Start with workflows, not technology: MGMA's IT chief suggests a tech plan for practice leaders

Practice administrators are expected to keep their practices modern and protected, often without a dedicated information technology (IT) team or a large budget. Julia Rosen, senior vice president of IT for the Medical Group Management Association (MGMA), previously served as chief technology officer for Centura Health, where she helped stand up technology for Colorado's COVID-19 mass vaccination sites. In an interview at the MGMA 2026 Annual Conference, she explained why technology decisions should start with workflows, why staff "super users" make better advocates than IT and how frequent cybersecurity updates are creating operational churn.

This transcript has been edited for length and clarity.

What IT concerns are you hearing from members at the conference?

Julia Rosen: A lot of our members are from independent practices, and they don't have large, robust IT teams to run major programs like cybersecurity or AI governance. So they are all trying to figure out: How do I do more with less? How do I stay modern and stay protected without necessarily having the money or budget for robust solutions or robust teams? I think that's a big concern for a lot of our independent practices.

Of course, practices of all sizes are concerned about cybersecurity, with increased threats coming from all over, both domestic and abroad. And AI is always something people are talking about. They hear a lot about it, but specifically in the health care industry, we're not as advanced as some other industries, and we want to be more cautious because of the compliance and privacy concerns. So a lot of practices of all sizes are talking about what's the right balance between being modern and adopting technology, and being cautious.

For practices that have used the same system for a while and think it may be time for something new, where should they start?

Julia Rosen: I encourage people to always start with operational workflows. Don't start with the technologies. Start with, what are the problems in our practice that we need to solve? If you have a legacy piece of technology, think about the problems that legacy technology introduces. Where is the friction that it causes in the workflow? Where is it making our practice slower, or maybe making our patients a little less safe, or making it slow for them to access care?

So rather than start with the technology, I always start with: What are the business problems that you're trying to solve with technology? Then focus on the platforms and technologies that will be the best to solve that problem. That's what I always encourage people to do. Start with an operational-first mindset before you even go to the technology, and that will help guide your technology journey.

Some physicians and practices are still skeptical about artificial intelligence (AI), or aren't sure where to get started. What do you advise them?

Julia Rosen: I would always advise starting with revenue cycle. Revenue cycle is actually where we are seeing a lot of the most return on investment (ROI) gains within health care. There are huge use cases from an AI standpoint in denials reduction, as an example. These are sort of easy use cases that people can use to get their feet wet, and they usually will produce immediate gains for their practice. You can upload your whole remittance files, for example, to an AI tool that complies with the Health Insurance Portability and Accountability Act (HIPAA) and ask it to assess the common root causes of denials and the next best actions for denials reduction.

I think starting with revenue cycle is a little bit less worrisome for a lot of practices than starting on the clinical side. And again, I think it gets more bang for your buck right away. So that's where I always encourage practices to start.

Whether it's AI programs, new hardware or new software, new technology costs money. Where do administrators find the money to pay for new systems?

Julia Rosen: When I think about AI technology in health care, I think of three different categories. There are the native AI tools that come with your electronic medical record (EMR), and if they come with your EMR, ideally you should already be using them. Then there are fit-for-purpose tools that are typically the high-cost tools you're talking about. They're provided by a specific vendor, there's a licensing fee every year that costs quite a bit of money, and there's a pretty high implementation burden.

Then you've got your basic Claude, Copilot or ChatGPT. If you buy an enterprise version of those tools and follow the right process to make them HIPAA compliant, it can be a very cost-effective way to start with AI. Shameless plug: I talk a bit about this in my [MGMA] Summit presentation that's coming up in December. A lot of practices already have Copilot implemented for administrative use cases, like writing emails, and in some Microsoft packages it's already included. So if you follow the right processes to make those tools HIPAA compliant, there's a lot you already have in your office where you can start leveraging AI for new use cases.

So, especially for practices that are strapped for money, start with the tools you have. Start with the native AI tools in your EMR. Start with the Copilot that you're using administratively in your office. Don't overcomplicate it. Don't look at the sea of 400 different AI tools and try to decide between them with your small investment dollars. Start small, and then you can build up from there. Once you see what kind of gains you're getting, you can potentially use some of those gains to buy some of the more complex add-on tools for more sophisticated business problems.

Given the documentation burden that physicians and other clinicians face, what have you heard about the implementation of AI scribes and how they're being received?

Julia Rosen: The use cases are pretty well received and operating well in primary care, for example — a lot of the core primary care and internal medicine, the basic office visits. I think they're very well adopted in those spaces. The challenge I've heard is that the large language models (LLMs) are not as sophisticated with more niche use cases and more niche specialties. It's getting better. The Microsoft product has a lot of specialties that it's rolling out and gradually hitting more of, but they're not as good when you move away from some of those basic use cases.

So that's where things like simplifying your documentation templates and going back to the basics are really critical — really having a robust program in your office to train the models, to make corrections and to make sure you are personalizing the models for what you need through constant feedback. That's really what I'm hearing: As you get more complex in the medical use cases, the models are not as advanced and need a little bit more work to really get the ROI that folks are looking for.

When an entire staff needs to start using a new technology, what's a good first step for practice administrators?

Julia Rosen: Super user programs are always the best way to do it. You've typically got the person in your clinic who's been there for 30 years and has done the job the same way for a while, and then sometimes you've got some of the more innovative, hungry folks who are really excited about the technology. So get those hungry folks to start with a tool and start a proof of concept. A lot of vendors will let you try out their product for 60 days or so. Pick the people in your practice in those specific roles who are passionate about learning new things, get them to adopt the technology and get them to talk about it with their peers.

I always say IT is the worst sales group for technology. Nurses, doctors, medical assistants — they want to hear from their peers about how they're using the technology and how it's becoming effective, not from technology people. So find those people in your practice who are going to be early adopters. Let them try it, and let them be the evangelists.

Are people paying enough attention to cybersecurity right now?

Julia Rosen: It's interesting. Specifically in health care, one of the things we're seeing is that a lot of the major software vendors are having to update their software a lot more frequently to patch cybersecurity vulnerabilities that are created by AI. Those updates are causing a lot of operational churn in practices. They're not always used to changing the way they do things based on software updates. Those softwares that are on premise or need to be patched, practices are not used to working at that pace to keep it updated, and that has an impact on the business.

When I think about cybersecurity in health care, so much of the health care technology stack is vendor based. Practices rely on a lot of those vendors for great cybersecurity practices and vulnerability management within those platforms. There are, of course, things you always have to watch out for in your own practice, like user training on phishing, understanding what you would do in a ransomware attack and doing tabletop exercises. But because so much of the cybersecurity work lies in the vendor space in health care, there is a tremendous operational impact from needing to do constant software updates.

So is enough attention being paid? I think there's some, but I also think practices need to be more aware of what their own vendors are doing around cybersecurity and push them to understand that, as well as look within their practices and be more adaptable to these more frequent updates that are addressing these vulnerabilities.