S1E13: FQHC AI (ft. Mikkel Finsen, Open Door Care Network)
Healthy Uptime Podcast Mikkel Finsen (Open Door Care Network) _ Jordan Cooper (Rackspace)-20261030_093345-Meeting Recording
October 30, 2026, 1:33PM
18m 17s
Jordan Cooper started transcription
Jordan Cooper 0:03
today with Mikkel Finsen, the Chief Technology and Cybersecurity Officer at Open Door Care Network. Mikkel, thank you so much for joining us today.
Mikkel Finsen 0:11
Thank you.
Jordan Cooper 0:13
For our listeners, the Open Door Care Network is an FQHC outpatient care network headquartered in Ossining, New York, serving the larger Westchester County, New York area with about 100 providers on staff. So we're going to be talking a lot about AI today within FQHC space.
So, Michael, Open Door serves a patient population with significant health care needs. But like most community health organizations, you have to be thoughtful about where you invest limited resources. In fact, this applies to every organization in the world, especially every provider organization. But I guess we can start off by asking, how do you prioritize technology investments?
How do you weigh different AI pricing and risk? Where do you see the greatest opportunities to improve care delivery and operational efficiency?
Mikkel Finsen 1:00
Yeah, thanks for that. We aim to focus on the providers at this as a priority right now. As we, as I said, we have about 100 plus providers in our organization. There is a well-known, you know, burnout still within the providers communities, and we are trying to identify tools that can help.
The providers spend less time, you know, in the evenings and weekends on their clinical notes. So we're focusing specifically on ambient AI technologies and scribe technologies. We have a couple of platforms rolled out and they're heavily used by a large number of the providers.
The reason we're using those is we want to help them get better clinical notes without actually having to focus on sitting and typing and missing information. And we also find that, you know, these tools give the providers a better opportunity to improve the quality of care to our patients and be more attentive to the patient needs and actually
listen and talk to the patient eye to eye, which means a lot for many, many patient provider relationships. And then they can focus less on typing in the notes and maybe forget capturing stuff like remind themselves of refills. The scribe tools will do that, will help them with that. So it's a clinical support tools.
Jordan Cooper 2:23
Mhm.
Mikkel Finsen 2:23
we provide them. And then also some clinical knowledge tools, you know, that are specifically diving into medical journals for help them with the validating clinical diagnosis, but it's support tools. It's not generative, it's not taking over their roles. We're not looking to replace a staff at this point in time. We're looking for how to support.
Jordan Cooper 2:44
So, Mikkel, ambient AI is perhaps the most widely adopted AI use case across the provider space in the United States. Actually, in the last few years, there have become a few clear frontrunners in the ambient AI space. And I'm wondering,
Mikkel Finsen 2:47
Yes.
Jordan Cooper 3:04
How, I mean, in the FQHC space, what your KPIs are for evaluating the success of your ambient AI tools in achieving the outcomes you desired. You mentioned reducing pajama time and reducing attrition. Are there any specific
KPIs that you say, all right, we're going to look for over the next 24 months, you know, we need to hit these in order to evaluate whether, you know, how successful this implementation is.
Mikkel Finsen 3:34
No, and it's a good question. It's something we have actually reviewed as late as yesterday in the organization to try and figure out how do we actually validate that these ambient tools are adopted and used correctly. So how do we monitor it? In the past, you know, not in the past, we still do peer-to-peer reviews on a lot of the notes.
So we're now looking at how do we do peer-to-peer review on these AI generated notes, making sure that the codes that they assign, making sure the prescriptions, everything is aligned just like we do when you do a norm peer-to-peer review. We had initially hoped that, you know, these tools would help our providers close their note.
nodes quicker, but that is not the case. I will just, you know, anecdotally said that, you know, Ambient AI, as you rightfully said, is one of the fastest growing support tools being deployed to the healthcare and one that most providers are eager to do. You know, we haven't seen this kind of adoption in a long time for.
for any medical tools. Anyway, that's just anecdotally. But so we have no, the only real thing we can measure right now is the adoption, how many people are using it, and the amount of notes they're generating with those. And so that's the first thing. Right now we have no real measures, to be honest with you.
Jordan Cooper 4:55
I want to focus on the CISO angle of your title. So healthcare organizations are increasingly dependent on outside vendors, cloud platforms, and now AI solutions. I'm wondering how you think about managing cybersecurity risk across that expanding ecosystem, especially in light of the ransomware attack you recovered from in 2020.
and your subsequent prioritization of critical applications for disaster recovery. And in that vein, I'd love if you could touch upon whether you've considered an independent recovery environment.
Mikkel Finsen 5:27
We have not considered an independent recovery environment. We do very rigid and, you know, frequent backups of our system. We test them on a quarterly basis to validate that these are actually able to restore, you know, critical services in a production environment. I know it sounds dangerous, but we have to do it in production.
environment, otherwise, what's the worth of testing it? We do use third-party vendors, you know, annually for a number of external events, such as, you know, obviously pen testing, phishing event, you know, phishing events, and whatever come at security risk assessment. So, we do have a lot of these external.
Events that that take place, but for my backup and restore, that's we really rely heavily on valid on our daily and hourly backups, as well as you know the the restore process itself.
Jordan Cooper 6:17
Right. I'm wondering, a lot of listeners here have heard anecdotally about ransomware attacks. Some have actually suffered it, obviously. Change Healthcare in 2025 affected many organizations across the nation. But you kind of came in and you helped your organization recover from a ransomware attack.
Is there anything that you learned in that recovery process that you would like to share with listeners to help them better kind of harden themselves across cyber attacks in the future?
Mikkel Finsen 6:51
Obviously, you know, the basic stuff is, you know, you need to have a good company on hand that you can speed dial and say, okay, we got attacked. What are the next steps? You know, cyber insurance is, you know, critical. You know, we just sign up and get cybersecurity. But they will often assign a consultancy firm to work with you.
So that's at the basic level. Have your disaster recovery documentation in place. But what we found most crucial was the backup and restore. Unfortunately, some of it didn't work. As you know, so that's why we're now more rigid about testing and the backups on a regular basis. So
and the backup and restore again to me is essential. Now, if you can go and have an off-site, you know, or backup or hot site, you know, ready, then that's even better, but you need to make sure you have backup and restore in place.
Jordan Cooper 7:45
So just in the last question on this topic, and then we'll move on. I'm curious, you know, the whole point of an IRE is in the eventuality of a cyber attack, your mirrored environments like your Dr. your HA might be susceptible to the same sort of infiltration as you experience in prod.
That's the point of an IRE to have kind of a logical air gap. I'm wondering how you made the decision to not pursue an IRE and instead just rely on a Dr. which in my understanding is to more kind of serve as security against an environmental sort of disaster as opposed to a targeted.
act by bad actors.
Mikkel Finsen 8:29
That's a long question. I think we have to also evaluate our resources, both financially and staffing and skills. So right now we don't have the budget to expand some of these capabilities. And so we have to keep it, you know, a lot of it in-house with the tools and capabilities we have and set up.
Jordan Cooper 8:44
Mhm.
Mikkel Finsen 8:51
strong partnerships with a short list of platforms that we rely on to help us with these services.
Jordan Cooper 8:59
Got it. So given your experience rebuilding Open Door's infrastructure and simplifying your network architecture, how do you envision your infrastructure evolving over the next few years? What do you expect to continue managing internally? And where, if anywhere, do you expect you might increasingly rely on a cloud platform or a managed service
in the cloud. So, you know, this is a cloud on-prem type question.
Mikkel Finsen 9:25
Yeah.
So we do have a lot of our systems, our cloud-based systems or SaaS services, if you want to put it that way. So most of our platforms do rely on that. We are looking at where can we complement or add value to our team in the sense of coverage. So 24-7 capabilities, you know, SOC and SOC,
opportunities where we work with vendors to go in and manage our systems outside of normal business hours or offload certain capabilities to, let's say, a network services company where they go in and manage, you know, certain alerts and certain monitoring to and proactively go in and
and either patch or address vulnerabilities, you know, as they occur, or attacks, I should say, hopefully no attacks, but yeah. And we, you know, I just want to say we all do attempting to keep our excellent footprint very, very small and light, so we really don't have that many, you know, should I say, attack platforms out there.
Jordan Cooper 10:14
Mm-hmm.
Yeah.
Do you have what are your what were your thoughts on on the migration process from on-prem to the cloud? Was there is there any kind of kind of lessons learned that you'd like to share about what to consider when you're migrating from your on-prem to to a cloud data center?
Mikkel Finsen 10:50
From a business perspective, I think it's important that the senior leadership and the board understand that moving to the cloud doesn't mean it's going to be cheaper. There's other controls we need to put in place. We need to reskill and then retrain some of our staff. So there's a cost required that is not going down and it's not going to be
seen as cheaper, because now we have a monthly OPEX expense, whereas in the past you bought a couple of servers, you could write them off over three to five years, but you constantly had to update those, but it becomes a vulnerability that we want to eliminate. So moving to the cloud for us was the obvious choice.
Also, as I said before, because we have a lean team, but explaining and getting the buy-in from the board for me was one of the critical factors as well. And then understanding how do we secure that, you know, the platforms and applications that are sitting up there through the security stack we have.
Jordan Cooper 11:46
You just mentioned about when you migrated to the cloud, you needed some reskilling of your team. And you said that, I know that you've built a substantially larger, more capable internal IT organizations in your tenure at Opendoor. As you look to the future, what capabilities do you believe are strategically important to retain internally and what may be more cost-effective or beneficial?
better managed by specialized outside partners.
Mikkel Finsen 12:11
Well, so we still rely on having, you know, technical staff on the books for our network, for cybersecurity, for our different platforms, back office platforms that we use to protect and manage the organization. But as I said before, we have to complement or expand that team.
because hackers and malicious actors don't, they don't really attack us during the day. So we have to figure out how can we protect ourselves out of ours. Right now we're doing it ourselves, but it can be straining. So back to your question is I think
These monitoring tools and AI tools will be able to help us in the future, and maybe some of the vendors out there can help take on some of those responsibilities. But we're establishing partnerships, not necessarily vendor relationships.
Jordan Cooper 13:04
Right, so obviously back to AI, there's a lot of enthusiasm about it. We spoke about ambient AI. There's a lot of use cases from clinical documentation as we spoke about the patient engagement, you said, like best practice advisories, clinical decision support.
But you said there's also, I think, an AI interpretation tool for multiple languages. Where do you see the most practical applications for organizations like OpenDoor? And what concerns do you have about introducing these technologies safely?
Mikkel Finsen 13:41
I think AI is fantastic, you know, I have to say that, but I think there's still a apprehension or a people should certainly be concerned about just deploying AI without going through, you know, understanding what the tools are and setting up specific guardrails for staff on how to use these tools, you know.
Shadow AI is certainly a big thing we need we need to address, and that's where you know organizations need to understand that people are using AI today, so that you're already exposed. You need to manage that risk somehow, and and and figure out how do we how do we know which AI tools and agents are used and how do we scan the network, how do we secure those?
but also how do we educate our end users? Because at the end of the day, our end users is still one of the biggest weaknesses we have in any organization if they unintentionally upload PHI to these platforms. So guardrails and guidance is essential.
Jordan Cooper 14:39
So kind of as we approach the end of this podcast episode, I know you had an interest in weighing in on different risks and pricing of AI. We haven't really touched upon pricing yet. Can you elaborate more on how you've been evaluating tokenization and just...
accommodating AI in a very strained budget.
Mikkel Finsen 15:01
Yeah, and I think this comes down to open and honest conversations with the vendors that are coming in. And I also think, and this is just personally, I think a lot of vendors are aggressively taking advantage of the notion AI and agents and come in and say, okay, well, everybody wants AI, everybody needs AI. So you're going to be paying top dollar to actually.
Use our platform, and I find it, you know, scary and concerning that the vendors are that aggressive without actually considering that who you're talking to, so...
Many vendors will say it's going to cost you a minimum of $125,000 a year just to use their platform. Then you have to understand, as you said, the different transaction fees that are coming in for the for processing the claims. And I understand that's the GPU, but are there any other, you know, hidden costs that they need to expose a little bit better to really understand what is the ROI of that platform?
So we can actually make a concerted decision into it and saying, well, it's going to cost you 1/4 of a million to run it as an estimate per year. Now, that means we have to earn a quarter of a million before we even start making money on this AI tool. So it's something we need to be really cautious about before we just jump in. And I understand
AI is here to take over the world, but at the same time, we have to be realistic, or the vendors have to be realistic as well when they come into these conversations and not push themselves on it, sign a contract, and then suddenly all these hidden costs start appearing when we get the monthly bills. And that's
Jordan Cooper 16:36
I hear a message for vendors to just be ethical and transparent as supportive partners instead of pulling a gotcha because obviously if it's unaffordable, that contract won't be renewed, right?
Mikkel Finsen 16:40
Yeah, yeah.
Yep.
You know, you need to know your audience. I had a vendor, and not to, I'm not going to name drop, but they said it's going to cost 1/4 of a million to use our AI platform. Then all the claims transaction comes on top of that. And I literally told the vendor, if you told me that at the outset of the call, I wouldn't even have set up the call.
Jordan Cooper 17:04
Yeah.
All right, well, any final parting thoughts perhaps to yourself a few years ago? Are there any messages you wish you could have known a few years in the past before you've gone on this journey?
Mikkel Finsen 17:21
No, I came from corporate America into healthcare some years ago. And then personally, that was, you know, for me, I thought it was just IT and IT is good. But definitely figuring out a way of learning what healthcare is before I joined healthcare would have helped me, you know, make some different decisions in the past. But I think technically we have achieved a lot and I'm not concerned about that. But in order for me to be a better partner with the healthcare,
organization. I'm with, you know, I had to learn it and really get under the hood with a number of these terminologies and processes. Nothing I can change now, but it's certainly something that, you know, reflect upon. It was, it was, it's a different world.
Thank you, sir.
Jordan Cooper stopped transcription
