A Finance Analyst's Agent, That No One Owns | Newsday with Elbridge Locklear and 229Project

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

A Finance Analyst's Agent, That No One Owns | Newsday with Elbridge Locklear and 229Project

[00:00:00] Elbridge Locklear: article, 86% say they are fairly confident about being able to govern it, right? So I had to make a comment about this. That was surprising because if you don't have an inventory and you're not familiar with the AI, you have some reference point, how do you govern? So that's, I don't know how you do that. I guess that's a stopping point on that, right? So you need to be able to govern, sure, but you need to know what you had.

[00:30:00] Sarah Richardson: Welcome to Newsday. I'm Sarah Richardson with the 229 project. And I am over the moon because we have Elbridge Locklear joining us for Newsday today. And Elbridge, you are now part of the 229 Legacy Program. And I'd love, in your own words, to share with our listeners, what that means.

[00:49:00] Elbridge Locklear: Wow. Yeah. So what's interesting or exciting about the legacy program and what I've learned so far is that, you know, I've spent numerous years as a CIO. And I have an extensive experience, very much like many of them out there. But, you know, I get an opportunity to take my experience and meet with other leaders that are in the role, they're deep in the weeds, but also share some of that background, listen to them,

[01:12:00] Elbridge Locklear: bring other solutions or perspectives to the table. And I enjoy that. I like that about two to them.

[01:20:00] Sarah Richardson: Well, thank you. And it's always that moment when you say thank you for saying yes, because what we do is we're on the road a lot. We host a lot of events. We talked to a lot of people. And you joined us in San Diego for our San Diego regional staff roundtable. And it was one of those moments where I was like, hey, you can watch how all these things run or you can just jump right in. And you jumped right in. You're on the AI panel in the

[01:43:00] Sarah Richardson: morning with us. You're helping facilitate the conversations, bringing amazing perspectives, not a beat missed in terms of just integrating into the work that we do every day. And so I'd also love to hear your reflections on the regional staff roundtable and what you witnessed in San Diego.

[02:01:00] Elbridge Locklear: Well, I'll share just a couple of things then. So one thing I enjoyed is DeCander. And so they were very comfortable, CIOs and the staff, highly engaged. And you have a lot of passion about the day-to-day work and solving solutions. So that was pretty nice. And it was 70 people. And I saw that consistent

[02:24:00] Elbridge Locklear: behavior kind of around the table. Some of the things that were discussed when you think about everything is AI. So everyone wants to talk about AI, right? So in the discussions, it wasn't so much about what are we going to do? How do we control AI, that sort of thing. It was more, AI is here. We're using it whether we know about it or not. And how do we determine

[02:47:00] Elbridge Locklear: what the ROI is? And how do you determine who has responsibility for that? Who owns the AI? whatever it might be. And I thought that was where we need to be. Right. So what's what everyone

[02:59:00] Sarah Richardson: is discussing. It is. And to your point, the conversation around the value derivation for the board. How are you keeping your board engaged appropriately? How are you keeping your sui and peers engaged appropriately? How does that trickle down to the staff? There are multiple layers of that continuation of the education of what we do every day. And let's be honest. Like there's a lot of things that IT has done over the decades that wasn't as interesting in some cases at the board.

[03:24:00] Sarah Richardson: board level, like your deck debt, your data management pieces, having to explain those and really connect with people in a more human way. AI is everywhere in everybody's lives. And so it is a conversation that is translatable across every continuum of what we're seeing and

[03:37:00] Elbridge Locklear: facing today. Absolutely. And the comment on the board is it's exciting now. So you see that the board, they're leaning in even more. How do you educate me? What should I actually be doing when they are engaging, say, with the CFO or with a COO, what is the responsibility of the board?

[03:56:00] Elbridge Locklear: Do I hold them accountable? Do I push them to activate AI? Or am I running some level of oversight so that I am aware of an inventory of what we have or say things that are high risk because they're very concerned about anything that's risk related in the financials or privacy or compliance.

[05:01:00] Sarah Richardson: Yeah, as we should be. I mean, truly, the fact that it is being released in a lot of these platforms and our different systems. So your governance may be not should we use it because it's already being used. It's how we're using it and how we're protecting it. The afternoon conversation and resilience that we're seeing across every market that we visit as well is it's more than just having a good downtime procedure. There are so many aspects of being resilient in the

[05:24:00] Sarah Richardson: workforce today that I love how transparent and how vulnerable the organizations are about sharing how prepared or how much preparation still needs to go into feeling safe enough in a world literally today where the threat actors are proliferating in a way that we also have never seen before.

[05:48:00] Elbridge Locklear: It is moving very fast. And the comment around resilience, that's a segment was, it's interesting because it's just now getting the attention with the introduction of AI and how quickly that's moving, you know, your traditional down times won't be the same. How are you managing that

[06:08:00] Elbridge Locklear: AI product that now, I don't want to say turned off or completely disabled, but that's the risk that you have. Something you become highly reliant on you. So your business continuity is going to

[06:21:00] Sarah Richardson: change completely. So it's interesting. Well, and then we've got a couple of headlines from the week

[06:55:00] Sarah Richardson: that play right into part of the conversation. The first one is from Beckers. And it's about traditional enterprise IT and is it disappearing? There were two health systems CIOs who argue that traditional enterprise IT is evolving as a technical expertise moves deeper into operations than AI assumes more building, configuration, testing, reporting work.

[07:19:00] Sarah Richardson: What happens to central IT? Does it focus more on the cyber component that we just talked about, governance, architecture, value, realization, all things that I have said, and we have all. said for a long period of time. Those are the table stakes of being a really effective CIO today. I'm curious, though, on your perspective, too, though, Elbridge, because it's less about

[07:42:00] Sarah Richardson: IT disappearing and IT's value proposition changing. I mean, yes, infrastructure is important. It's somewhat invisible differentiator really becomes when technology improves access, the experience of financial performance and care. Make no bones about it, though. You still need to keep your infrastructure healthy. You still need to keep your data management

[08:05:00] Sarah Richardson: moving as a program and the democratization of availability of that information. But what else are you seeing as IT's value proposition is changing internally? What are some of the key elements, both in this article, but that you're experiencing out there?

[08:21:00] Elbridge Locklear: So I'll lead with, you know, centralization is not the same as standardization, right? So that's important to know. And some of the comments that they made, you know, truly governance and security and infrastructure still won't need to be managed. It still sits within that IT realm. That's not changing. I totally agree with it.

[08:43:00] Elbridge Locklear: Now, the lines are blurring because now it's becoming a little more distributed as in, you know, now I will, and I've done this too, and I'll just comment on it. So, yeah, you will have people doing development on the data side. So your analytics team can sit. within the operations and be effective, a little more of a federated model. Now, for me and my

[09:05:00] Elbridge Locklear: experience, even when I worked at Navant Health, and it's been over five years, we had a pretty federated model, and Navant is large, so over 19 hospitals. And so what I've been seeing and what others are seeing to be more effective is that those decision makers and those level authority that's needed around technology has to sit close with the operations. And that's okay.

[09:29:00] Elbridge Locklear: It still can be managed, security, data standards. All of that can be managed and have to be common across the environment, but you need a level of governance and understanding. And that's effective. I've seen that be effective.

[09:45:00] Sarah Richardson: Well, and what I appreciate to is how much energy we have spent the business analyst roles or other aspects, business relationship managers, even a lot of your clinical analysts, they get to go in now and spend more time on the workflow redesign, making sure things are safely deployed, user education, adoption, which is huge, can you scale it past

[10:05:00] Sarah Richardson: a pilot? And if the pilot's not successful, are you willing to pull it back off of the shelf or put it back on the shelf? Probably a better way to say it. And the benefit realization, we heard the soundbite, I'm not sure what city it was in the last couple of weeks, where we heard if you can't fix it without AI, you are not going to fix it with AI. So it's back to the beginning of some of the

[10:27:00] Sarah Richardson: things we've always said. You can't automate or put software on top of a crummy process and somehow expect it to be better. So the things that we have literally been sharing and plantificating for years are getting that front row seat because all the acceleration and all these other expectations have to lay on top of those things. And so I'm grateful when we're

[10:46:00] Sarah Richardson: hearing that the traditional role may be disappearing. Well, yes, but to your point, now this ability to standardize effectively and educate across the continuum, Wow, this may be the hallmark moment. You and I have spent probably the greater part of 30 years each pursuing to be true for our industry.

[11:09:00] Elbridge Locklear: It could be. It could be. You know, as we continue to move down this path with the introduction of AI across the board, it would change how the operators work. And in recent experience, introducing AI, the biggest problem we're seeing is where if we've done, we've done, we've done. don't have processes in place. Operators are doing something off the cuff, but they see it's

[11:34:00] Elbridge Locklear: a very administrative burden, but they never documented or standardized it in any kind of way. And when you introduce AI, this is great. It does it all for me. But you can't relinquish that responsibility, right, and say, hey, it's not my problem. It's IT's problem. And you see a lot of that. It's a great benefit that AI can bring to the table, but the accountability still needs to sit with the operator. And that's one of the biggest

[11:57:00] Sarah Richardson: struggles that I've seen. So if you're sitting back in your CIO seat, what are you willing to let go of? What are the things that as this new perspective takes deeper root or maybe an older perspective continues to take root? What are the things that you know you may have to traditionally give up that are probably the fun parts of some of the work we've been doing all these

[12:18:00] Elbridge Locklear: decades? Well, when you think about that, the traditional CIO, and I'll say a little about me too, is knowing everything, managing, controlling. There's a control factor that all CIOs or CDIOs want. It's not so much about that now. We're all technologists, including the operators. And I think

[12:38:00] Elbridge Locklear: I've given up some of this. So I go back to that data and analytics example, or even if you need someone to demonstrate, I can create an agent, right? And I can do really well with that. The perfect person to do it to get the operators to rally around. it is an operator. So I'm definitely okay with that. And I've seen it be effective. And it's

[13:02:00] Elbridge Locklear: necessary to get the others on board. And so I'm comfortable with giving it up that development capability, that creation capability. But often you get the best product when you say, when you say, well, I'm going to work with ABC and finance. They're a financial expert. If we bring their expertise to the table, we'll go over the safeguards.

[13:25:00] Elbridge Locklear: put the guardrails in place, make sure they're familiar with those. And we will have the capability to audit and review. And I think you can get the best product that way. Yeah, I love

[13:35:00] Sarah Richardson: a little sound by it. We also heard about you're going from being a technology operator to an enterprise orchestrator. And that's the responsibility of knowing the operating model and speaking and outcomes rather than uptime. So yeah, giving up control, but creating really that

[13:50:00] Sarah Richardson: distributed knowledge and workforce is really, really key. Well, it leads us perfectly into. the other thing that I found this week, and we've got some perspectives on it, too, about health care having an agentic AI identity problem. This one came from health care IT news. Literally a survey, 250 health care leaders found 28% already have agentic AI in production,

[14:09:00] Sarah Richardson: and another 44% are piloting it. Yet 72% acknowledge that some AI tools or agents have been deployed without formal IT approval. Not a surprise per se. And I think the way we look at this, is becoming materially, shadow AI is becoming materially different from shadow IT.

[14:30:00] Sarah Richardson: Conventional application, you can access data, the agent can retrieve it, API activity, workflows, potentially make decisions across multiple systems. The thing we asked people is, does the organization treat their AI agents as having their own digital identity? What can it access? What can it perform? What authorized it? How quickly can it's access be revoked? And are there

[14:53:00] Sarah Richardson: those running under Elbridge's domain, Sarah's domain, or are they individual non-human employees? We keep hearing the how you lead non-human employees through this new workforce. Do you onboard them? do you do their annual review? Like, how do you engage with non-human employees that are these agentic workflows? Love your thoughts on this one. Yeah, this is, now, there one comment in that

[15:18:00] Elbridge Locklear: article, 86% say they are fairly confident about being able to govern it, right? So I had to make a comment about this. That was surprising because if you don't have an inventory and you're not familiar with the AI, you have some reference point, how do you govern? So that's, I don't know how you do that. I guess that's a stopping point on that, right?

[15:40:00] Elbridge Locklear: So you need to be able to govern, sure, but you need to know what you had. The other side of it is, it's exciting. I've met probably in three different discussions with groups of CIOs, and we were talking about the digital identity. the agents have their own identity. So when you think about that, they have the authority to do certain things? But the question is, do you know what that is? Who is the owner? Who's

[16:04:00] Elbridge Locklear: responsible, right? Who's accountable for what they're doing? And that's the scary part. I look at it very much like I've got an analyst that works in the financial department or finance department, very knowledgeable in finance. They go out and create an agent. I have no knowledge of that agent, but that agent has the authority to do many things, call upon other agents and other skills. So they start out with,

[16:27:00] Elbridge Locklear: I've created an agent to do ABC and finance. But the problem with agents are, they are highly skilled. They can call on other skills. That agent has cybersecurity capability, for example, right? They understand how to work around security restrictions. And that can create a high risk situation for us. I'm not comfortable with that. And I think that's what we have to figure out. You should not be,

[16:52:00] Elbridge Locklear: in my opinion, you should not be just randomly onboarding agents all over with no knowledge of what their capability is or what they have access to or who has ownership or accountability for what they do. And it can't be just IT because we may not have developed those. We may not have built those. But anything that we would build theoretically, you'd want to know why do we need it,

[17:16:00] Elbridge Locklear: what value does it create? What can it actually do? What access levels does it have? So, you think about authentication versus authority, total different things. You can authenticate Elbridge. But the other question is, what authority do I really have? And that takes you down a different path. And who's granted me that authority? We need to treat the agents the same.

[17:40:00] Sarah Richardson: Well, and even the article talks about the AI system autonomously exporting patient information in batches. And you've got these audit logs that have allowed the organization to identify the problem and reinforce observability that has to come before autonomy. You also have to learn how to do that really thoughtfully. And when you build your agents and you're connecting your MCP servers and you're saying, allow it access and yes, and it wants this, you could be clicking things that you may not

[18:04:00] Sarah Richardson: understand the implication. I mean, my goodness, I've connected my agent to all kinds of elements that are external for the purpose of it being more functional. And there's moments and I'm like, what all is it going to be having access to? How can I monitor? what mine is using. Yes, we gave ours, their own names inside of 229, so our agents have

[18:25:00] Sarah Richardson: their own names. But we get to play with it in a pretty controlled environment. I mean, we literally have spent years governing human access to health care data. Access to debting management is a forever thing because people move roles and contractors leave and you've got, you know, admin accounts and all kinds of different things you've got to keep track of. Now we have to do the same for this non-human user. But with even greater attention to what they can do after they gain access.

[18:49:00] Sarah Richardson: So here's my question for you also as we close out this one. Should every AI agent have an identifiable human owner who remains accountable for access, action, exception, outcome? This isn't about being punitive. But if you have agents that report under your structure, what is your responsibility for their action?

[19:08:00] Elbridge Locklear: I think absolutely because, you know, would you invite someone in the chief control's office that has a human being that has a capability, or a similar capability as to control her and they can act on their own. Would you invite something to not have oversight, not be able to monitor, not have that look back and that check? How did things go last week? Did things

[19:32:00] Elbridge Locklear: go well? Do we have any escalations? So that is what you do right now with employees all day long. How is that different with an agent that has similar capabilities as an employee, except they can move at the speed of a machine, unlike employees for human beings? And so absolutely. Well, and what's

[19:51:00] Sarah Richardson: interesting to me, too, is everyone's learning how to do this at the same time. If you walked in today and said, you know, we often ask people in these rooms, on a scale one to five, how comfortable are you having these in-depth conversations about AI and some of these perspectives? And they said, about a five. I'm like, okay, that's why we're here. We're going to make sure that we keep talking about, here's how you set up an agent factory. Here's how you govern and manage an agent factory. Here's how

[20:15:00] Sarah Richardson: how you bring in even third party components and manage them effectively and stay aware of what's happening in your environment. But a lot of this is continual learning. I do believe it's safe to say I don't know all of the answers to some of these pieces. My responsibility as a CIO is to stay up on all of these pieces and bring these ideas forward as quickly as we can. It also means

[20:36:00] Sarah Richardson: setting an appropriate pace inside of the organization. You can still be a pioneer with some of these pioneer models and have safety and security at the front end of what your expectations are because this goes back to what are you clinically willing to permit in your org, what do you financially willing to permit in your org, and then what are you willing to do from just a basic operations

[21:00:00] Sarah Richardson: perspective? And so there are tiered approaches to the impact of what some of these technologies have as well. If you and I are experimenting for fun in the 229 universe with agents, we are not affecting patient care. That is not going to be true if we are still running a hospital.

[21:16:00] Elbridge Locklear: That's right. That's right. And as we go down that path and we start to look at the use of AI across the board, you know, I go back to your access point. When I gave you access to do whatever it might be when you first got onboarded based on certain skill set, least privilege access, I audited what you did. How is that different by introducing this new? And I know no one like

[21:41:00] Elbridge Locklear: to call it tech, but it's not really different. And it has changed. Well, and I'm grateful that both

[21:47:00] Sarah Richardson: AI and resilience tend to be the themes of our current round stable schedule. And so by the time with this airs, we may or may not be sitting in Seattle having this exact conversation with the teams up there. We are headed to Seattle next week. The team wrapped up Atlanta yesterday. And we also have Denver next week. So I am just absolutely thrilled that you are on board with us here at 229, bringing your

[22:10:00] Sarah Richardson: leadership, years of expertise, perspectives, and ability really just to manage the dialogue in a way that is thoughtful so that people can be thinking about maintaining what they need to maintain inside of their environments and knowing that we're going to have that outside view and lens for them to tap into to always be seeking some of the newest perspectives coming out of the industry as well. Albert, thank you so much for joining me on Newsday today. Thank you. It's pleasure.

[22:35:00] Sarah Richardson: And for all of you listening, the next era of healthcare IT may be less about owning every technology and more about creating the conditions in which this distributed innovation can happen safely, measurably, and in service to the organization's mission. Thanks for listening. That's all for now.