See where healthcare data goes once it hits an AI tool

All right. Thank you, everybody. Especially those of you on phone calls. This is just a good place to sit, right? Well, good afternoon, everyone. Thank you for attending this session. My name is Christian Boucher. I'm the healthcare CTO at Island, and I'm joined by Shawn Surber, director of Solutions Engineering at Island as well. Just a little background. He and I both have worked in healthcare for about 25 years each, both on the provider side, as well as the vendor side. And today we want to talk a little bit about how, you know, who has heard of AI? Anyone? Okay, great. Great. We have a good audience today. So we want to talk a little bit about how how data governance is going to play a role in how AI is enabled throughout your organization will move forward. So I'll start it off.

Just a little background, if you have an... Started using AI now. Pretty, I'm assuming you're in the minority, but overall, we're seeing a giant trend of AI taking hold in AI, whether it's your homebuilt LLMs or you're partnering with public LLMs, whatever it may be, AI and agentic AI are making its way into healthcare significantly.

The way we see it is, you know, the new homepage. We oftentimes have, sorry, brought various tools in place to present applications and resources to your healthcare providers and the users with inside of your ecosystems. That alone has driven a lot of consumption of various tools inside of IT. But the way we used to get, the homepage needs to be better. It needs to be customizable. It needs to be context to where, needs to be hypermobile for your users to not only understand which applications they have access to, but also how those applications can interact with each other. And, you know, we're talking about homepage here. We're really talking about is we're talking about the user workspace. And when we're talking about clinicians especially, we need to ensure that their workspace is defined for them, not just generically for any employee of a hospital or provider or company or whatever, right?

And so by being able to personalize that, based on who they are, what their roles are, you create a workflow, that, go ahead, that allows you to tie together all of your applications in one space. And this is a really common problem we run into where users have all these different types of applications and they got to go here to do that, they got a log of VPN for this. They got to wander around the building trying to figure out how stuff works. So we bring all that into their workspace, and we're talking, you know, all of your SaaS apps, right? Everybody knows what a SaaS app is, is served out of the cloud. This is what's driven the creation of or the use of browsers in the enterprise. Browser is not just for shopping anymore. It runs almost all of your applications. But there's also still those desktop apps and secure apps and all these things you need to be able to access from that single place. And now along comes Gen AI.

And with Gen AI, you bring a lot more concerns to the overall workflows in data security within your organization. Things like PHI. Where does that, how do, how do you govern where that flows, which, which LLMs are allowed to be consuming PHI, which LLMs are allowed to exfiltrate PHI? Not only with the with the clinical side of the house, but also when you start talking about your operation side or your back office, everyone is using various tools to overall deliver AI into your organization, and there has to be some way to govern that data and how it flows, where it flows, and when it can.

The way we see it, and the way we design our solution is to be able to extend capabilities that we've had previously with virtual applications or web-based applications, into the world of AI, delivering you significantly granular controls, into how you can govern where data goes, who sees those LLMs, when they can use them. Can they use them when they're remote or is it only when they're on managed devices? And that gets into some of our last mile controls. And just like there's been browser wars and polo wars. There's been, you know, HD, DVD versus Blu-ray. No one's decided yet how AI models are going to be used and which AI models are going to survive. So we can't throw all of the eggs into any one basket. You need to be able to support all of these apps based on which ones your organization is choosing. And then you have to wrap security around them.

And that's really the biggest thing. You know, we don't want patient data. We don't want proprietary data. We don't really want anything getting out into public AI models. So you put controls around the AI you control and allow users to use it. And the AIs that you don't control, you either block access to them or you restrict what they can do. You can't complement based data, you can't upload patient files, that sort of stuff. And so adding in those enterprise data security requirements is really key to your successful implementation of a... And that's really what's going to get you that adoption. I've been supporting clinicians for 25 years. And one thing I know is if it's not easy, they're not going to do it. And it is easy. They probably still won't do it. But what we're gonna do is we're talking about like steering up, getting, making it easy for them.

They click on something. you know, they clicked on the link, somebody sends them, oh, check out this new AI. It's amazing. It loads your AI. Automatically for him. And they're like, that looks just like the AI I was already using. You're an idiot. But they don't need to know that, right? We make everything smooth, make everything seamless, and don't allow this proliferation of what we lovingly. We've taken the shadow IT term and we've moved it into AI. So now there's shadow AI. What AI models are in use in your organization?

I used to ask this question when I was in asset management about Java. Like, what versions of Java do you have running? The best answer I ever got was all of them probably. Yeah, same answer for AI. Somebody's using every one of them. And that gets us back to that conversation is we want to enable our end users to leverage the tools that we're purchasing and leverage the intelligence that we're bringing to them. But how do we govern that access? How do we allow them to be able to continue their work and not be concerned about, am I am I putting this data in the wrong AI platform? Am I sending it to the wrong agentic engine? So we have the ability to, you know, essentially, give you the power to control how and when your data gets moved. And that can change again by role, so you may have certain individuals that don't see any AI agents within your within the homepage or the RR workspace.

And you may have others that have several, but at the same time, how do you make sure that they're not taking that PHI data and moving it into a publicly facing an LLM or one that was not designed with a clinical nature? So those where we really feel that we can help organizations deliver a lot more governance over the way that where that data goes. The other part of it, and we start talking about, you know, streamlining, you know, workflow is for organizations. Now, sometimes agent AI can help that. Maybe it's building robotic process automation on some of the tools that we have in place. Maybe it's being able to scrub data from one application, move it to AI, pull out the content, and then deliver it back into another application. All those things are important. If we're delivering these tools that are meant to give your users more power and more ability to make decisions in real time, they better be easy to use and they better be, you know, you better have the ability to, you know, automate some of those processes because if not, you're just adding more steps to their day.

And if you haven't figured it out already on the security guy. So Christian's all about, hey, let's make sure everybody's enabled. lets get them all the things. I'm like, all right, but now we have to secure it. We have to do it right, right? So that becomes a critical part of that implementation, leveraging the tools you've already got. You don't need to reinvent the wheel, but also building that security in from the ground up. Everybody wants everything to be secure by design. Nothing is ever going to be secure by design. So by putting your access to AI and gating your access to AI through an enterprise browser. You create an abstraction layer. You create the ability to create secure by design because you can control everything that user can do. You can insert multifactor authentication. You can control their cut copy paste actions they can take within applications. That's where you can change that that paradigm, change that model, where now you don't care so much about the application behind it, because you know you've got control over the way your users are using it. And that's really what we're talking about here is this concept of taking a tool that gives you all of your traditional security tools at the moment the users are accessing information.

DLP. Everybody's favorite 4 letter word, right? I implemented DLP for 180,000 user health system. That was 10 years ago. It was a nightmare then it's a nightmare today. Everybody hates DLP, but everybody has to have it. So tying that into things like, moment of access, data redaction, controlling, educating the users, tying it into the AI systems to give you insights into where your data is going and how it's being used allows you to then build your policies, your procedures and your systems for the future. Now, the key thing there is you need the data. Everybody uses data differently. So by pulling all of these applications into this single new user workspace, you're now able to gather that data and make intelligent, design choices about the way you're rolling out your your remaining applications. And I would just add, you know, one of the great things about these new platforms, whether it's AI or internal MCP service connecting and different application groups, is they should be able to be consumed by any user at any time.

Of course, depending upon posture. Understanding that, you know, you have the world of healthcare has changed. It's no longer everyone sitting in a brick and mortar building. You have researchers working from home, you have partnerships with physician affiliates. You have partnerships with universities. How do you securely deliver these applications and these, you know, all these AI models securely to those to those organizations? The, the, the great thing about a browser, and I would say specifically about island browser, is that you can deliver these applications with one application, that you either deploy them, with your infrastructures you have now to your manage devices, or you simply, email a link to your affiliate access, they download the browser, log in with the credentials that you have, and all of a sudden you've secured all this data and this access, regardless of the modality of how they're accessing that. So it really simplifies this and allows you to go to market with new tools instantaneously.

You want to add a new LLM to your environment, to simply add it to the, to that user's homepage, what, within 5 minutes, it refreshes and they have access to that instantaneously, no more, 6 months rollouts of new tools. It's instantaneous, for all those user groups that can access them. And think about your, your mobile workforce, your traveling nurses, your, caseworkers, your, your home health nurses, you need to give them the tools to to get their job done, and a lot of that, those tools are technology based now. So you give them that same experience, whether you own the device or not, without ever having concern about your data migrating out into a an unknown LLM or anywhere else. And so that capacity to operate on unmanaged devices, but still have an enterprise grade tool, is very similar to what you are probably doing with your user's phones right now.

Because if you're not providing their phones, it's their own device, but you put restrictions around your Gmail or your Outlook that restrict what they're allowed to do. This is the exact same concept. You say, if you want to access our applications, you use our tool to do so, and now you've got complete control over that without trying to take over the rest of their stuff. You don't want the rest of their stuff. So, thank you so much for joining us. We appreciate it. You guys are great. Thank you so much. If you've got any questions, we're happy to answer them, we talked really fast. We did? So, we can answer a question or 2 from the stage, if you wish. And then, of course, we've got a booth just right around the corner, in the 2nd aisle right there. 4036, where we've got engineers there ready to show you how this really works. Thank you.