AI in Healthcare IT: Opportunities, Threats and the New Build-vs-Buy Equation

AI is reshaping the economics of healthcare software

The past two years have shifted the healthcare technology debate from whether artificial intelligence (AI) can create value to where it can be adopted safely, profitably and at scale. Generative AI (GenAI) is already moving from content generation to workflow assistance, while the next wave of agentic AI promises cross-system task execution: scheduling, routing, documentation, order management, coding, reporting and decision support. The industry is moving from AI-enabled productivity tools towards governed workflow orchestration, with value increasingly concentrated in integration, governance and execution layers (see Figure 1).

This shift matters profoundly for healthcare information technology (HCIT) companies. Historically, software vendors have benefited from product complexity, scarce engineering capacity and the difficulty of building reliable applications for regulated healthcare environments. AI-assisted software development and ‘vibe coding’ are weakening some of these barriers by making software cheaper and faster to build. Larger healthcare services providers, particularly those with scale, proprietary data assets and specialised workflows, are now asking whether they should build more of their own solutions.

However, the conclusion should not be that HCIT moats are disappearing. Instead, they are moving. Coding speed, rapid prototypes and feature-level differentiation are commoditising. The more durable sources of advantage are healthcare specific: reliability, regulatory-grade governance, integration depth, data access, change management, evidence, implementation capacity and embedded distribution through systems of record.

AI is reshaping software economics

AI is changing both the supply and demand sides of healthcare software. On the supply side, coding, testing, documentation and design workflows can now be accelerated materially by AI tools. Software companies can release more functionality with the same development resources; at the same time, customers with strong internal product owners and clinical experts can build more bespoke tools than before.

On the demand side, buyers are becoming less impressed by demos and more focused on proof. If many vendors can produce a plausible workflow mock-up, the real questions become whether the software is validated, integrated, governed, secure and capable of performing reliably in a local care environment. Healthcare buyers will increasingly ask for evidence of productivity, throughput, safety, data quality and compliance rather than for a simple features list.

This creates an apparent paradox. AI lowers the cost of building software, which threatens established vendors. But healthcare-grade deployment remains difficult, which protects vendors that have already industrialised quality management, validation, interoperability, cybersecurity and customer support.

Why systems of record remain protected

In HCIT, systems of record remain the anchor of value capture. Electronic medical record (EMR), radiology information system/picture archiving and communication system and laboratory information system platforms are mission-critical operational systems. They are deeply embedded into clinical workflows, billing logic, regulatory reporting, data access and daily operations. Replacement cycles can extend five to 10 years or more, and migrations are risky, expensive and operationally disruptive.

For this reason, near-term AI value is likely to concentrate in modules adjacent to the core rather than in full replacement of the core. Systems of engagement, action, insight and innovation can move faster because they add functionality around the existing stack. But they still need access to the data and workflows controlled by systems of record. This makes incumbent HCIT vendors gatekeepers: third-party AI can scale only when it is integrated into the clinical and operational pathways.

Near-term AI value is likely to concentrate in systems of action, insight and engagement rather than in the wholesale replacement of systems of record (see Figure 2).

The core systems are protected by six reinforcing moats:

1. Reliability and uptime: Downtime disrupts patient care, billing and clinician trust, making risk mitigation a central procurement criterion.
2. Interoperability: Buyers require dependable connections to adjacent clinical, diagnostic, financial and national eHealth systems.
3. Workflow embedding: Local clinical variation, training, adoption and change management increase switching costs.
4. Regulatory-grade governance: Medical Devices Regulation (MDR), US Food and Drug Administration, EU AI Act, General Data Protection Regulation, Health Insurance Portability and Accountability Act and quality-system requirements create documentation and monitoring burdens that favour mature vendors.
5. Evidence and track record: Buyers prefer proven solutions with similar integrations and clear outcomes, particularly in mission-critical environments.
6. Distribution and installed base: The vendor that owns the system of record has privileged access to users, data, workflows and procurement conversations.

The strategic consequence is that HCIT vendors should not defend only the database or the transaction system — they should defend the integration point. Vendors that become the orchestration layer for AI workflows can capture value even when the underlying algorithm is built by a partner, marketplace participant or customer.

Where AI value will scale first

AI adoption scales fastest where return on investment is immediate, accountability is clear and the workflow is bounded. Administrative productivity, documentation, coding, scheduling, triage, quality control and reporting are likely to scale more quickly than open-ended clinical autonomy. These areas have measurable labour impact, lower clinical risk and clearer ownership within provider organisations.

Clinical AI will continue to develop, particularly in imaging and other data-rich areas, but broader autonomy remains constrained by fragmented data, local workflow variation, validation requirements, liability ambiguity and regulatory change control. Only a limited number of fully or partially autonomous solutions have achieved clearance, and most approved tools still support rather than replace clinicians.

The opportunity for HCIT companies is significant. AI modules can expand the addressable market beyond the traditional core system: AI receptionists, scribes, revenue cycle automation, capacity management, reporting optimisation, diagnostic AI marketplaces, data services and governance tools can all become paid add-ons. In outpatient and diagnostic settings, the AI-enabled module opportunity may approach or exceed the value of the original software subscription in selected use cases.

However, the pricing model must evolve. Per-seat and per-site pricing can be exposed when AI reduces staff requirements or shifts work to automated agents. Vendors should consider usage, transaction, throughput, outcome, shared savings or hybrid pricing models that align with the value created.

The provider build threat is real — but selective

The build-versus-buy equation for healthcare services providers is changing. AI-assisted development, low-code environments, modular architectures and open-source models are making it easier for scaled providers to build workflow applications, analytics layers and specialised patient-facing tools. Large providers are also accumulating proprietary data that can be used to train or tailor AI systems.

European providers have already demonstrated that self-build is no longer limited to a small group of academic pioneers. Examples span in-house EMRs, telehealth platforms, patient portals, analytics layers and medical AI tools. Provider self-build activity has accelerated significantly since the GenAI inflection, particularly in workflow, engagement and AI layers, where differentiation matters most (see Figure 3).

Most providers are unlikely to build across the entire stack. Instead, a hybrid architecture is emerging: build where workflow differentiation matters and buy where regulation, interoperability, cybersecurity and compliance dominate. Build-versus-buy preferences vary materially by provider archetype and stack layer (see Figure 4).

Notably, internally developed systems deployed within a single legal entity may benefit from reduced MDR obligations in some use cases, further increasing the attractiveness of selective self-build strategies for scaled providers.

How HCIT companies should respond

The build threat should not lead HCIT companies to defend closed systems at all costs. In many markets, the closed-system posture will become less attractive as clients seek to experiment with AI, build micro apps and deploy models on top of their existing data and workflow infrastructure. The defensive end state for many HCIT vendors is likely to be an open, regulated, AI-native platform rather than a fully closed system architecture (see Figure 5). Five strategic moves are particularly important:

1. Create a platform and extensibility layer: Offer application programming interfaces (APIs), software development kits, sandboxes, low-code/no-code tooling and curated marketplaces so providers build on the vendor platform rather than around it.
2. Become a regulatory utility: Turn national eHealth connectors, AI governance, cybersecurity, audit trails, documentation, validation and post-market monitoring into productised capabilities.
3. Build agentic-native architecture: Enable model-agnostic tool calling, role-based permissions, human-in-the-loop controls, full logs and workflow-specific guardrails.
4. Deepen vertical workflow fit: Use specialty modules, outcome benchmarks and clinical workflow content to preserve differentiation where generic AI tooling is weakest.
5. Reset commercial models: Move towards usage, transaction, outcome or co-development economics where AI changes the link between seats, work and value.

Implications for investors and boards

For investors, the central diligence question is shifting from “Does the company have AI features?” to “Does the company have the right to win in an AI-enabled, hybrid build-versus-buy world?” That right to win should be tested across both defence and offence.

On defence, investors should assess which product modules are easiest for customers or new entrants to replicate, where the system is protected by regulatory or integration barriers, and whether pricing is exposed to AI-driven productivity gains. On offence, they should assess the vendor’s ability to capture a new module technology acceptance model (TAM), become the AI marketplace or orchestration layer, monetise data services and support client-side innovation without losing control of the platform. The strongest HCIT assets are likely to combine mission-critical installed bases with modern integration architecture, credible AI governance, strong customer support, specialty workflow depth and a clear roadmap towards higher levels of automation. This combination is likely to command a premium, while closed, slow-moving products with weak APIs and limited AI readiness may face increasing multiple pressure.

HCIT moats are shifting, not disappearing

AI will not replace HCIT systems of record overnight. The healthcare environment remains too regulated, fragmented, risk-sensitive and workflow-specific for a rapid displacement cycle. However, AI will change where value is created and captured. The edge of the stack will move faster; the core will remain protected but must become more open, more intelligent and more extensible.

For HCIT companies, the opportunity is to convert the threat into a platform strategy. By enabling customers to innovate on top of trusted systems, vendors can retain the system-of-record moat while expanding into AI workflow modules, marketplaces, data services and governance. By resisting openness, they risk encouraging customers to build around them.

For larger healthcare services providers, the rational answer will increasingly be hybrid: build the differentiating workflow and AI layer, buy the regulated plumbing and integrate both around a stable system of record. The winners on both sides will be those that understand that AI has not eliminated healthcare software moats; it has redefined them.

How L.E.K. Consulting can help

L.E.K. helps HCIT companies, healthcare services providers and investors assess how AI changes product strategy, competitive advantage, build-versus-buy decisions and value creation. Our work spans AI opportunity assessment, product and platform strategy, commercial model redesign, healthcare data strategy, regulatory and interoperability roadmaps, and investor diligence.

For HCIT companies, this includes identifying AI-driven TAM expansion, mapping build-risk exposure by module and customer segment, designing AI-native platform strategies and developing a prioritised autonomy roadmap. For healthcare services providers, it includes determining which workflow and AI capabilities should be built, bought or partnered and how to do so without compromising compliance, safety or implementation speed.

To discuss how AI could reshape your healthcare technology strategy, platform roadmap or build-versus-buy decisions, contact us.

L.E.K. Consulting is a registered trademark of L.E.K. Consulting. All other products and brands mentioned in this document are properties of their respective owners. © 2026 L.E.K. Consulting