AI Is Already in Your Practice: Michael Ducsak on Governing What Comes Next

On this episode of the MGMA Insights Podcast, host and senior editor Daniel Williams sits down with Michael Ducsak, chief information security officer at Anatomy IT, to discuss AI governance, cybersecurity and the practical safeguards medical practices need as employees adopt increasingly powerful technology. Ducsak draws on nearly 30 years in information security to explain how organizations can identify existing AI use, protect sensitive information and build policies that preserve productivity without introducing unnecessary risk.

Episode Takeaways

• Assume AI is already in use. If employees have access to browsers, smartphones or common digital assistants, they likely have access to AI tools, whether leadership has formally approved them or not.
• Begin with discovery. Practice leaders should work with internal IT teams or external specialists to identify which AI platforms employees are using, what information is being entered and where organizational data could be exposed.
• Connect AI adoption to a defined business need. Administrative work, correspondence, meeting notes and other repetitive responsibilities may offer immediate opportunities to improve efficiency, but each use case should be evaluated before implementation.
• Treat public AI platforms cautiously. Information entered into open or consumer-grade tools may be retained or used beyond the organization’s control. Practices should verify licensing terms, privacy settings and data-handling protections before allowing employees to use a platform.
• Protect patient and organizational information. AI governance should reinforce safeguards around protected health information, personally identifiable information, financial records and intellectual property.
• Put expectations in writing. A formal policy should identify approved tools, prohibited data, acceptable use cases and employee responsibilities. Blocking every AI platform is unlikely to stop adoption, so clear and workable boundaries are essential.
• Match access to employee roles. AI tools should follow the same permission principles used elsewhere in the organization. Employees should only be able to retrieve or process the information required for their responsibilities.
• Create a culture of prompt reporting. When an employee clicks a suspicious link or shares information with the wrong platform, reporting the mistake quickly gives cybersecurity teams the best chance to limit damage.

Resources

• Learn more about Anatomy IT
• Connect with Michael Ducsak on LinkedIn
• Cybersecurity for Medical Practices: Federal Policy and HIPAA Security Update (MGMA Government Affairs; Oct. 2026)
• AI for Medical Practices (MGMA Resources)
• MGMA Insights Podcast Network

MGMA Members: Would like to appear on an episode? Email us at dwilliams@mgma.com. If you have a question about your practice that you would like us to answer, send an email to advisor@mgma.com. Don't forget to subscribe to our network wherever you get your podcasts!

Anatomy IT sponsored this episode.

Are you experiencing IT issues causing unplanned downtime? Do you struggle to stay compliant with HIPAA or other programs? Or lack an AI Governance plan to increase productivity and lower risk?

For nearly four decades, Anatomy IT has delivered cybersecurity and compliance services. With solutions tailored for ambulatory surgery centers, hospitals, and medical practices, we enable healthcare leaders to modernize IT without compromising patient care.

Anatomy IT is a proud member of MGMA. Learn more at anatomyIT.com/mgma.