Post 1 of 4 in The Narrowing EMR series.
KEY TAKEAWAYS
- The EHR remains the clinical system of record for most health systems, but it is no longer sufficient as the center of strategic IT decision-making in an unstable operating environment.
- Three forces converged in the 2025–2030 window: value-based care model shifts, generative AI lowering the technical floor for agent-building, and interoperability rules and exchange frameworks (including CMS–0057-F and TEFCA) pushing clinical data toward more open exchange.
- 31.5% of US hospitals deployed generative AI inside their EHR by end of 2024, with 24.7% planning deployment within 12 months — two distinct adoption cohorts are forming.
- Digital leaders are distinguished not by their EHR choice but by whether they have built formal governance architecture for data and AI as an organizational capability.
- Information blocking civil monetary penalties of up to $1M per violation are active since September 2023; regulators reinforced enforcement posture in October 2025.
- The ‘vanilla stack, vanilla performance’ risk: health systems configured identically to peers cannot differentiate workflows or accelerate AI deployment in a market where those capabilities are becoming the competitive fault line.
For twenty-five years, the received wisdom in health system IT strategy has been simple. Pick the dominant EHR vendor. Run it well. Consolidate around their platform. Ignore the noise. The safety of that bet came from environmental stability. Regulatory rules moved slowly, clinical workflows evolved incrementally, technology choices had long half-lives, and the winning playbook was operational excellence on a mature stack.
In 2026, that playbook has become the riskiest strategic bet a health system can make.
I want to be precise about the claim. I’m not arguing that Epic or Oracle is the wrong call for the clinical system of record. Those decisions remain reasonable for most organizations. What I’m arguing is that the EHR should no longer sit at the center of a health system’s strategic IT decisions. For a generation it did, and that was the right call. For the next decade it will not, and continuing to treat it that way is the single biggest source of strategic risk most CIOs and CMIOs are carrying into their 2026–2030 planning.
This is the first post in a four-part series making that case. Before the structural argument, I want to start with the evidence already visible inside healthcare.
Why “safe” used to be safe
The historical case for EHR consolidation was earned, not inherited. Between 2005 and 2020, health systems that standardized on a single dominant EHR outperformed peers on most of the metrics that mattered. Clinician training costs dropped. Implementation predictability improved. Upgrade cadence became manageable. Interoperability within the enterprise got easier. Operational reliability came from running what everyone else was running.
Judy Faulkner’s “do not acquire or be acquired” commandment codified that approach explicitly. The integrated, comprehensive record was a product of deliberate vertical integration, not a side effect of it. In a stable environment, that integration was a competitive asset for Epic and an operational asset for every Epic customer.
That strategy worked because the environment was stable. Reimbursement models were predictable. Regulatory interfaces moved slowly. The competitive set was the health system across town. The winning playbook was execution, not strategic repositioning.
The environment is no longer stable.
What changed in Healthcare IT Strategy: Three Converging Forces
Three forces have converged on the 2025–2030 window. Each is independently sufficient to move the locus of strategic competition off the EHR application tier. Together, they make the move close to inevitable.
Value-based care and alternative payment models are reshaping the revenue base. CMS risk arrangements, Medicare Advantage expansion, direct-to-employer contracting, hospital-at-home, and ambulatory migration are pulling revenue off its historical rails. The health system of 2033 will not have the same revenue mix, patient flows, or competitive set it has today. Whatever sits at the center of a health system’s IT strategy through that transition has to be flexible enough to reconfigure with the business model. A vertically integrated clinical application is not optimized for that kind of flexibility. It was optimized for consistency.
The combination of generative AI, tool-calling frameworks, and low-code platforms has lowered the technical barrier to building workflow-specific agents. Between late 2023 and early 2026, the capability to build an AI agent that operates on structured clinical data has moved from “requires a data science team” to “requires a clinically-trained end user with a low-code platform.” Within the next three to five years that floor drops further. When the technical barrier falls, the binding question stops being which vendor’s agent is best? and becomes who governs the agents your staff will build? That question lives at the data layer, not the application layer. I’ll come back to it in Post 2.
Regulatory pressure is forcing clinical data open. TEFCA is operational, with eleven designated QHINs exchanging more than 889 million documents across more than 21,000 participating organizations. CMS-0057-F requires FHIR APIs for Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization by January 2027. Information blocking civil monetary penalties of up to $1 million per violation have been in force at HHS-OIG since September 1, 2023, and OIG and ASTP issued a joint enforcement alert in October 2025 reinforcing that posture. The regulatory direction is unambiguous. Clinical data is a patient asset the provider is obligated to make flow, not a vendor asset the provider rents.
None of these forces is speculative, and all three pull in the same direction. The EHR consolidates its strategic value in clinical workflow execution; the analytics, AI, population health, and revenue optimization work moves to an organization-controlled platform.
The Gap Between Digital Leaders and Laggards Is Already Widening
There’s a bigger historical pattern here. Every enterprise data category over the last fifteen years has followed roughly the same shape I’m describing for healthcare, and I’ll take that argument apart in Post 3 where the “healthcare is different” objection gets the serious treatment it deserves. But I don’t need the cross-industry evidence to make the case here. The data inside healthcare is already strong enough.
The gap between digital leaders and laggards in healthcare is widening. And the dividing line isn’t which EHR they run. It’s whether they’ve built formal governance architecture around their data and AI strategy, independent of their EHR vendor.
The CHIME-KLAS Digital Health Most Wired 2025 report documented that health systems with formal governance structures (cross-functional committees, clear ownership, measurable KPIs) outperformed peers “by wide margins” on patient-engagement adoption, utilization, and satisfaction. As one recap of the findings put it, governance, interoperability, and training are the true drivers of digital maturity. That finding didn’t hinge on whether the organization ran Epic or Oracle or Meditech. It hinged on whether the organization had built a deliberate governance architecture around its AI and data decisions as organizational capability, not delegated it to a vendor.
The deployment data tells the same story from a different angle. JAMA Network Open reported in December 2025 that across 2,174 nonfederal US hospitals, 31.5% had deployed generative AI inside their EHR by the end of 2024, with another 24.7% planning deployment within twelve months, and 43.7% classified as delayed adopters. That’s not a single adoption curve with everyone moving together. It’s two groups forming: a majority already in motion, and a shrinking cohort still on the sidelines.
The organizations in motion are not distinguished by their EHR choice. They’re distinguished by what they built around it. Mayo Clinic’s enterprise search and generative AI collaboration with Google Cloud, reflecting Mayo’s effort to build AI and search capabilities across data sources that extend beyond the EHR. Kaiser Permanente’s longitudinal research data infrastructure. Intermountain’s AI Center to govern ethical deployment across the enterprise. Northwell’s ambient AI deployment across 28 hospitals with Abridge. These are organizations that treated their data and AI layer as a strategic asset, built as an organizational capability, not as a vendor-provided feature.
The organizations on the sidelines are not behind on Epic or Oracle. Most of them run Epic at the same level of operational maturity as the leaders do. What they’re behind on is what sits around the EHR. That gap is what’s widening every quarter.
Why EHR-First Strategies Stopped Being the Safe Bet in Healthcare IT
Safety is context-dependent. In a stable environment, integrating around a single dominant vendor is the low-variance path. You trade optionality for execution certainty, and in a stable world, that trade is correct.
The trade inverts when the operating environment is in motion. A 2026 health system is in motion on three fronts at once. Reimbursement is shifting toward value-based care and at-risk arrangements that reward outcomes and efficiency rather than volume. Care delivery is shifting with it, out of the hospital and into the home, through remote patient monitoring, hospital-at-home programs, connected IoT devices, and continuous personal health data streams that didn’t exist in the workflow five years ago. And the competitive set has expanded beyond the health system across town. Amazon’s One Medical footprint, payer-owned primary care (Oak Street, ChenMed), and a growing roster of tech-enabled entrants are all competing for the same patients on a different operational model. You can’t respond to any of those shifts on a stack optimized for stability.
That’s where “vanilla stack, vanilla performance” becomes the operational risk. A system configured exactly the way every other Epic or Oracle customer is configured will perform roughly the way every other Epic or Oracle customer performs. In a stable market, that’s a floor you can accept. In a market where differentiated workflows, faster AI deployment cycles, and reconfigured care models are becoming the competitive fault line, matching the median is a losing position.
The “safe” choice is only safe when the environment isn’t moving. In 2026, the environment is moving faster than it has in twenty-five years. Staying on the vanilla stack isn’t a hedge against that change. It’s a bet that the change won’t matter to you. For most health systems, that bet is going to lose.
What’s coming in the series
Post 2 takes on the binding question behind the laggard gap, and it’s not a technology question. Post 3 takes the “healthcare is different, healthcare is slow” objection apart directly, because I know it’s coming. Post 4 closes with prescription: what a CIO, CMIO, or CTO should actually be doing with all of this between now and 2030.
For now, the inversion stated plainly: the received wisdom that consolidating on the dominant EHR vendor is the safe strategic play was correct in a stable environment. The environment is no longer stable. And the health systems that still treat the EHR as the center of their strategic IT decisions are, in 2026, the ones carrying the most strategic risk.
Continue Reading
This article is part of our four-part series.
Frequently Asked Questions
It means treating the EHR as the system of record for clinical workflow execution – which it does well – while building a separate, organization-controlled layer for data governance, analytics, AI deployment, and population health. The EHR remains essential; the argument is about what sits at the strategic center, not whether the EHR should exist. Health systems that have made this shift (Mayo Clinic, Kaiser Permanente, Intermountain, Northwell) are distinguished by formal governance architecture for their data and AI decisions, not by replacing their EHR.
Healthcare data governance is the set of policies, ownership structures, and accountability mechanisms that determine how clinical and operational data is collected, stored, accessed, and used across an organization. It matters for AI strategy because generative AI tools (whether EHR-embedded or third-party) operate on data, and the quality, accessibility, and control of that data determines what AI can actually do. The CHIME-KLAS Digital Health Most Wired 2025 findings confirm that formal governance structures (cross-functional committees, clear ownership, measurable KPIs) are the primary differentiator between digital leaders and laggards, more so than EHR choice.
TEFCA (Trusted Exchange Framework and Common Agreement) is the federal framework for nationwide health information exchange, operated by the Sequoia Project as the Recognized Coordinating Entity (RCE). As of 2026, eleven Qualified Health Information Networks (QHINs) are exchanging more than 889 million documents across 21,000+ participating organizations. TEFCA participation is currently voluntary for most providers. The broader regulatory direction is clearly toward more standardized, interoperable data exchange, but that is not the same as TEFCA itself becoming mandatory. Separately, CMS–0057-F does impose specific API requirements on impacted payers beginning in 2027.
Information blocking is any practice by a healthcare provider, health IT developer, or health information network that interferes with the access, exchange, or use of electronic health information (EHI),unless a recognized regulatory exception applies. Civil monetary penalties of up to $1 million per violation have been in force at HHS-OIG since September 1, 2023. OIG and ASTP (formerly ONC) issued a joint enforcement alert in October 2025 reinforcing that posture. Common examples include technical barriers to data export, contract terms that restrict interoperability, and workflows designed to limit patient data access.
Value-based care shifts reimbursement from volume (fee-for-service) to outcomes and efficiency (risk arrangements, Medicare Advantage, direct-to-employer contracting). That shift demands IT capabilities the EHR was not designed to provide at scale: population health analytics, risk stratification, longitudinal patient tracking outside acute episodes, and revenue optimization across alternative payment models. A vertically integrated EHR stack optimized for in-hospital workflow documentation is not reconfigurable fast enough to match an organization’s changing revenue model. The data and analytics layer — which must be organization-controlled, not vendor-locked — is where value-based care strategy gets executed.
About the Author
Ryan Kent is the founder of Abundant Healthcare Strategies, a healthcare IT advisory firm that helps health systems navigate strategic IT decisions, digital transformation, and AI governance. With over 10 years in healthcare IT consulting, Ryan works with CIOs, CMIOs, and CTOs at health systems navigating the transition from EHR-centric IT strategy to organization-controlled data and AI architecture. The Narrowing EMR series reflects his ongoing advisory work with health systems planning their 2026–2030 technology strategy.