Before a Health System Deploys Agentic AI

What Changes When AI Starts Taking Action

Artificial intelligence in healthcare has largely been used to help people interpret information. It can summarize records, identify patterns, draft communications, and support clinical or administrative decisions.

Agentic AI can go further.

An AI agent may be able to retrieve information from another system, complete a task, submit documentation, schedule an appointment, communicate with a payer, monitor a workflow, or decide that an issue should be escalated to a person.

Once software can take actions inside a healthcare organization, the organization needs clear rules about what it is allowed to do.

That raises practical questions involving authority, patient information, vendor contracts, cybersecurity, regulatory compliance, oversight, and responsibility when something goes wrong.

Where Agentic AI May Show Up First

Administrative operations are an obvious starting point.

An agent could potentially gather information required for prior authorization, complete forms, submit requests, monitor payer responses, and identify when an appeal is needed.

Similar systems could help coordinate referrals, schedule appointments, confirm follow up tasks, or support revenue cycle operations.

These uses may appear lower risk than clinical decision making, but administrative actions can still affect patient care. An incorrect submission can delay treatment. A scheduling mistake can prevent timely follow up. Incorrect information can create reimbursement or compliance problems.

Clinical uses raise the stakes further.

A system could review medical history, laboratory results, medication information, and other records before a visit. It might identify a care gap or monitor information from connected devices and decide when a clinician should be alerted.

At that point, healthcare organizations need to understand where assistance ends and decision making begins.

Start With Authority

Before deployment, organizations should define what the agent is actually allowed to do.

Can it read information? Can it change information? Can it draft a communication? Can it send it? Can it identify a denied claim? Can it submit an appeal? Can it schedule a patient without additional approval?

Each step creates a different level of responsibility.

Some actions may be appropriate for automation. Others may require human approval. Certain activities may need to remain outside the system’s authority entirely.

Those boundaries should be deliberate and documented.

Human Oversight Has to Be Real

Keeping a human involved does not automatically create meaningful oversight.

Organizations should determine when a person enters the process, what information the person receives, whether the reviewer has the necessary expertise, and whether there is enough time for meaningful review.

A person who approves hundreds of automated decisions may eventually treat approval as routine.

Healthcare organizations should decide which actions require review, who is qualified to perform that review, and what happens when the person disagrees with the system.

Where the Legal Issues Show Up

Agentic AI may require broader access to patient data and operational systems than traditional software.

Organizations should know what information the agent can retrieve, which systems it can enter, what credentials it uses, and whether its access changes depending on the task.

HIPAA and other privacy obligations remain relevant. Vendor contracts should also address what can be done with information obtained through the relationship, including whether data can be used to improve models or support services provided to other customers.

Cybersecurity becomes more important when software can act across multiple systems. Organizations should consider permissions, credentials, incident response, and how access can be suspended quickly if something goes wrong.

Contracts should address what actions the agent is permitted to perform, how system changes are communicated, what records are retained, and who is responsible for incorrect or unauthorized actions.

Responsibility Continues After Deployment

Healthcare software operates in an environment that changes constantly. Vendors update products. Electronic health records change. Interfaces are modified. New data sources are added. Security vulnerabilities emerge.

An agent that worked properly when first deployed may behave differently later.

Organizations should determine who is responsible for monitoring those changes.

The vendor may control the software. The health system may control the workflow. A third party may provide an interface. Another company may supply a connected device.

Responsibilities should be clear before an incident occurs.

The agreement should address who monitors updates, who validates significant changes, who investigates problems, and who is responsible for correcting them.

Organizations Need to Be Able to Reconstruct What Happened

If an automated action is challenged, the organization may need to determine what information the agent accessed, what instructions it received, which systems it interacted with, what actions it performed, and whether anyone approved those actions.

That makes auditability important.

Detailed records may be needed for patient safety reviews, compliance investigations, payer disputes, cybersecurity incidents, litigation, and vendor management.

If an organization cannot determine what its own system did, responding to a problem becomes much more difficult.

What Executives Should Review Before Deployment

Before giving an AI agent authority to act, healthcare organizations should be able to answer a few basic questions:

1. What actions can the system perform?

2. Which actions require human approval?

3. What information can it access?

4. Which systems can it enter or change?

5. Who reviews information submitted outside the organization?

6. Who is responsible when an automated action is wrong?

7. Can the organization reconstruct what the system did?

8. Who monitors the technology after deployment?

9. How are software updates and changes evaluated?

10. Do existing contracts address the responsibilities created by automated action?

Agentic AI may remove significant amounts of administrative work from healthcare and improve coordination across fragmented systems.

Those benefits depend in part on whether organizations put appropriate controls around the technology before relying on it.

Software that can act requires more than an accuracy review.

Healthcare organizations need to know what it can do, who is watching it, and who is responsible for the result.

How Lanton, Lanton & Sosa Law Can Help

Lanton, Lanton & Sosa Law advises healthcare and life sciences organizations on regulatory compliance, technology contracting, data governance, healthcare operations, cybersecurity, and emerging issues involving artificial intelligence.

Organizations evaluating agentic AI may need to review vendor agreements, data rights, privacy obligations, cybersecurity responsibilities, approval procedures, audit requirements, liability provisions, and the regulatory requirements associated with particular uses of the technology.

Reviewing those issues before deployment can help an organization determine whether its legal and operational controls are keeping pace with the authority it is giving the software.

Health Law Questions Healthcare Leaders Are Facing Now

The Massachusetts Bar Association’s Health Law Section will hold its annual conference on Thursday, October 8, from 12:30 to 5:30 p.m. I’ll be participating as one of the speakers, with the discussion focused on the legal and practical issues healthcare organizations are facing now.

The program will cover PBM reform, reproductive justice, medical autonomy, reimbursement, and artificial intelligence in healthcare.

They may be listed as separate topics, but healthcare organizations often have to deal with them at the same time.

A reimbursement rule can affect whether a patient receives care. PBM policies can change how pharmacies and providers operate. New technology can raise questions about privacy, responsibility, reimbursement, and professional judgment. Political and regulatory decisions can affect how organizations plan and invest.

The common thread is practical risk. Healthcare leaders have to understand not only what a rule says, but how it will affect operations, patient care, employees, and business decisions.

Artificial intelligence makes that challenge more immediate. Healthcare organizations are adopting tools for research, administration, diagnosis, and communication, often before the legal and regulatory expectations are fully settled. That makes oversight, documentation, privacy, and accountability important questions to address early.

The conference will bring together healthcare attorneys and other professionals to discuss these issues in a practical setting. I’m looking forward to joining the other speakers and contributing to the conversation.

The event will be held in person at the Massachusetts Bar Association. Registration is available through the Massachusetts Bar Association’s Health Law Section.

This article is for general educational purposes only and does not constitute legal advice. Healthcare law depends on the specific facts and applicable law. Organizations should consult qualified counsel regarding their circumstances.

FDA Extends Certain DSCSA Exemptions for Small Pharmacies: What the Additional Year Means

The Food and Drug Administration has given qualifying small pharmacies another year to implement certain enhanced drug distribution security requirements under the Drug Supply Chain Security Act.

On August 6, 2026, FDA announced that small dispensers, along with their trading partners where applicable, will receive exemptions from certain requirements through November 27, 2027. The prior exemption period was scheduled to end on November 27, 2026.

For independent and community pharmacies still working through technology, data exchange, staffing, and trading partner challenges, the additional year is meaningful. It is not, however, a suspension of DSCSA compliance.

The exemption applies only to specific enhanced drug distribution security requirements. Other DSCSA responsibilities remain in effect, and FDA is continuing to urge small dispensers to make progress toward full implementation.

Which Pharmacies Qualify?

For purposes of the new exemptions, FDA considers a dispenser to be a small dispenser if the company that owns the dispenser has 25 or fewer full time employees who are licensed pharmacists or qualified pharmacy technicians as of November 27, 2026.

This means the analysis is based on the company that owns the pharmacy, not necessarily the employee count at one individual pharmacy location. Organizations operating multiple locations should therefore examine their ownership structure and total number of qualifying employees before concluding that the exemption applies.

Qualifying small dispensers do not need to submit an application or notify FDA to use the exemption. A pharmacy should still document its eligibility internally and be prepared to explain the basis for relying on it.

What Has Been Extended?

The exemptions apply to certain enhanced security requirements involving interoperable, electronic, package level product tracing.

During the exemption period, qualifying small dispensers and, where applicable, their trading partners may continue using existing methods for certain activities that would otherwise require fully interoperable electronic systems. These include aspects of:

• Exchanging transaction information and transaction statements electronically

• Including package level product identifiers in transaction information

• Conducting product verification at the package level

• Responding to government requests for transaction information during recalls or investigations

• Gathering transaction information back through the supply chain

• Processing certain saleable returns

The exemption also covers specific product identifier verification requirements when a qualifying pharmacy investigates suspect or illegitimate products. It does not eliminate the pharmacy’s other investigation and verification responsibilities.

What the Exemption Does Not Cover

The extension should not be treated as a general waiver from DSCSA.

Pharmacies must still purchase prescription drugs from authorized trading partners. They must maintain applicable transaction records, identify and investigate suspect products, quarantine products when appropriate, and notify FDA and relevant trading partners when illegitimate products are discovered.

Pharmacies must also maintain policies and procedures that allow employees to recognize and respond to products that may be counterfeit, diverted, stolen, adulterated, or otherwise unfit for distribution.

The additional year changes the timeline for certain enhanced electronic requirements. It does not erase the underlying obligation to protect the integrity of the drug supply chain.

Why FDA Granted More Time

FDA granted the additional exemption while an independent assessment examines whether small dispensers can feasibly implement interoperable, electronic tracing at the package level.

That assessment will evaluate the technology and software available to small pharmacies, including whether existing systems are accessible, functional, and economically feasible. FDA is encouraging small dispensers to complete its assessment survey by September 22, 2026. A small dispenser may designate another organization, such as a consultant, to complete the survey on its behalf.

The survey gives independent pharmacies an opportunity to document the practical difficulties they encounter, including system costs, integration problems, staffing limitations, data quality issues, and dependencies on wholesalers or technology vendors.

How Pharmacies Should Use the Additional Year

The safest approach is to treat the extension as an implementation period, not a waiting period.

A pharmacy relying on the exemption should first document why it qualifies. That documentation should identify the ownership entity, the relevant employee count, and the methodology used to determine which employees are included.

The pharmacy should then evaluate its current DSCSA capabilities. This includes confirming whether it can receive and retrieve transaction information, identify its authorized trading partners, investigate suspect products, quarantine inventory, respond to information requests, and preserve the required records.

Pharmacies should also speak with their wholesalers, buying groups, and technology providers. A pharmacy may qualify for an exemption while one or more of its trading partners operate under different requirements. Understanding how each party will transmit, receive, store, and retrieve information can help prevent purchasing disruptions and inventory delays.

Written policies should reflect what the pharmacy is actually doing today. Employees responsible for purchasing, receiving, returns, inventory management, and product investigations should understand those procedures and know when a problem must be escalated.

Finally, pharmacies should keep records of their implementation efforts. Contracts, vendor communications, training records, system testing, written procedures, corrective actions, and internal assessments can help demonstrate that the pharmacy used the exemption period responsibly.

The Legal and Operational Risk Has Not Disappeared

DSCSA compliance is not solely a technology project. It involves vendor contracts, licensing, purchasing controls, record retention, employee training, product investigations, and relationships with trading partners.

A pharmacy that waits until the exemption is about to expire may discover that its software cannot communicate effectively with a wholesaler, its transaction data cannot be retrieved promptly, or its written policies no longer reflect its operations. Those problems can affect more than regulatory compliance. They can interrupt purchasing, delay returns, create audit exposure, and ultimately affect patient access.

FDA’s extension gives qualifying small pharmacies valuable time to address those risks. The best use of that time is to build a compliance program that is both operationally workable and legally defensible.

Lanton, Lanton & Sosa Law PLLC advises pharmacies, healthcare organizations, and other regulated businesses on compliance, contracting, audits, licensing, reimbursement, and operational risk. Organizations evaluating the DSCSA exemption should assess both their eligibility and the steps necessary to reach full compliance before the exemption ends.

This article is provided for general informational purposes and does not constitute legal advice.

Mergers and Acquisitions Are Not About the Deal

Most M&A conversations begin with momentum. A buyer is interested, a seller is ready, the valuation makes sense, and the timeline is moving. From the outside, it looks like progress. What is actually happening is a change in direction. There is a moment in these deals that does not get enough attention, when everything still looks clean on paper. Then one question shifts the conversation. What actually changes the day after this closes? Not in theory, in practice. Contracts start to behave differently under new ownership. Revenue that felt stable begins to depend on relationships that may not carry over the way everyone expected. Regulatory exposure shows up in places that were easy to overlook when everything was still in a data room.

That is usually where the pace slows, not because the deal is wrong, but because something important has not been fully seen yet. Most deals close. Fewer hold together the way they were expected to. The issues tend to surface later, when a contract does not perform the way it was assumed or when a regulatory requirement becomes operational instead of theoretical. By then, the deal is already done and the room to adjust is smaller.

The work I focus on now starts earlier. It begins with understanding how the business actually functions before the deal takes shape, where revenue is coming from, how it is protected, and where the pressure points are. That perspective changes the outcome. The deal becomes something the business can actually operate inside of after it is done. Mergers and acquisitions are inflection points where capital, regulation, and operations all meet at once. When those elements are aligned, the business moves forward with clarity. When they are not, the friction shows up over time.

Most businesses do not need more deal activity. They need a clearer view of what happens after they move. That conversation usually starts earlier than people expect.