CHIME's 2026 Most Wired Report: AI Use Hits 93% While Oversight Trails Behind

Health systems are no longer debating whether to use AI. According to the 2026 Digital Health Most Wired National Trends Report, released November 13 by the College of Healthcare Information Management Executives (CHIME), 93.2% of participating organizations now use AI in clinical or operational processes. Full adoption of generative AI rose from 31.0% to 54.8% in a single year (CHIME release via KXAN).

The more important number sits further down. Only 16.4% of the organizations using AI already have fully documented processes for monitoring models after deployment (HealthTechnologyNet reprint of the CHIME release). Fewer than half have a fully documented process for evaluating a model before it goes live (Digital Health Insights). Most organizations can tell you which AI tools they have turned on. Far fewer can show, on paper, how they decided those tools were fit to use or how they would notice if one started performing worse.

That gap is the story of this year's report, and it is not only a large health system problem. The organizations that scored highest are separated from the rest less by what they bought than by the discipline around how they buy, test, and watch it. Most of that discipline costs time and attention rather than money, which matters if you are the IT director, the security officer, and the help desk at a small hospital.

What the Survey Covered

This year's survey drew 235 organizations across 46 states and five countries, representing more than 45,000 facilities. Those organizations produced 476 scored submissions, because each organization can answer for up to three care settings (acute, ambulatory, and long-term/post-acute), and each submission is scored against its own peer group (Digital Health Insights).

The scoring model is size-adjusted. Introduced in 2025, it weighs organizational size, complexity, risk, and resources, and it now reports results in 10 segments (Digital Health Insights). That matters for smaller organizations: a small hospital is not scored as if it were a multi-state system.

The trends report is separate from the Level 10 recognition list. CHIME announced its 14 Level 10 organizations on October 20 and scheduled their recognition for November 12 at the CHIME26 Fall Forum. Twelve are repeats from 2025, including Baptist Health System and University Health. The two new Level 10 organizations are Roper St. Francis Healthcare Services and UPMC (Digital Health Insights).

Adoption Is Outrunning Documentation

The adoption numbers are steep. Beyond the overall 93.2% figure, ambient listening is fully adopted for physicians at 60.8% of organizations, but for nurses at only 9.5% (HealthTechnologyNet reprint of the CHIME release). In our view, ambient documentation is the place many smaller organizations will first run a generative AI tool against live patient encounters, which makes it a sensible first target for formal review.

The oversight numbers have not kept pace. The 16.4% post-deployment monitoring figure has drawn the most attention (MarketScale), and with reason. A model that performed well during a pilot can behave differently months later after a vendor update, a change in documentation templates, or a shift in the patient population. Without a written plan that says who checks, what they check, and how often, nobody is assigned to notice.

CHIME CEO Russ Branzell said in the release that lasting value depends on the leadership, governance, and infrastructure around technology (HealthTechnologyNet). The release names AI governance, cyber resilience, clinical technology integration, trusted analytics, and disaster preparedness and recovery readiness among its priority areas (ADVFN reprint of the CHIME release).

What Separates the Top Scorers

Two comparisons in the report are worth putting in front of your leadership team. Among organizations scoring 9 or 10, 96% use a standard framework to define what an investment must deliver before they buy it, compared with 41% of organizations scoring below 8. Half of the 9 or 10 scorers regularly test whether their AI models perform worse for some patient groups, compared with one in ten of those scoring below 8 (Digital Health Insights). Note the comparison group: organizations scoring 8 sit outside both buckets.

Neither practice requires a data science team. A standard investment framework can be a single page that every AI request must complete before it reaches a purchase order: what problem the tool solves, what measurable result is expected and by when, what data it touches, who owns it after go-live, how you will know it is working, and what happens if it is not. If a vendor or department cannot fill in that page, the purchase is not ready.

Bias testing at a small organization usually starts with the vendor. Ask for performance data broken out by patient group, and ask whether the model was validated on a population that resembles yours. A tool tuned on a large urban academic population may not perform the same way for an older, rural patient base. Get the answers in writing and keep them with your inventory.

The Data Underneath

AI tools are only as reliable as the data they draw on, and the report suggests a lot of that data is not ready. Two-thirds of organizations maintain a data catalog and 60% run automated data quality checks, yet by respondents' own estimate, roughly two in five data elements are not ready for AI. Only 38.7% keep a single authoritative record for patient, provider, and location, and 76.2% name end-user data literacy as a barrier (Digital Health Insights). Only 15.7% have a comprehensive role-based data literacy program (HealthTechnologyNet reprint of the CHIME release).

For a small IT shop, the practical starting point is the authoritative record problem. Duplicate patient records, stale provider lists, and inconsistent location names cause problems for interfaces and reporting long before AI enters the picture. Cleaning them up pays off whether or not you ever deploy another AI tool.

The Resilience Finding Deserves Equal Attention

The governance gap is the headline, but the recovery numbers may be the more urgent finding for many readers. Fewer than 40% of organizations can restore clinical, administrative, network, and employee communication systems within four hours of losing their primary data center. Phishing simulations run at least semi-annually at more than 95% of organizations, while full-scale failover exercises run at only 23.6% (Digital Health Insights). The same summary says organizations with tested failover are about twice as likely to restore systems within four hours.

Organizations test what is easy to test. A phishing campaign is a scheduled email. A failover exercise means planned downtime, coordination with clinical leadership, and the real risk of finding out that something does not work. That risk is the point. Under 45 CFR 164.308(a)(7)(ii)(D), testing and revision procedures for contingency plans are an Addressable implementation specification. Addressable does not mean optional: the organization must either implement it or document why an equivalent alternative is in place. HHS has also proposed Security Rule changes that would likely eliminate the Addressable designation and make all specifications Required.

If a full-scale failover is out of reach, start smaller. Pick one critical system, restore it from backup into an isolated environment, and time the restore from start to verified login. That single number tells you more about your recovery posture than any vendor's stated recovery time objective.

Other Findings Worth Noting

Prior authorization automation stands at 49.4% overall but only 28.9% among the smallest organizations. On interoperability, four in five U.S. organizations have joined a TEFCA Qualified Health Information Network, 56.8% have full two-way, real-time exchange with community providers, and 81.5% report that partners cannot connect (Digital Health Insights). Joining a network and actually exchanging data with the clinics down the road are clearly not the same thing.

Where HIPAA Fits, and Where It Does Not

The HIPAA Security Rule does not mention AI, and nothing in it requires bias testing or clinical performance monitoring. Those are patient safety and governance questions. But an AI tool that contains or uses electronic protected health information (ePHI) is an information system like any other, and the existing safeguards apply to it (45 CFR Part 164):

• Risk analysis, 45 CFR 164.308(a)(1)(ii)(A) (Required). An accurate and thorough assessment of risks to the confidentiality, integrity, and availability of ePHI. If an AI tool handles ePHI and is not in your risk analysis, the analysis is incomplete.
• Evaluation, 45 CFR 164.308(a)(8) (Standard). Periodic technical and nontechnical evaluation, including in response to environmental or operational changes affecting the security of ePHI. In our reading, deploying a new AI tool is the kind of operational change that should trigger one.
• Access control, 45 CFR 164.312(a)(1) (Standard). Access only for persons or software programs that have been granted access rights. AI tools that query records on a user's behalf need defined access rights like any other program.
• Audit controls, 45 CFR 164.312(b) (Standard). Mechanisms that record and examine activity in information systems that contain or use ePHI. Know where the tool's activity is logged and who reviews it.
• Business associate contracts, 45 CFR 164.308(b)(1) and (b)(3) (Required). If an AI vendor creates, receives, maintains, or transmits ePHI on your behalf, you need satisfactory assurances documented in a written contract or other arrangement.

The overlap is useful. The documentation you build for AI governance (what the tool does, what data it touches, who owns it) is much of what your risk analysis already needs.

A Starting Point for a Small Team

Consider a 25-bed Critical Access Hospital with one IT staff member and a part-time contractor. Nobody there is going to stand up an AI governance committee with a data scientist and a bias-testing pipeline. What that hospital can do is build a simple inventory and keep it current. A spreadsheet with these columns is enough to start:

Fill in the highest-risk tools first: anything that drafts clinical documentation, suggests clinical actions, or touches patient-facing communication. Set the next review date for each, and treat a vendor model update or a major EHR upgrade as a trigger for an early review. A post-deployment monitoring plan can be as simple as a named clinician sampling a set number of outputs each month and reporting problems through the same channel you use for other safety or IT incidents. That is a documented plan, and per this report it would put you ahead of most organizations using AI.

Then use the report itself as a conversation tool. The size-adjusted segments mean you can compare yourself with organizations like yours rather than with large academic centers. If you lack the expertise in house, peer networks and shared services can help fill gaps in governance tools and experience.

Read the Benchmark With Care

A few cautions. The full National Trends Report was not publicly readable when this article was written, and the public summaries do not include full methodology, exact survey questions, or response rates by organization size. Results specific to Critical Access Hospitals and very small organizations are not broken out in the public excerpts. Several figures, including the data readiness estimate, are respondents' own estimates. And the report links governance practices to higher maturity scores, not to measured outcomes such as fewer incidents or better returns. Treat the numbers as a strong directional signal, not a precise measurement.

The direction is clear enough. AI is already running in nearly every organization that answered the survey, and the oversight around it is mostly informal. The fix for most readers is not a new platform. It is a list, an owner for every line on it, and a date on the calendar to check again.

This article is for informational purposes only and does not constitute legal or compliance advice. Covered entities and business associates should consult qualified legal counsel or compliance professionals before making decisions pertaining to HIPAA or IT infrastructure.

Sources

• CHIME, CHIME's Digital Health Most Wired Report Finds AI Use Reaches 93% as Health Systems Navigate Governance and Oversight (KXAN press release distribution): kxan.com
• HealthTechnologyNet, reprint of the CHIME release: healthtechnologynet.com
• ADVFN, reprint of the CHIME release: advfn.com
• Digital Health Insights, Key Takeaways From the Digital Health Most Wired National Trends Report: dhix.dhinsights.org
• Digital Health Insights, CHIME Names 14 Organizations to Level 10 in the 2026 Digital Health Most Wired Survey: dhinsights.org
• MarketScale, Just 16% of AI-Using Health Systems Fully Document Model Checks After Launch, CHIME Finds: marketscale.com
• Electronic Code of Federal Regulations, 45 CFR Part 164: ecfr.gov