A survey published last week asked healthcare leaders responsible for AI strategy whether they could see and control what their AI agents were doing.
More than 85% said yes. Full visibility into agent activity, able to govern what an autonomous agent does.
In the same survey, 72% said AI tools or agents get deployed in their organization without formal IT approval, at least occasionally.
Both answers came from the same group of people.
That isn't dishonesty. It's what confidence looks like when it's measured against the tools you know about. You can have real, well-documented control over every agent that went through review and still be wrong about the total, because the ones that skipped review aren't in the picture you're looking at.
The adoption numbers are why this matters now. Roughly a quarter of these organizations have already implemented agentic AI, 44% are piloting, and another 21% plan to within the year. Agents differ from ordinary software in the way that counts here: they don't wait for input. They move between systems and take actions on someone's behalf.
So the useful question for leadership isn't "do we have an AI policy." Most organizations do by now.
It's this: if someone deployed an agent last month without telling anyone, how would we find out? Through a review, an access log, a vendor invoice, or not at all?
If the honest answer is "not at all," the policy isn't the part that needs work.
The survey was conducted by Vanson Bourne for Imprivata.
What this means for health organizations
Confidence in AI governance is only as good as your inventory. You can start with information you already have: software invoices and expense claims, sign-in and access logs, and a simple way for staff to tell you about tools they use without getting in trouble.
