Nearly 70% of employees are using non-corporate accounts on workplace systems to access artificial intelligence platforms, according to Josh Schmidt, who is a partner at BPM leading cybersecurity and IT advisory work. At a medical practice, the next data leak could be as simple as an employee pasting patient information into an unapproved AI tool to save five minutes.

Schmidt learned to see technology through the eyes of a business owner. He grew up in a family of small business owners, studied computer science, and discovered that he was good at ethically breaking into systems. That combination shaped his current work: Finding vulnerabilities, translating them into business risks, and helping leaders fix them before someone else exploits them.

He recently joined Caila Cohen and Sven Jost, fellow BPM partners, for a conversation with Daniel Williams, senior editor and host of the MGMA Insights Podcast. Their subject was back-office modernization, but their warning was broader: Practices keep buying technology before defining the problem, automating fragmented workflows, and creating new security and reporting risks in the process.

Modernization begins with a blank sheet of paper

Cohen, an engineer by training and a partner in BPM’s technology business unit, Caravel, works with healthcare organizations whose growth has outpaced their systems. A clinic adds a location, acquires another practice, or recruits a provider — and each move brings another application, spreadsheet, workflow, or locally invented workaround.

“That method works in the near term to get that additional acquisition, for example, embedded into the organization,” Cohen said. “But eventually and pretty quickly, it leads to disconnected systems, workarounds that are manual, duplicate data.”

The duplication also shows up in staff work: Entering the same demographic information twice, reconciling reports by hand, or asking the one employee who remembers why a process was designed that way. Institutional knowledge becomes infrastructure.

Modernization, Cohen argued, does not start with replacing every system but rather with a blank-sheet question: “If we’re looking at the business first day and we’re designing the organization as of the current state, both for process and technology, how would we want it to operate?”

The goal is a back office that is scalable, secure, and data-driven. Reaching it can require taking “a couple steps back to evaluate the process first before they even look at technology.”

The most expensive mistake is automating a bad process

Cohen sees one mistake more than any other: Organizations begin with a product instead of a problem statement. A demonstration promises automated scheduling, an AI assistant, or a new reporting layer. Leaders buy it without first mapping the work that it is supposed to improve.

“Without having that clear problem statement, organizations end up just automating a broken process, making that process even worse, compounding that process,” she said.

The market pressure to adopt AI is already substantial. An August 2026 MGMA Stat poll found that AI played a role in patient visits at 83% of responding medical groups, up from 71% one year earlier. Yet 30% of leaders using AI reported no meaningful change in workload, while 37% described work shifting to other tasks. The numbers suggest that simply adopting AI doesn't necessarily translate into less work.

Cohen also warned against attempting to transform the entire organization at once. Her alternative is to find a small number of high-friction, high-value use cases and solve those first. 

“Modernization doesn’t need to be a massive, disruptive technology overhaul,” she said. Ask what should be faster, easier, or more visible, then decide whether technology belongs in the answer.

A dashboard cannot settle an argument about definitions

Jost, an economist and data analytics partner at BPM, works at the intersection of finance, operations, and technology. That makes him the person asked to reconcile reports after various departments produce different answers to the same question.

He describes the condition as “data rich, insight poor.” Medical groups rarely lack data volume. Instead, they lack common definitions, accountable owners, and a clear connection between a metric and the decision it should support.

“In many cases, we have many metrics that are defined differently across maybe finance, operations, clinical teams,” Jost said. The result is a meeting in which leaders debate whose number is correct rather than deciding what action to take.

A visually polished dashboard does not solve that problem. “We can’t even answer the question of what changed, why, and what are we going to do next,” he said. Before building another report, leaders should select a few high-value questions, agree on the definitions behind them, name the data owner, and trace a repeatable path from source to action.

Jost applies the same discipline to AI. “The wrong question where we are in the life cycle of AI and automation is always like, ‘Hey, where can AI be deployed?’” The better question is which recurring problem, decision, or bottleneck needs to be solved. The answer could be AI, conventional automation, a workflow redesign, or a policy change.

Repetitive work is the best place to begin

When asked for one actionable recommendation, Jost asked in return, “Where do people spend [a lot of] time on repetitive work?” He explained that repetitive tasks are visible, measurable, and often spread across multiple employees, which makes it easier to put a number on the value of doing the work differently.

A practice might examine daily eligibility checks, recurring spreadsheet consolidation, payment posting, denial-status follow-up, appointment backfilling, or routine correspondence. Leaders can then record the number of transactions, minutes per transaction, rework rate, and employees involved before evaluating a solution.

The goal is not to announce an enterprise transformation. “Start with one problem and one decision that matters and then scale,” Jost said.

The attack surface extends beyond the practice

Schmidt divides a practice’s exposure into two systems: those it controls and those it depends on. Internally, that includes cloud infrastructure, remote-work platforms, patient portals, endpoints, and employee accounts. Externally, it includes vendors, their subcontractors, and the subcontractors behind them.

“One of the largest blind spots is those fourth parties,” Schmidt said. A medical group may assess an EHR, billing vendor, or cloud provider during contracting, but it often has little visibility into the processors and subprocessors supporting that company.

Shadow AI adds another layer. Employees may use personal AI accounts through corporate devices, avoiding whatever protections the organization established for approved platforms.

MGMA Stat data shows similar uncertainty around cyberattack recovery. An October Stat poll of 238 practice leaders found that only 19% were very confident their organizations could recover quickly from a cyberattack, 61% were somewhat confident, and 21% were not confident. The most confident respondents cited tested backups, documented incident-response plans, experienced IT teams, and strong vendor support.

Schmidt advises practices to identify where these tools are being used, how employees are circumventing controls, and what guardrails can contain the risk.

There is no cybersecurity miracle cure

Schmidt’s final warning drew on the language of healthcare itself. Practices are accustomed to evaluating products that promise transformative results. Cybersecurity vendors often use the same pitch.

“Snake oil and promises of remedies in the medical space are a tale as old as time,” he said. “Miracle cures don’t exist for the human body, and they don’t exist for cybersecurity either.”

No platform makes a practice impervious. A resilient program combines layered defenses, a technology inventory, staff education, access controls, vendor oversight, tested backups, and an incident-response plan that identifies who makes decisions when systems are unavailable. The organization must also know how it will continue scheduling patients, submitting claims, communicating with clinicians, and paying employees during an outage.

The same principle connects all three disciplines. Technology cannot compensate for an undefined workflow. Analytics cannot compensate for disputed definitions. Security software cannot compensate for an organization that does not know where its data travels.

“Build a trusted team, build a process and a solid foundation that can cut through that noise,” Schmidt said. The practice that does that work is not impervious. It is prepared.

Resources

• Connect with Caila Cohen on LinkedIn
• Connect with Josh Schmidt on LinkedIn
• Connect with Sven Jost on LinkedIn
• Caravel, BPM Technology Solutions
• Upcoming MGMA conferences and webinars
• Explore MGMA Health IT resources

MGMA Members: Would like to appear on an episode? Email us at dwilliams@mgma.com. If you have a question about your practice that you would like us to answer, send an email to advisor@mgma.com. Don't forget to subscribe to our network wherever you get your podcasts!