Blogs

Insights from Joshua Howell, Healthcare CTO at Rubrik

Tell us about Rubrik and your role there.

Rubrik is a security and AI operations company focused on helping organizations recover quickly when cyber incidents occur. While cybersecurity has traditionally emphasized prevention, resilience is about ensuring organizations can restore operations when something inevitably goes wrong.

As Healthcare CTO, I work with health systems around the world to understand the challenges they're facing, share best practices across the industry, and help shape Rubrik's product strategy based on real-world customer needs. I also work closely with healthcare organizations, technology partners and industry groups to advance cyber resilience across the healthcare ecosystem.

AI adoption is accelerating across healthcare. What new challenges does that create for health systems?

Healthcare organizations are under tremendous pressure to adopt AI because of its potential to improve efficiency and patient care. But as adoption accelerates, governance becomes increasingly important.

One challenge we're seeing is a lack of visibility. Many organizations don't have a complete picture of what AI models or agents are being deployed, what data they're accessing, or what actions they're taking. We've spoken with health systems that believed they had only a handful of AI applications in production, only to discover they had more than one hundred.

At the same time, AI is changing the cybersecurity landscape itself. Attackers are using AI to accelerate attacks and create increasingly convincing phishing attempts, reducing the amount of time defenders have to respond. Healthcare organizations need governance that provides visibility into how AI systems are being used while ensuring they remain secure, reliable and operating within appropriate guardrails.

Why is AI governance becoming such an important priority for healthcare organizations?

Governance is the conversation happening everywhere right now. Healthcare organizations want to know what AI systems exist across their enterprise, what credentials they're using, what data they're accessing, and whether they're operating within their intended purpose.

Just as importantly, organizations need to be prepared for when something doesn't go as planned. AI can operate at incredible speed, which means failures can also happen very quickly. If an AI system changes data, produces inaccurate information, or behaves unexpectedly, organizations need to understand exactly what happened and restore trusted information as quickly as possible. We can’t simplify good governance as oversight. Instead, we need to look at how we give organizations the visibility and tools they need to confidently deploy AI while maintaining trust.

How do you think about resilience alongside responsible AI adoption?

Resilience starts with recognizing that no technology is perfect. AI has enormous potential to improve healthcare, but it also introduces new dependencies that organizations must be prepared to manage.

As AI becomes embedded in more clinical and operational workflows, organizations need to think through what happens if those systems become unavailable or produce unexpected results. The goal is to promote innovation in a way that ensures healthcare organizations can continue delivering safe patient care even when technology encounters problems.

The key to building resilience is understanding which systems are critical, monitoring how AI is interacting with data, and having processes in place to quickly recover if something goes wrong. Those capabilities ultimately help organizations adopt AI with greater confidence.

Many organizations have traditionally focused on preventing cyber incidents. Why is recovery becoming equally important?

Healthcare has long understood the value of prevention in clinical care, and cybersecurity has historically focused heavily on preventing attacks. But today's reality is that organizations need both prevention and recovery.

Cyberattacks against healthcare continue to increase, and the question is increasingly not if an organization will experience an incident, but when. Even the strongest defenses cannot eliminate every risk. That means organizations need to invest in recovery capabilities that allow them to restore systems quickly and confidently. Prevention remains essential, but resilience ensures healthcare organizations can continue delivering care when prevention alone isn't enough.

What motivated Rubrik to join CHAI?

Our team believed CHAI would play an important role in developing governance frameworks and best practices for AI. As we saw CHAI bringing together the right stakeholders to help shape responsible AI adoption in healthcare, we knew we wanted to be part of those conversations early.

Healthcare AI is evolving incredibly quickly, and participating alongside providers, technology companies and other experts gives us a much better understanding of what healthcare organizations need. For us, joining CHAI is an opportunity both to learn from the community and contribute our expertise in resilience and cybersecurity.

What are you most excited to contribute as a CHAI member?

One perspective we hope to bring is the operational side of AI governance. Many of the people who will ultimately be responsible for managing AI systems won't be AI researchers or model developers. They'll be IT and infrastructure teams responsible for monitoring systems, protecting data, maintaining uptime and responding when problems occur.

Above all, we want to help ensure governance frameworks are practical and implementable for those teams. By helping translate responsible AI principles into operational practices that healthcare organizations can realistically adopt, we hope to contribute to AI that is not only innovative, but also trustworthy, resilient and sustainable at scale.