Who Gets Access to Patient Data When the One Asking Is an AI Agent?

Picture the scene.

It's 2 a.m. at a health system somewhere in the U.S., a request hits the electronic health record. Not from a physician. Not from a nurse. From an AI agent, acting on behalf of... whom, exactly?

Who said it could ask? What records can it see? And where does that sensitive data go next?

If you can't answer those three questions with confidence, you're not ready for agentic AI. 

Healthcare has spent a decade getting data to move. FHIR. HL7. National networks. Interoperability mandates pushed patient records out of silos and into motion, and leaders deserve real credit for that.

But somewhere along the way, we told ourselves that moving the data was the hard part.

It wasn't. The hard part now isn't moving data. It's governing who  and what touches it.

Agentic AI is already walking through the door. In the AMA's Augmented Intelligence Research (published in February 2025), physician adoption of AI jumped from 38% to 66% in a single year. And the agents coming next won't just summarize notes. They'll schedule, triage, authorize, and query patient records on their own initiative.

Every one of those actions is a question your governance layer has to answer in real time. Not in a policy binder. Not in a quarterly operating review. The answer must come at the moment of the request.

‍The stall is coming

Here's my prediction, and I can assure you it's not a hopeful one for the unprepared: the first wave of healthcare AI agents will stall — not because the models aren't good enough, but because access was never governed from day one.

‍Gartner predicts more than 40% of agentic AI projects will be canceled by the end of 2027. I've seen this firsthand across industries. Teams race to pilot. The demo dazzles. Then security, compliance, and privacy teams ask the obvious questions: who approved this agent, what data can it reach, how do we revoke it. And then, the pilot quietly dies in committee or as a failed science project.

That's not a tech problem. That's a patient trust problem.

Consider what's already at stake. According to IBM's Cost of a Data Breach Report 2026, the healthcare industry registered the highest average breach cost (USD 6.64 million) among several industries. 

Malicious insiders, phishing, stolen credentials. Now add agents making thousands of autonomous data requests an hour, and ask yourself: can your current controls even see that traffic, let alone govern it?

If the answer is no, you're not deploying AI. You're deploying Shadow AI with a hospital badge.

And in healthcare, "invisible" is the one thing you can't afford to be. Your regulator isn't abstract, it's a post breach audit where the first question won't be about your model. It will be: who, or what, touched that patient record, and under whose authority?

‍From interoperability to AI readiness

So what must healthcare IT leaders build now? Not a moonshot. A bridge.

Interoperability got the data moving. AI readiness is about governing the traffic. The layer that connects the two is governed API exposure — and that's exactly where an AI gateway comes in.

Think of an AI gateway as the front door for every agent in your ecosystem. Every request an agent makes to a FHIR API, to a model, to a tool andpasses through one governed point of exposure. That's where you enforce identity, consent and policy, before data ever leaves the building. That's where observability lives: every call logged and traceable, so you can see which agent touched which record, under whose consent, and why — in real time, not in a quarterly audit.

AI Gateway: full observability over AI agents - https://www.youtube.com/watch?v=2svdJaBNSd8

Without that layer, agent traffic is invisible traffic. Your security team can't govern what it can't see.

With it, the same pipes that serve clinicians today can safely serve agents tomorrow. I saw what governed, observable pipes make possible when I sat down with Liberty Health's Chief Data Officer, Marcelo Biangulo. They built an integrated data network for the public health system of São Paulo — Unified Health System  — that already touches more than 7 million patients across 370+ facilities. A project that would normally take eight months went live in about two weeks.

The agents arriving next don't need new pipes. They need permission to use the ones you built with the right level of visibility and control.

‍Five things to put in place now

• Agent identity. Every agent gets its own identity, its own credentials, and least privilege access. No shared service accounts. No "it uses the integration's key."
• Consent as code. Patient consent enforced at the API layer, per request — not buried in a scanned PDF nobody checks.
• Policy enforcement at the point of exposure. The API is where data leaves the building. That's where you govern it. Not after.
• Audit everything. Who asked, what was returned, on whose behalf, under what consent. Every call. Every time.
• Governed FHIR exposure. You've already built the FHIR APIs. Now wrap them in visibility and control so the same pipes that serve clinicians can safely serve agents.

None of this slows AI down. Governance was never meant to be the brake. Governance must be step 0 in every AI strategy.

‍Treat Every Agent Like a New Hire

The question "who gets access to patient data?" used to have a short answer: people with badges. Now the one asking might be software and "we'll figure it out after the pilot" is not an answer your patients signed up for.

I believe the health systems that win the agentic era will be the ones that treat every agent like a new hire: identified, authorized, trained on what it may touch, and watched on every shift. Visibility first. Control always. Scale what you can prove.

Interoperability was chapter one. Governed AI access is chapter two. The health systems writing chapter two now are the ones whose agents will still be trusted long after the pilots are forgotten.