Healthcare organisations may be becoming more digitally mature, but that does not automatically mean they are ready for widespread AI adoption. Western Health in Melbourne has been dealing with one of the increasingly common side effects of rapid AI adoption: shadow AI, where employees use artificial intelligence tools that have not been formally approved or authorised by the organisation.
Western Health serves around 1.3 million people across Melbourne's west and employs roughly 13,000 staff. Over the past eight years, it has consolidated more than 30 systems across its network, giving it a stronger digital foundation for introducing AI.
Yet even with that maturity, governing AI has become a major challenge.
Almost Four in Ten Employees Are Already Using AI
During HIMSS26 APAC, Western Health divisional director of digital health Lily Liu revealed that close to 40% of the organisation's workforce is already using AI.
Around 800 employees were found to be using AI tools that had not been formally approved, while others were accessing applications for which they were not authorised.
This creates an uncomfortable situation for healthcare leaders.
Trying to completely block AI may simply push more use underground.
At the same time, allowing uncontrolled experimentation can create privacy, cybersecurity, governance and patient-safety risks.
Western Health's approach therefore focuses on providing enough governance to manage risk without discouraging useful innovation.
An AI Tool Is Not the Same as an AI Use Case
One of Liu's most important points is that organisations need to distinguish between an AI tool and what people are actually using it to do.
Microsoft Copilot, for example, is simply an AI tool.
Using Copilot to draft an email to a colleague is a non-clinical use case.
Using the same Copilot system to write a patient discharge summary becomes a clinical use case.
The technology may be identical, but the consequences are completely different.
That distinction matters because healthcare organisations should not apply exactly the same governance process to every interaction with AI.
A generated internal memo does not carry the same potential risk as an AI-generated clinical recommendation that could influence treatment.
Different AI Systems Need Different Governance
Western Health also recognises that not every type of AI should be governed in the same way.
A large language model used for drafting text is fundamentally different from a clinical decision-support system.
The latter may influence patient care directly and therefore requires stronger assessment, validation and ongoing monitoring.
Western Health has a dedicated committee responsible for changes to clinical practice, including changes to clinical workflows.
AI implementations affecting those workflows can therefore require corresponding clinical assessment rather than being treated simply as another software deployment.
That approach avoids the temptation to create one enormous AI policy and assume it applies equally to every possible use.
A Five-Step Assurance Process Helps Control Risk
Western Health uses a five-step assurance process as part of its AI governance model.
The process begins with a basic but important question:
Is this AI use case appropriate in the first place?
Not every problem needs AI.
A traditional software workflow may be cheaper, easier to understand and easier to maintain.
If AI is appropriate, the organisation can then consider the level of risk, how the tool will be used, what data it will access and whether clinical or operational safeguards are necessary.
Liu also noted that not every AI application needs to go through exactly the same assurance process.
Governance can be adjusted according to risk.
That flexibility is important because applying a clinical-level review to every employee using AI to draft an email would quickly become impractical.
AI Cannot Be Approved Once and Forgotten
Another challenge is that AI systems change.
Traditional enterprise software can remain relatively stable until an organisation chooses to install an update.
AI platforms may evolve much more frequently.
Models can be upgraded, behaviours can change and new capabilities may appear without the organisation significantly changing its own workflow.
That means AI governance cannot become a one-off approval exercise.
Liu warned organisations against effectively approving an implementation and then forgetting about it.
In clinical environments especially, ongoing monitoring remains necessary regardless of whether the underlying model has been updated.
Healthcare organisations therefore need governance that continues throughout the system's lifecycle.
Do Not Launch Too Many AI Projects at Once
The excitement surrounding AI can encourage organisations to start numerous pilots simultaneously.
Western Health takes a more cautious approach.
Liu warned against trying to implement too many AI initiatives at the same time.
Every project requires governance, workflow design, user training, monitoring and evaluation.
Launching dozens of pilots can quickly overwhelm the teams responsible for overseeing them.
There is also a risk that organisations become very good at starting AI projects but poor at determining whether any of them actually delivered useful results.
A smaller number of focused implementations can be easier to evaluate properly.
Treat Every AI Implementation as an Innovation
Liu suggested that healthcare organisations should treat each meaningful AI deployment as an innovation initiative.
The reasoning is simple.
Many organisations introducing AI today are attempting things that have never previously been part of their normal workflow.
That means there may not be an established implementation template to follow.
The project should therefore be approached as an experiment with defined goals, boundaries, measurements and review points.
Liu also recommends time-boxing AI initiatives.
Without clear deadlines and decision points, pilots can remain stuck in an experimental phase indefinitely.
A time-boxed implementation forces the organisation to eventually decide whether the AI project should move forward, change direction or stop.
The Workforce Has to Be Ready
Technology alone will not determine whether an AI implementation succeeds.
The workforce has to understand what the organisation is trying to achieve and how the AI system is supposed to be used.
That includes understanding the limitations of the tool.
Employees need to know when AI output should be verified, what information should not be entered into external systems and when human judgement must take priority.
In healthcare, this becomes particularly important because staff may encounter AI across both clinical and administrative work.
A technically impressive tool can still fail if employees do not trust it, misunderstand it or use it in ways the organisation never intended.
AI readiness therefore needs to include education as much as infrastructure.
Western Health Is Already Using AI Across Multiple Areas
Western Health currently uses AI for several practical tasks.
These include:
The organisation also uses AI chatbots to answer HR questions and support employees using its Electronic Medical Record system.
These are relatively practical examples where AI can reduce repetitive work without necessarily making autonomous clinical decisions.
The next stage is expected to move closer to frontline clinical workflows.
Western Health plans to introduce an AI scribe across outpatient services in the coming months.
AI scribes can listen to consultations and generate draft clinical documentation, potentially reducing the amount of time clinicians spend typing notes after seeing patients.
AI Scribes Could Be One of Healthcare's Most Practical Uses of AI
Documentation burden is a persistent problem across healthcare.
Doctors, nurses and allied-health professionals can spend substantial amounts of time entering information into electronic systems.
AI scribes attempt to shift some of that work away from the clinician.
Instead of manually documenting every part of an encounter, the AI can generate a structured draft for the clinician to review.
The important word remains draft.
Clinical staff still need to verify that the information is accurate before it becomes part of the medical record.
Handled properly, AI scribes could give clinicians more time to focus on patients while reducing administrative workload.
Handled poorly, incorrect AI-generated documentation could introduce new clinical risks.
That is exactly why governance and monitoring need to accompany the technology.
Western Health Is Also Exploring Vibe Coding
Interestingly, Western Health also plans to explore vibe coding, where AI tools assist heavily with software development by generating or modifying code from natural-language instructions.
For healthcare organisations, this could potentially speed up development of small internal tools or prototypes.
But it also raises familiar questions about testing, security and maintainability.
AI-generated code should not automatically be treated as production-ready simply because it appears to work.
Hospitals operate highly sensitive environments containing patient data and critical workflows.
Any AI-assisted development therefore still requires normal engineering controls, code review and security validation.
Shadow AI Shows That Employees Will Not Wait
Perhaps the most important lesson from Western Health's experience is that AI adoption is already happening whether organisations formally approve it or not.
Employees can access powerful AI services from browsers and personal devices with very little effort.
That makes a purely restrictive approach difficult to sustain.
If staff see clear value in the technology, some will inevitably experiment.
The challenge for healthcare leaders is therefore to create approved pathways that are easier and safer than unofficial alternatives.
Good governance should not simply tell staff what they cannot do.
It should help them understand where AI is useful, which tools are approved and what safeguards apply.
Final Thoughts
Western Health's experience shows why healthcare organisations should avoid treating AI as just another software rollout.
The technology changes rapidly, the risks vary dramatically between use cases, and employees may begin using it long before formal policies are finished.
A better approach is to treat meaningful AI implementations as innovation projects.
Define the problem first.
Decide whether AI is actually appropriate.
Apply governance according to risk.
Measure the outcome.
Train the workforce.
Monitor the implementation continuously.
And give every project a clear timeframe rather than allowing endless experimentation.
Healthcare AI does not need to be slowed down unnecessarily, but it does need to be introduced deliberately.
The organisations likely to benefit most will not be those that deploy the greatest number of AI tools.
They will be the ones that can turn experimentation into safe, measurable and sustainable improvements to healthcare delivery.
Comments 0