Your Legacy Systems Will Decide Whether Your AI Strategy Works

Most healthcare AI programs will underdeliver and it will have almost nothing to do with the AI.

I have sat in enough rooms with health system and health plan leaders to recognize the pattern. The model demos beautifully. The pilot wins the board over. Then it meets reality, a stack of decades-old applications behind the EHR, claims, billing, portals, call centers and it stalls. The intelligence was never the problem. The plumbing was.

The data tells the same story. In early 2026, Microsoft and The Health Management Academy found 43% of provider executives piloting agentic AI, the autonomous systems now moving beyond chat into real workflow execution. Just 3% had them running live. That’s not a technology gap. It’s an infrastructure gap.

The bill for standing still keeps climbing

We’ve quietly accepted legacy systems as the cost of doing business. A 2023 study estimated that outdated technology at $52,000 per physician per year in lost productivity, with roughly 73% of providers still relying on it. Annoying, but survivable. Right?

Not anymore. Healthcare has been the most expensive industry on earth for a data breach for over a decade straight. IBM’s 2025 report puts the average healthcare breach at $7.42 million, higher than any other sector and these breaches take 279 days on average just to find and contain. The 2024 disruption at Change Healthcare made those stakes impossible to ignore. A single outage interrupted claims and pharmacy transactions nationwide for weeks, affecting an an estimated 192.7 million individuals and leaving many providers dependent on emergency funding while payments stalled.

The lesson isn’t about any one company. It was about how much of the system now rides on platforms that are hard to secure, monitor and upgrade, so the blast radius of a single failure can extend across the entire sector. In an industry where the worst case is a patient harmed, software you can’t readily secure or upgrade isn’t just technical debt. It’s a liability sitting on your balance sheet.

Regulators stopped waiting for you

Here’s what really changed the equation in 2026. You no longer get to choose the timeline for modernization. CMS has effectively set it for you.

The Interoperability and Prior Authorization Final Rule, CMS-0057-F, is now in force for Medicare Advantage, Medicaid, CHIP and exchange plans. Faster prior-authorization rules and metric collection began January 1, 2026. Your first public prior-authorization numbers deadline was March 31, 2026. Four FHIR APIs, covering patient, provider, payer-to-payer and prior authorization, must be live by January 1, 2027. CMS expects the move to save around $15 billion over ten years.

This cannot be achieved by simply layering APIs onto platforms that were never designed for interoperability. Compliance now requires opening your core systems through modern standards. That’s modernization, whatever you choose to call it.

So, stop filing modernization under “IT”

Here’s the challenge to anyone greenlighting another AI initiative this quarter. Before you fund the next pilot, answer one question honestly: can the underlying systems underneath it actually support what you are building?

If the answer is no, then modernization isn’t a competing line item. It is your AI strategy. And it no longer needs to be a multi-year, rip-and-replace ordeal that scared everyone off. Go phased instead: migrate what matters most first, bridge the rest, move to cloud where it pays and aim AI at the modernization work itself to compress the timeline. Across multiple healthcare and life sciences clients, that’s exactly how we put our SASVA™ platform to work.

The winners of the next five years won’t be whoever bought AI first. They’ll be whoever built something AI can actually stand on. If you can’t say with confidence which one you are, that’s the conversation to have now, before the next breach headline or CMS deadline has it for you.

Sources

• IBM, Cost of a Data Breach Report 2025 (healthcare $7.42M, highest of any sector; 279-day average to detect and contain).
• Microsoft and The Health Management Academy, healthcare agentic AI readiness research published in the New England Journal of Medicine, January 2026 (43% piloting; 3% in live workflows).
• CMS, Interoperability and Prior Authorization Final Rule (CMS-0057-F): operational requirements from Jan 1, 2026; first public metrics due Mar 31, 2026; FHIR APIs live by Jan 1, 2027; ~$15B projected savings over 10 years.
• Persistent, Re(AI)magining Legacy Software in Healthcare with an AI-Driven Approach (2025), for the 2023 productivity study, legacy prevalence and SASVA™ figures.