Verify Your Artifacts. Protect Your Patients.

Securing the Software and AI Behind Patient Care

Software is no longer an operational layer behind patient care. It is patient care. It’s what powers the EHR a clinician relies on mid-shift, the infusion pump firmware at a bedside, the AI model reading a scan, the trial-management system a regulator will later audit. When that software fails or is compromised, the impact doesn’t announce itself as an outage ticket. It shows up later, as a delay, a missed window, sometimes a death. In June 2025, King’s College Hospital NHS Foundation Trust confirmed that a long wait for a blood test result, caused by the June 2024 ransomware attack on pathology provider Synnovis, was one of a number of contributing factors in a patient’s death. The impact reached patients across multiple hospitals, far beyond the systems that were breached.

At the same time, regulatory pressure is widening: FDA requires cyber device manufacturers to include a software bill of materials in premarket submissions, and HHS has proposed HIPAA Security Rule changes that would require a technology asset inventory. Meanwhile, AI-assisted coding, diagnostic models, and autonomous agents are entering the pipeline faster than many governance programs can track. The threat landscape hasn’t eased, either: a single unvetted open-source package or unmonitored model can still reach a clinical system unnoticed.

If software is patient care, then the integrity of that software is a patient safety issue. This brief outlines how healthcare and life sciences organizations are approaching that responsibility, from knowing what is in the software and AI they run, to verifying where it came from, to keeping that trust intact as it changes. It also covers what this means for providers, device makers, and life sciences teams shipping regulated software.