Healthcare organizations are adopting AI agents at the same time attackers are becoming more effective at exploiting identity systems. That convergence creates a new cybersecurity problem: AI is no longer only a tool used by clinicians, administrators, or security teams. It is becoming an actor inside the identity environment.

The reported exposure of information tied to roughly 22,500 Hartford HealthCare patients through the Connecticut HUSKY provider portal is not simply another healthcare data breach. It is a case study in the cybersecurity risk created when patient information moves through shared infrastructure controlled by multiple organizations.

The sentencing of three members of an international criminal organization tied to a nearly $2 billion telemedicine healthcare fraud scheme should be read as more than a criminal enforcement milestone. It is a case study in how legitimate healthcare infrastructure can be repurposed when prescribing, pharmacy ownership, claims submission, and remote billing controls fail at the same time.

The federal government’s latest changes to the No Surprises Act are not about reopening the patient protection debate. That debate has largely settled. Patients should not be placed in the middle of surprise out-of-network billing disputes when they had little control over where or by whom care was delivered.