“You don’t need to panic and fear about everything just to make sure you’re one step ahead,” says Michael Ducsak, chief information security officer at Anatomy IT. “You just keep a weather eye out and some common sense.” 

In conversation with Daniel Williams, senior editor at MGMA and host of the MGMA Insights Podcast Network, Ducsak explains how medical practices can establish AI governance without losing the efficiency that makes the technology valuable. Drawing on nearly 30 years in cybersecurity, a career that began at AT&T when the field was still largely discussed in terms of fraud, Ducsak offers practical guidance on identifying AI use, protecting sensitive information, and setting clear expectations for employees.

Top Three Takeaways

1. Assume employees are already using AI.
   When practice leaders ask whether their teams are using AI, Ducsak’s answer is direct: “Yes, they are.” Employees can access AI through browsers, smartphones, and other everyday tools, with or without formal approval. Rather than attempting an outright ban that may be difficult to enforce, practices should identify which tools are being used, understand how employees are using them, and establish appropriate boundaries.
2. Start with discovery, policy, and education.
   Effective AI governance begins with understanding the practice’s current environment. Ducsak recommends discovering which AI tools are in use, clarifying the business reasons for using them, and creating written policies that define acceptable behavior. Staff education is equally important. Employees need to understand that information entered into an AI platform can still create risks for the organization and that they remain accountable for how the technology is used.
3. Protect data without eliminating productivity.
   AI can help administrative teams draft correspondence, organize information, and complete routine work more efficiently, but those benefits must be balanced against privacy, security and compliance risks. Ducsak cautions practices against entering protected health information, personally identifiable information, financial data, or other sensitive material into tools that have not been reviewed and appropriately controlled. The goal is not to say no to every AI application, but to create safeguards that allow approved uses while protecting patients and the practice.

Resources

• Learn more about Anatomy IT
• Connect with Michael Ducsak on LinkedIn
• Cybersecurity for Medical Practices: Federal Policy and HIPAA Security Update (MGMA Government Affairs; Oct. 2026)
• AI for Medical Practices (MGMA Resources)
• MGMA Insights Podcast Network

MGMA members who have a useful story, challenge, solution, experience or perspective to share are invited to contact Daniel Williams at dwilliams@mgma.com about appearing on the MGMA Insights Podcast Network.

Sponsor

Anatomy IT

Are you experiencing IT issues causing unplanned downtime? Do you struggle to stay compliant with HIPAA or other programs? Or lack an AI Governance plan to increase productivity and lower risk? 

For nearly four decades, Anatomy IT has delivered cybersecurity and compliance services. With solutions tailored for ambulatory surgery centers, hospitals, and medical practices, we enable healthcare leaders to modernize IT without compromising patient care. 

Anatomy IT is a proud member of MGMA. Learn more at anatomyIT.com/mgma.