The Real Question Is Governance, Not Technology – How Health System Data Governance Determines Your AI Strategy

Two Poles on the Healthcare AI Governance Spectrum: Epic vs Oracle

The question resolves on a spectrum, not as a binary. Most real health systems will end up somewhere in between, with some decisions held by the vendor, some held by the hospital, many shared, and many transitional. The strategic question is which pole your architecture defaults to when no one is actively making a call. The two poles are worth laying out.

The vendor-anchored pole. Epic’s “Partners and Pals” program sits closer to this end of the spectrum. Epic chooses which third parties get Pal status, which get Partner designation, and which sit under Connection Hub as general listings. At UGM 2025, Epic unveiled its own first-party agents (Emmie in MyChart, Art for clinicians, Penny for revenue cycle), alongside what Epic introduced as Cosmos AI, now described publicly as Curiosity, a family of foundation models trained on deidentified records in Cosmos. Epic’s Showroom exposes the integration layer on relatively open terms, with hundreds of third-party apps and a substantial number of no-cost APIs available on the platform. Integration is genuinely accessible. What Epic holds tighter is the governance layer for first-party agents and the deepest workflow paths. Front-of-line placement, deep workflow integration, and access to the native data model run through Epic’s own orchestration. The hospital influences. At the deepest part of the stack, it does not fully decide.

This is consistent with Epic’s long-running operating philosophy, codified in the company’s “10 Commandments” as do not acquire or be acquired. Judy Faulkner has been explicit for years that integration is Epic’s strategic asset and that acquisition-plus-interface architectures dilute it. From Epic’s perspective, holding the governance layer at the deepest part of the stack is not a flaw. It is the operating model.

In March 2026, Epic announced Agent Factory at HIMSS 2026, a no-code visual builder that lets health systems design, orchestrate, and monitor AI agents inside the Epic environment, alongside Curiosity, a new family of foundation models trained on deidentified records in Cosmos. That is a real expansion of what hospitals can build. The distinction that matters for this argument: the shift from “Epic builds the agents” to “hospitals build agents inside Epic” is not the same as “hospitals govern agents that span beyond Epic.” I could not verify any public Epic documentation describing Agent Factory as supporting open agent-interoperability standards like the Model Context Protocol or Agent2Agent that Microsoft, Salesforce, AWS, and Oracle are participating in. Based on what is publicly documented today, Agent Factory does not deliver that second shift. Several analyst reads frame it as Epic claiming the orchestration layer for healthcare AI, which is consistent with the vendor-anchored posture, not a departure from it. Oracle used the same HIMSS moment to make the opposite case. HIMSS 2026 did not settle the architecture debate. It made the strategic contrast easier to see.

The institution-anchored pole. Oracle Health’s OCI-native EHR, launched in 2025 for ambulatory use, is built on the opposite premise. Seema Verma described it as “an entirely new EHR, built in the cloud for the Agentic AI era,” with explicit support for customers extending Oracle’s agents, building their own, or integrating third-party models. The architectural claim is that the patient record lives in a model-agnostic cloud data platform (Oracle Health Data Intelligence, or OHDI), with the EHR application sitting on top as one consumer of that data rather than the owner of it. Larry Ellison has framed Oracle’s healthcare strategy around consolidating patient data into a single patient-centric record, rather than leaving it spread across dozens of hospital-centric databases. Oracle’s follow-on product, the AI Database 26ai, folds agentic AI, vector search, analytics, and app development into the database itself, rather than leaving those capabilities in a separate application tier.

A fair amount of that paragraph is Oracle’s own positioning. The product launches and integration patterns are real. Whether the institution-anchored architecture delivers on its promise at scale across the provider market is still an open question. The reason this matters for the argument is not that Oracle has already won. It’s that Oracle is offering a structurally different governance posture, and that posture maps to where the institutional incentive is heading.

In that posture, the governance decision sits where it would naturally sit in any other part of the enterprise. With the CIO, the CMIO, the compliance office, and the governance committee. The hospital is positioned to decide more of what runs, under which controls, and against which slices of the data. The vendor supplies the platform. The institution supplies the judgment.

These are two structurally different bets on what a 2030 health system IT stack should look like.

Why the Falling Technical Floor for AI Agents Forces the Governance Question

The reason this matters now is that the technical barrier to building a clinically useful AI agent is collapsing. The floor has dropped by roughly one organizational layer every decade: what required a data warehouse team in 2005 required a SQL-literate analyst in 2015, and a generative prompt in 2025. The same trajectory is now playing out for AI agents in healthcare. A production clinical agent today requires an ML engineering team, access to training data, integration work against a clinical system, and a validation process. My expectation is that within three to five years, the combination of foundation models, low-code agent platforms, and standardized clinical data APIs will put a clinically trained staff member in a position to configure a workflow-specific agent against the hospital’s own data in days rather than quarters. That is a forecast on my part, not a guarantee. But the trajectory looks credible.

When agent construction is hard, depending on a vendor to do it for you is rational. Epic’s “we’ll ship the agents, you use them” model is reasonable in 2026 because most health systems cannot meaningfully build their own. When agent construction gets easy, that calculation flips. The hospital-built agent will fit the hospital’s workflow better than any vendor’s one-size-fits-all shipped product. At that point, I think Emmie, Art, and Penny end up looking less like a moat and more like a floor. Useful, widely adopted, but no longer a differentiating capability.

The binding question in that world is not how good is the vendor’s agent? It is who governs the dozens of agents your clinicians and analysts are now capable of building? That question lives in the data platform and the governance architecture, not the application.

Epic’s first-party agent strategy is a reasonable bet for today’s buyer, and I want to be clear about that. Where I land, looking forward, is that it reads more like a stopgap than a durable moat. That is a forecast, not a settled outcome.

Architectural Posture, Not Code Quality: The Strategic Read for Health System CIOs

The strategic read the evidence supports:

Oracle is betting on a more hospital-controlled data and agent layer. Epic is betting on a more vendor-governed integrated stack.

That is a description of two strategic postures, not a finished verdict on either one. It is also about architectural posture, not code quality. Epic’s clinical workflow design is one of the strongest in the industry. Hyperdrive performs. Chronicles is a capable purpose-built clinical data store. The documentation, training infrastructure, research community, and user group culture are organizational assets most competitors cannot match. Epic earned its position by executing better than anyone else on what EHR customers actually cared about for twenty years.

What has changed is the institutional incentive. For a long time, hospitals were content to let the integration vendor hold the governance decision because they lacked the capability or the strategic motive to want it back. In 2026, increasingly, they have both. The binding question is shifting from how good is our clinical workflow software to how well can we govern the dozens of AI agents our own clinicians will be able to build. In client conversations at Abundant, most health system leaders recognize this shift is happening. Far fewer have built an explicit architectural response to it.

If your governance architecture is operating closer to one pole than the other by default, it is worth knowing which one.

What’s next in the series

There is a pattern underneath this argument that extends well beyond healthcare. In every enterprise data category over the last fifteen years, an incumbent application vendor tried to hold customers inside a vertically integrated stack, and an open-platform competitor won the data and analytics layer. Epic’s current posture rhymes with the bet those incumbents made.

The objection I hear most often: “That may hold in generic enterprise tech, but healthcare is different. Healthcare is slow. Give it twenty-five years, not five.” I take that seriously. It has real historical evidence behind it. Next week I take it apart. If you found yourself nodding at the governance reframe but skeptical of the timeline, that’s the post to read.

Ryan Kent is the founder of Abundant Healthcare Strategies, a healthcare IT advisory firm.