For IT leaders, every risk decision shapes the organization’s future. Innovation can drive efficiency and improve outcomes, but security and operational stability remain essential. Today, rural hospitals increasingly rely on AI to stabilize operations, reduce administrative burdens and extend care, without requiring large, costly IT investments.¹
IT executives can learn from the efforts of rural health organizations like Cherry County Hospital. In a 21-bed facility serving a town of 3,000 in Nebraska, tight margins make every technology decision count. Chief Information and Security Officer Phillip Mues must demonstrate a clear return on investment to the board while aligning IT strategy with both budget and mission. As a leader within the health information systems division of Solventum (formerly 3M Health Care), I was eager to talk with Phillip about how he makes these high-stakes technology decisions, his organization’s experience using our ambient documentation solution and the lessons he’s learned along the way.
Lesson 1: Outsource with caution
For lean teams in rural communities, outsourcing can offer operational efficiencies, while also introducing hidden costs, dependencies and vulnerabilities, as Cherry County discovered.
When its third-party medical dictation vendor was struck by a ransomware attack, Cherry County was left at the back of the support and restoration queue. Similarly, a radiology over-read partner experienced a cybersecurity breach, causing service interruptions that delayed clinical workflows and directly impacted patient care.
These incidents highlight the importance of evaluating third-party risk, cybersecurity posture and contingency planning when relying on external partners for mission-critical clinical and operational services.
Phillip’s experiences at Cherry County illustrate why IT leaders must understand their organization’s risk tolerance and ask detailed questions about vendor security practices, including alignment with frameworks such as the NIST Cybersecurity Framework and independent audit reports like SOC 2 Type II. They also underscore the importance of reviewing disaster‑recovery models, especially as cybersecurity incidents become more common. Equally important in these situations are in-house IT staff who have “skin in the game.” These staff who know your systems intimately can respond quickly, safeguard daily operations and mitigate risks before they escalate.
Lesson 2: Balance internal expertise and AI capabilities
Rather than relying on outsourcing to make efficiency gains, healthcare organizations can consider time-saving AI tools that serve as capacity multipliers. These solutions should fit workflows and extend staff abilities, never adding complexity for its own sake.
For instance, Cherry County worked with us at Solventum to deploy our ambient documentation solution that frees clinicians from administrative clinical documentation tasks and gives them time back to focus on patients. In small hospitals, those minutes really add up and truly make a difference for staff and patients. According to Phillip, clinicians at Cherry County say these solutions capture more detail than ever. The key is including all clinically relevant points while intentionally leaving out less important information. When clinicians trust generative AI’s accuracy, they can focus more on patients and complex tasks.
This shift brings clinicians back to what matters most. The health system benefits because they can devote attention to patient conversations, not just data entry. The positive effects of complete and accurate documentation ripple out to the rest of the organization, supporting efficient care delivery, payment integrity and fair quality measurement.
So, how to choose a technology vendor? Phillip recommends seeking partners who treat your organization as more than just an account and who prioritize reliability, security and collaboration. In his experience, the right partner is pragmatic, listens and delivers real solutions.
Lesson 3: Make governance an ongoing priority
No matter the partnership, Phillip emphasizes it’s not a “set it and forget it” situation. Strong compliance and ongoing validation protect the hospital and its patients. One mistake can jeopardize everything, so every partnership needs transparency, centering around patient safety and with human oversight built in.
Support for post-deployment monitoring and feedback loops is critical. When local practices align with responsible AI standards, organizations can confidently care for their communities. It’s not just about meeting regulations but building trust and quality.
Actionable takeaways for mastering risk
Managing risk never ends — it’s an ongoing journey. These are the principles Cherry County lives by:
- Know your organization’s realities, constraints and goals.
- Build resilience by mixing internal expertise with trusted partners.
- Demand clear feedback, communication and seamless integration from your vendors.
- Prioritize practical solutions over shiny new technology.
- Choose innovations that reduce burdens and bring value to clinicians and patients.
By balancing risk with pragmatic vision, you can shape an organization that’s resilient, efficient and ready for tomorrow – whether you’re a small rural facility or large health system.
You can learn more about Cherry County Hospital here and about Solventum here.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.