Tallahassee Memorial HealthCare, noted in the same article that data has to be proven sound before AI can take on the work of running and correlating reports. The same holds for a trust index. Each input needs a defined source, thresholds for yellow and red, and an owner who acts when the color changes.
Two more design choices keep the index honest. Normalize counts by volume, such as events per thousand uses, or the index will turn yellow simply because adoption grew. Duke Health’s AI surveillance dashboards, as described in the Duke-Margolis paper, track normalized counts of issues and safety events by severity, by AI tool and by deployment location. Treat a long run of green with skepticism. If the index never moves, confirm adequate oversight and monitoring of the metric before concluding the AI is safe.
Several of the six CEOs argue that AI should be judged by what it does for patients, caregivers and the organization’s performance. Those outcomes rest on facts that must be regularly reviewed:
Visibility, control and continuous monitoring establish those facts. They are what let a team trust the outcome numbers on the scorecard.
Vitea discovers the AI in use across a health system, including AI that vendors add to tools you already own. It enforces AI policy at the prompt level in real time and continuously tests deployed AI against its baseline.
Give your board an AI scorecard backed by evidence. Schedule a conversation with our team.
About the author: Murali Naidu, MD, is Chief Medical Officer at Vitea, the AI governance platform built for healthcare that enforces AI policy in real time. He is a former hospital CEO, most recently of San Ramon Regional Medical Center, and previously served as Chief Clinical Officer at Sentara Healthcare.
Executive comments in this article were originally reported by Kelly Gooch in Becker’s Hospital Review, “What AI KPIs should CEOs track? 6 health system leaders weigh in” (Oct. 5, 2026).
Health system CEOs should track two kinds of AI metrics. Outcome KPIs, such as readmissions, patient and provider satisfaction, caregiver time returned and financial benefit against AI operating cost, belong in the existing performance scorecard. Governance KPIs, such as inventory completeness, ownership coverage, AI-related safety events and near misses, post-deployment performance and framework alignment, show whether those outcome numbers can be trusted.
Compare the approved list against the AI activity observed across the network, including tools staff adopt on their own and AI features vendors add to approved products. Then track how many discovered tools are awaiting review and how long it takes to review them.
An AI-related near miss is an event in which AI could have caused harm but the problem was caught first. Examples include a fabricated detail in an AI-drafted note that a clinician corrects before signing, or a prompt containing protected health information that policy enforcement blocks before it reaches an unapproved tool.
Frequency should match risk. High-risk clinical tools warrant continuous monitoring against a local baseline, while lower-risk tools can be re-tested on a set schedule. A vendor model change or a breached threshold for accuracy or override rates should trigger review regardless of the schedule.
An AI Risk & Trust Index is a single executive view that rates AI risk green, yellow or red by combining clinical safety events, inaccuracies, privacy and security events, patient complaints and significant clinical overrides. It is reliable only when each input has a defined source, thresholds and an owner.
.png)
.png)
.png)
