ABOUT THIS EPISODE
October 12, 2026: Bill Russell and Drex DeFord. Sarah Richardson is in the air for Philadelphia. The week is one argument: the attack got cheap, and the controls around the tool did not keep up.
The number is $700. Drex described a dark-web package that weaponizes a fresh patch for a buyer who does not understand it. At the regional staff roundtables, the matching line was a meme they were no longer joking about. They patch in production, with a plan to roll back, because the test window is gone.
Citrix had shipped another emergency NetScaler build that Sunday for a SAML sign-in bug attackers were already using. Epic had paused most new product work for about six weeks after Anthropic's testing found MyChart audit log gaps. Some customer configurations could let an outsider view records with no audit trail. Judy Faulkner is the source of the pause, via the TechCrunch and Becker's reporting Bill read on the tape. Mayo had given an all-clear after OpenAI agents probed the site on October 2. No unauthorized access. The agents looked for config files and tried to create accounts.
The policy block is the contract. Drex's takeaway from three stories in 2 Minute Drill Extra: get it in the contract, and a general counsel who does every other kind of agreement may need a specialist for this one. FDA put AI device lifecycle on the fiscal 2027 agenda. The FTC is looking at OpenAI and Anthropic. California signed AB 1979 and SB 503, protecting clinician judgment and requiring bias mitigation. Newsom vetoed the bill that would have protected a clinician who overrides the tool. The physician is still the person who owns the click. Drex's rhyme: EHR alerts trained a generation to click through, and AI alerts are walking the same road.
Children's Healthcare of Atlanta gates every Epic AI feature on accuracy and has left some off. Bill sat in a room where a CIO turned all of them on because the partner is trusted. Abridge is re-signing a great majority on three-year and five-year terms. Drex does not like predicting next year from a three-year signature.
HCA nurses report Timpani, built with Palantir, is staffing unsafely across about 130 of 190 locations. One union unit filed a grievance. Bill is not surprised by a prompt written to optimize.
Blue Cross Blue Shield's estimate is about a billion dollars over two years for autonomous inpatient coding. Bill's counter is the work was already delivered and the note is finally complete. Drex agrees the cost goes up because the payer has to pay for work that used to fall out of the chart. The next move he expects is delay: deny, demand the evidence, wait.
The story is the addition. The electrical plan passed. The electrician's questions did not. Cognitive surrender is Bill trusting the tool on the parts he will not learn. Drex's version from a dinner question: a lot of people who "have an agent" still have a search box.
Key Points:
0:00 Patch it in production
3:19 Citrix shipped the NetScaler patch
6:49 SureTest
7:32 Epic paused the new products
8:51 Past the business associate agreement
11:59 California, and the physician still decides
12:48 Censinet
15:40 Cognitive surrender
18:33 One Epic AI tool at a time
20:54 130 of 190. Nurses pushed back
23:01 A billion dollars over two years
25:54 A lawyer's inbox, and an agent
Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer
