Health Information Systems, Analytics and AI

Introduction and Context

Hospital administration increasingly depends on the ability to collect, interpret, protect and act on information. Clinical care, finance, staffing, procurement, quality improvement, public-health reporting and patient engagement all generate data. When these data remain fragmented in paper files, isolated spreadsheets or incompatible software, managers cannot obtain a reliable picture of hospital performance. Health information systems (HIS) address this problem by integrating people, processes, technology and governance to support health-service operations and decision-making.

The contemporary hospital is therefore not merely a physical institution. It is also a data-producing and data-dependent organisation. Electronic health records (EHRs), laboratory systems, radiology information systems, pharmacy systems, patient portals, telehealth platforms and workforce applications exchange information across clinical and administrative boundaries. Analytics converts this information into evidence, while artificial intelligence (AI) may assist with prediction, classification, language processing and workflow automation.

Technology, however, does not automatically produce better care. Poorly designed systems can increase documentation burden, reinforce inequity, expose confidential information or generate misleading performance measures. Effective hospital administration requires both technical literacy and managerial judgement. This chapter examines the major information systems used by hospitals, interoperability, telehealth, cybersecurity, dashboards, data quality, analytics and responsible AI governance.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Distinguish an EHR from a broader hospital information system.
2. Explain interoperability and the role of standards in information exchange.
3. Evaluate telehealth models, benefits and operational risks.
4. Apply principles of cybersecurity, privacy and access control.
5. Design and interpret useful hospital dashboards and indicators.
6. Assess data quality using recognised dimensions and practical controls.
7. Use descriptive and predictive analytics appropriately.
8. Identify risks and governance requirements associated with AI in healthcare.
9. Recommend an integrated information strategy for a hospital.

1. Health Information Systems as Organisational Infrastructure

A health information system is an organised combination of hardware, software, data, procedures, people and governance used to collect, process, store, exchange and use health information. It is broader than an application. A technically sophisticated system can fail if users are not trained, workflows are unsuitable or data responsibilities are unclear.

A hospital information system (HIS) generally supports hospital-wide administrative and clinical functions. Typical modules include:

• patient registration and master patient indexing;
• appointment and scheduling management;
• admission, discharge and transfer (ADT) management;
• billing, costing and claims;
• laboratory and pathology information systems;
• radiology information systems and picture archiving and communication systems (PACS);
• pharmacy and medication management;
• nursing and clinical documentation;
• operating-theatre and bed management;
• procurement, inventory and supply-chain management;
• human-resource and payroll systems; and
• quality, incident and public-health reporting.

An EHR is a longitudinal digital record of an individual’s health information, potentially available across episodes of care and organisations. An electronic medical record is often used for a record within one provider or organisation, whereas an EHR implies wider continuity and exchange. In practice, terminology varies by country and vendor; the important distinction is scope, continuity and exchange rather than the label alone.

A useful way to understand HIS is through four layers:

The systems approach is essential. A new EHR may improve availability of information but also alter professional roles, work allocation, communication patterns and accountability. Implementation should therefore include clinical, administrative, information-technology, legal and patient representatives.

Information flow and the patient journey

Information follows the patient journey: registration, assessment, investigation, diagnosis, treatment, discharge and follow-up. At each stage, information may be created, modified, transferred or used for decisions. Duplicate registration, incorrect patient identification, delayed result review and incomplete discharge summaries are examples of information failures that can become safety failures.

The master patient index is particularly important. It links records to a unique patient identity and reduces duplicate or incorrectly merged records. Reliable patient identification normally uses more than one identifier, such as name, date of birth and an organisation-specific identifier. Names alone are unsafe because patients may share names or change them over time.

2. Interoperability and Standards

Interoperability is the ability of different information systems to exchange, interpret and use information consistently. It has several dimensions:

1. Technical interoperability: systems can connect and transmit data.
2. Syntactic interoperability: exchanged messages follow an agreed structure.
3. Semantic interoperability: the receiving system understands the meaning of the data.
4. Organisational interoperability: institutions have aligned policies, workflows, responsibilities and legal arrangements.

A message that arrives successfully but labels a medication dose incorrectly is technically connected but clinically unsafe. Interoperability must therefore be evaluated by meaning and usefulness, not merely by network connectivity.

Common standards include Health Level Seven (HL7) messaging, Fast Healthcare Interoperability Resources (FHIR), Digital Imaging and Communications in Medicine (DICOM), and terminology systems such as SNOMED CT, LOINC and ICD. Their functions differ. FHIR provides modular resources and application programming interfaces; DICOM supports medical images and related information; LOINC supports laboratory and clinical observations; ICD supports disease classification and reporting; SNOMED CT provides detailed clinical concepts in jurisdictions where it is licensed or adopted.

Interoperability also requires terminology mapping. One system may record “heart attack,” another “myocardial infarction,” and a third an abbreviated code. A terminology service maps these expressions to standard concepts while preserving the original clinical context. Mapping is not always exact: loss of detail, local abbreviations and different coding purposes can create ambiguity.

Interoperability evaluation

Hospital administrators should ask:

• Can the system exchange data with laboratories, pharmacies, insurers and referral partners?
• Are messages complete, timely and traceable?
• Are clinical concepts and units preserved?
• Can patients access and transfer their information?
• Are interface failures monitored and reconciled?
• Are data-sharing agreements and legal responsibilities explicit?

An interface inventory, error log, reconciliation process and named data owner are practical controls. Interoperability should be tested using realistic clinical scenarios rather than only technical demonstrations.

3. Telehealth and Digitally Enabled Care

Telehealth uses information and communication technologies to deliver health services when participants are geographically separated. It includes synchronous video or telephone consultations, asynchronous review of submitted information, remote monitoring and clinician-to-clinician consultation. Telemedicine usually refers more specifically to clinical care, whereas telehealth may include education, administration and public-health services.

Telehealth can improve access for rural populations, reduce travel, support specialist review and maintain continuity during emergencies. It may also reduce congestion for selected follow-up services. Its limitations include unequal internet access, inadequate devices, difficulty performing physical examinations, privacy risks, licensing constraints and the possibility that remote care is inappropriate for a patient’s condition.

A telehealth service should define:

• eligible conditions and exclusion criteria;
• identity verification and informed consent;
• emergency escalation procedures;
• documentation and coding requirements;
• prescribing and referral rules;
• technical support and accessibility arrangements;
• privacy and recording policies; and
• quality and patient-experience indicators.

The correct question is not whether telehealth is always better than in-person care. It is whether a particular service, for a particular patient and purpose, can achieve acceptable quality and safety remotely. Hybrid pathways often provide the most appropriate model.

4. Cybersecurity, Privacy and Resilience

Hospitals are high-value targets because they hold sensitive information and depend on continuous availability. Cybersecurity protects confidentiality, integrity and availability—the “CIA triad.” Confidentiality prevents unauthorised disclosure; integrity prevents unauthorised or accidental alteration; availability ensures that authorised users can access systems when needed.

Important threats include phishing, ransomware, stolen credentials, insider misuse, insecure medical devices, unpatched software, supply-chain compromise and accidental disclosure. Cybersecurity is therefore a clinical governance issue, not solely an IT issue. An unavailable medication system or altered laboratory result may directly harm patients.

Core safeguards include:

• unique user accounts and strong authentication;
• multi-factor authentication for high-risk access;
• role-based access and least privilege;
• encryption in transit and at rest where appropriate;
• secure configuration and timely patching;
• network segmentation, especially for medical devices;
• tested backups protected from ransomware;
• audit logs and monitoring;
• staff awareness training and phishing exercises;
• incident-response and business-continuity plans; and
• regular risk assessment and supplier assurance.

Least privilege means that users receive only the access necessary for their duties. A ward clerk may need demographic and appointment information but not unrestricted access to psychiatric notes. Emergency access (“break-glass” access) may be justified, but it should require a reason and subsequent review.

Privacy concerns the appropriate collection, use, disclosure and retention of personal information. Administrators should apply purpose limitation, data minimisation, transparency, lawful processing, access controls and retention schedules. De-identification reduces risk for secondary use, but it does not guarantee anonymity: combining several datasets can permit re-identification.

A sound incident response process includes preparation, detection, containment, eradication, recovery and lessons learned. During an outage, paper downtime procedures, communication trees, clinical prioritisation and later data reconciliation are essential. Resilience means more than preventing incidents; it includes the capacity to continue safe operations and recover accurately.

5. Data Quality and Information Governance

Data quality is fitness for intended use. A dataset can be accurate but too late for clinical decisions, or complete but systematically biased. Common dimensions include:

Data quality should be managed at the point of capture. Structured fields, validation rules, controlled vocabularies, clear forms and user feedback are generally more effective than trying to repair all errors later. Nevertheless, data warehouses require profiling, duplicate detection, missing-value analysis and reconciliation with source systems.

For a data item, a simple completeness rate can be expressed as:

This measure assumes that the denominator is clearly defined and that “non-missing” does not necessarily mean “correct.” For example, a field containing “unknown” may be complete in a technical sense but clinically uninformative. Quality indicators must therefore be interpreted together.

Worked example. A hospital reviews 480 discharge records. The discharge medication field is completed in 456 records. The completeness rate is:

(456 ÷ 480) × 100% = 95%

The result is 95%. It does not establish medication accuracy, appropriateness or timeliness. Those require separate audits.

Information governance assigns responsibility for data definitions, quality, access, retention and use. A data dictionary should specify each field’s meaning, format, permitted values, source, owner and update frequency. Data stewards monitor quality in operational areas, while a governance committee resolves cross-departmental issues.

6. Dashboards and Performance Measurement

A dashboard presents selected indicators in a form that supports monitoring and action. It should answer a management question, identify variation and make responsibility clear. A visually attractive dashboard with excessive measures can obstruct rather than improve decision-making.

A useful dashboard design process is:

1. Define the decision or operational question.
2. Identify the audience and reporting frequency.
3. Define each indicator, numerator, denominator, exclusions and data source.
4. Establish a baseline and target.
5. Show trends, stratification and meaningful comparison.
6. Indicate data freshness and quality.
7. Assign an accountable owner and escalation rule.

Rates require careful denominators. For example, the inpatient fall rate may be expressed per 1,000 occupied bed-days:

If a hospital records 18 falls during 6,000 occupied bed-days, the rate is:

(18 ÷ 6,000) × 1,000 = 3 falls per 1,000 occupied bed-days

The denominator makes comparison more meaningful than simply reporting 18 falls, but interpretation still requires case-mix, reporting-practice and severity information.

Dashboards should distinguish counts, proportions, rates, averages and medians. A mean waiting time can be distorted by a small number of very long waits; a median and selected percentiles may better describe skewed waiting-time data. Statistical process control charts can help distinguish ordinary variation from unusual signals, but arbitrary traffic-light thresholds may encourage gaming or overreaction.

Dashboards should support equity analysis. Results may need stratification by age, sex, disability, language, ethnicity, socioeconomic status, geography or other relevant characteristics, subject to privacy and statistical disclosure controls. An apparently good hospital average may conceal poor outcomes for a specific group.

7. Descriptive and Predictive Analytics

Analytics transforms data into information for understanding and action.

Descriptive analytics

Descriptive analytics answers “What happened?” It includes counts, rates, distributions, trends, cross-tabulations and summary reports. It is the foundation for operational control. A hospital may analyse emergency-department arrivals by hour, bed occupancy by ward, cancelled operations by reason or antibiotic use by service.

Measures must be selected appropriately. For observations x₁, x₂, ..., x_n, the arithmetic mean is:

Here, n is the number of observations and x̄ is the mean. The mean is appropriate for quantitative data when the measurement process and purpose justify it, but it is sensitive to extreme values. The median is often preferable for heavily skewed variables such as length of stay.

Diagnostic and prescriptive perspectives

Diagnostic analytics asks why a result occurred, using drill-down, comparison, process mapping and root-cause analysis. Prescriptive analytics considers possible actions and their consequences. Neither should be confused with causal proof. A correlation between staffing and delays may reflect a third factor, such as unusually high demand.

Predictive analytics

Predictive analytics estimates the probability or expected value of a future outcome using historical data. Examples include predicting readmission risk, demand for beds, missed appointments, deterioration or supply consumption. A prediction is not a diagnosis and should not replace clinical judgement.

A binary risk model may estimate:

where p is the predicted probability, e is the base of natural logarithms, and z is a weighted combination of input variables. In a logistic model, z = β₀ + β₁x₁ + β₂x₂ + ... + βₖxₖ, where β₀ is the intercept, βᵢ are estimated coefficients and xᵢ are predictors. The model assumes that the selected predictors, coding, sample and validation process are appropriate; it does not guarantee causal relationships.

Model evaluation must consider both discrimination and calibration. Discrimination concerns whether higher-risk cases are ranked above lower-risk cases. Calibration concerns whether predicted probabilities correspond to observed frequencies. A model may rank patients well but systematically overestimate risk in one population. Evaluation should therefore include subgroup performance, missing-data behaviour, clinical usefulness and prospective monitoring.

A confusion matrix supports evaluation of a binary classifier:

Sensitivity is TP ÷ (TP + FN), while specificity is TN ÷ (TN + FP). Sensitivity measures the proportion of actual positive cases detected; specificity measures the proportion of actual negative cases correctly rejected. The choice of threshold depends on clinical consequences. Missing a dangerous condition may be more harmful than generating additional alerts, but excessive false alerts can cause alert fatigue.

8. Artificial Intelligence in Hospital Administration and Care

AI refers to computational methods that perform tasks associated with human intelligence, such as pattern recognition, language processing, prediction and decision support. Machine learning systems learn statistical relationships from data; generative AI produces text, images, code or other outputs from learned patterns. These systems can support appointment forecasting, coding assistance, clinical documentation, image interpretation, supply planning, patient communication and fraud detection.

AI should be introduced as a governed sociotechnical intervention, not as a software purchase. Before deployment, administrators should define the intended use, affected population, decision authority, performance requirements, failure modes and escalation process.

A responsible AI framework includes:

• Purpose and necessity: a clear problem and evidence that AI adds value.
• Data governance: lawful provenance, representative data and controlled access.
• Validity and safety: technical testing, clinical validation and monitoring after deployment.
• Fairness: assessment of unequal error rates and access consequences.
• Transparency: understandable information about system purpose and limitations.
• Human oversight: qualified staff can question, override and report the system.
• Accountability: named owners for procurement, use, incidents and review.
• Security: protection against data leakage, manipulation and adversarial misuse.
• Change control: reassessment when data, workflows, populations or models change.

Generative AI presents additional risks. It may produce plausible but false statements, disclose confidential information through inappropriate prompts, reproduce bias or create fabricated references. It should not be assumed to have verified knowledge. Sensitive use requires approved tools, restricted data handling, output checking and clear rules about authorship and responsibility.

AI procurement should require documentation of training data or data provenance where available, intended population, performance by subgroup, limitations, update procedures, audit access, cybersecurity controls, interoperability and liability. A pilot should define success measures before implementation. “Accuracy” alone is insufficient: the organisation should also measure workflow impact, equity, staff burden, patient outcomes and unintended consequences.

9. Implementation and Change Management

Information-system implementation is an organisational change programme. A practical sequence is:

1. Establish governance, sponsorship and measurable objectives.
2. Map current workflows and identify safety-critical processes.
3. Define requirements and minimum data standards.
4. Select or configure systems using transparent criteria.
5. Clean and map legacy data.
6. Test interfaces, permissions, downtime procedures and clinical scenarios.
7. Train users by role and provide at-the-elbow support.
8. Introduce the system in a controlled manner.
9. Monitor adoption, safety, quality and user experience.
10. Review benefits and continuously improve.

Common failures include excessive customisation, inadequate testing, poor communication, insufficient super-users, ignoring informal workarounds and measuring implementation only by whether the system went live. Human factors engineering is valuable: screens should reduce cognitive burden, alerts should be prioritised, and workflows should reflect actual clinical practice.

The benefits-realisation plan should connect technology to outcomes. For example, an electronic medication administration system may aim to reduce administration errors, improve documentation timeliness and support pharmacy reconciliation. The organisation should specify baseline measures, target values, responsible owners and review dates.

Illustrative Case: Regional General Hospital

Background

Regional General Hospital is a 350-bed facility operating an EHR, laboratory system, PACS, pharmacy application and separate appointment platform. The systems exchange some data, but emergency-department clinicians report delayed laboratory results, duplicate patient records and difficulty identifying patients recently discharged.

Problem

The executive dashboard shows an apparently stable average emergency-department length of stay. However, complaints are increasing, discharge summaries are often incomplete and readmissions among older patients appear to be rising. The hospital is considering an AI readmission-risk tool.

Analysis

A multidisciplinary team maps the patient journey and discovers three problems. First, laboratory results are transmitted through an interface that fails silently when a code is not recognised. Second, registration staff use inconsistent patient identifiers, producing duplicate records. Third, the dashboard uses a mean length of stay without displaying the median, high-percentile waits or results by arrival time and patient group. The proposed AI tool was trained in another health system and has not been validated locally.

Approach and solution

The hospital first creates an interface monitoring report with reconciliation of failed messages. It improves patient-identity verification, merges duplicate records through a controlled process and assigns a master-patient-index steward. Dashboard definitions are rewritten, with data freshness displayed and waiting time stratified by clinical pathway. The hospital also introduces discharge-summary completeness audits and a follow-up process for high-risk patients based initially on clinician assessment rather than unvalidated AI.

The AI tool is then evaluated in a silent pilot: it generates predictions but does not influence care. The team assesses calibration, discrimination, subgroup performance, missing data and workload. The governance committee requires clinician review, documented reasons for overrides and a process for patients or staff to report concerns. Deployment is approved only for a narrowly defined use with ongoing monitoring.

Outcome

The hospital identifies that many apparent “readmissions” were caused by duplicate records. Interface failures are detected earlier, and managers discover that long waits are concentrated in evening arrivals rather than evenly distributed. The AI pilot performs less reliably for a subgroup under-represented in the training data, so deployment is postponed pending better data and workflow redesign.

Learning points

The case demonstrates that data quality and interoperability are prerequisites for credible analytics. A dashboard can conceal operational problems if its definitions are weak. AI cannot compensate for poor identity management, incomplete records or unsuitable workflows. Responsible innovation may require delaying deployment until evidence and safeguards are adequate.

Challenges and Limitations

Hospitals face persistent challenges: legacy systems, vendor lock-in, incompatible standards, limited budgets, staff resistance, cybersecurity threats, variable digital literacy and unequal patient access. Data collected for care may be unsuitable for research or prediction without cleaning and contextual interpretation. Administrative indicators can create perverse incentives when targets become more important than patient welfare.

Analytics may reproduce historical inequalities. If a service was less accessible to a population in the past, a model trained on its utilisation data may incorrectly treat low use as low need. Missing data are often not random; they may reflect language barriers, poverty, disability, clinical workload or unequal documentation. De-identification can reduce privacy risk but may also remove information needed to assess equity.

No dashboard, model or AI system is neutral. Choices about what to measure, whose data are included, which errors are tolerated and who can challenge a decision are ethical and managerial choices. Professional accountability remains necessary even when decisions are supported by automation.

Best-Practice Checklist

A hospital seeking to strengthen its information capability should:

• maintain a current inventory of systems, interfaces and data owners;
• use standard patient identification and terminology practices;
• define data-quality rules at the point of capture;
• design dashboards around decisions rather than decoration;
• publish indicator definitions, denominators and data freshness;
• test cybersecurity controls and downtime procedures regularly;
• apply least privilege, multi-factor authentication and monitored access;
• assess telehealth suitability, accessibility and emergency escalation;
• validate predictive models locally and across relevant subgroups;
• require human oversight and documented accountability for AI;
• involve patients and frontline staff in design and evaluation; and
• review systems continuously as technology, populations and risks change.

Chapter Summary

Health information systems are organisational infrastructures composed of technology, data, people, processes and governance. EHRs provide longitudinal patient information, while broader hospital information systems support clinical, administrative and operational functions. Interoperability requires technical connection as well as syntactic, semantic and organisational compatibility. Standards such as FHIR, DICOM, LOINC, ICD and SNOMED CT support exchange and meaning but do not eliminate the need for governance.

Telehealth can expand access when clinical suitability, privacy, identity, documentation and escalation are addressed. Cybersecurity protects confidentiality, integrity and availability and must be treated as a patient-safety responsibility. Data quality includes accuracy, completeness, timeliness, validity, consistency, uniqueness, relevance and accessibility. Dashboards are useful only when indicators have clear definitions, appropriate denominators, responsible owners and meaningful stratification.

Descriptive analytics explains what happened; diagnostic and prescriptive approaches support investigation and action; predictive analytics estimates future outcomes but does not establish causation or replace professional judgement. AI requires purpose limitation, representative data, validation, fairness assessment, transparency, human oversight, security and continuous monitoring. Successful digital transformation is therefore not simply the acquisition of software. It is the disciplined governance of information for safer, more equitable and more effective hospital services.

Key Terms

Health information system: An organised combination of people, processes, technology and governance for managing health information.

Hospital information system: A hospital-wide system supporting clinical, administrative and operational functions.

Electronic health record: A longitudinal digital record of an individual’s health information.

Master patient index: A controlled index linking records to unique patient identities.

Interoperability: The ability of systems to exchange and use information meaningfully.

Semantic interoperability: The ability of systems to preserve and interpret the meaning of exchanged data.

FHIR: A standard framework using modular healthcare resources and interfaces for information exchange.

DICOM: A standard for medical images and associated information.

Telehealth: Delivery of health-related services through communication technologies across distance.

Cybersecurity: Protection of information systems against threats to confidentiality, integrity and availability.

Least privilege: Granting users only the access necessary for their authorised duties.

Data quality: Fitness of data for its intended use.

Dashboard: A focused display of indicators supporting monitoring and decision-making.

Descriptive analytics: Analysis that summarises what has happened.

Predictive analytics: Analysis that estimates the likelihood or value of future outcomes.

Sensitivity: The proportion of actual positive cases correctly identified by a test or model.

Specificity: The proportion of actual negative cases correctly identified by a test or model.

Artificial intelligence: Computational methods that perform tasks associated with human intelligence.

Model calibration: Agreement between predicted probabilities and observed outcome frequencies.

Information governance: Policies, responsibilities and controls governing information use, protection and accountability.

Review Questions

Short Answer Questions

1. Distinguish an electronic health record from a hospital information system.
2. What are the four major dimensions of interoperability?
3. State the three elements of the cybersecurity CIA triad.
4. Define data completeness and explain why it does not establish accuracy.
5. Why should a predictive model be evaluated for calibration as well as discrimination?

Long Answer Questions

1. Explain how interoperability standards and terminology services support safe hospital information exchange.
2. Discuss the benefits, limitations and governance requirements of telehealth.
3. Describe a comprehensive cybersecurity and business-continuity programme for a hospital.
4. Explain how administrators should design a dashboard for emergency-department performance.
5. Discuss the principles of responsible AI governance in hospital administration.

Analytical / Application Questions

1. A hospital’s reported average waiting time improves, but complaints from one patient group increase. What data-quality, dashboard-design and equity analyses should be undertaken?
2. A predictive readmission model has good overall accuracy but performs poorly for a minority population. Should it be deployed? Justify a governance decision and propose next steps.
3. During a ransomware incident, the EHR becomes unavailable. Develop an immediate operational response and a subsequent recovery and learning plan.

Multiple Choice Questions with Answers

Question 1

Which feature most directly distinguishes semantic interoperability from technical interoperability?

A. The systems use the same network connection.

B. The systems exchange data using encryption.

C. The receiving system correctly interprets the meaning of exchanged data.

D. The systems are purchased from the same vendor.

Correct Answer: C. The receiving system correctly interprets the meaning of exchanged data.

Question 2

Which control best reflects the principle of least privilege?

A. Giving every employee access to all records during working hours.

B. Giving each user only the access required for authorised duties.

C. Allowing users to share one departmental account.

D. Removing all audit logs to improve system speed.

Correct Answer: B. Giving each user only the access required for authorised duties.

Question 3

A hospital records 18 falls during 6,000 occupied bed-days. What is the fall rate per 1,000 occupied bed-days?

A. 0.3

B. 3

C. 30

D. 333

Correct Answer: B. 3

Question 4

Which data-quality dimension asks whether required values are present?

A. Completeness

B. Specificity

C. Uniqueness

D. Timeliness

Correct Answer: A. Completeness

Question 5

Which statement best describes descriptive analytics?

A. It estimates a future outcome using a predictive model.

B. It summarises patterns and events that have already occurred.

C. It automatically makes clinical decisions without human review.

D. It encrypts information before transmission.

Correct Answer: B. It summarises patterns and events that have already occurred.

Question 6

In a screening context, sensitivity is the proportion of:

A. Actual positive cases correctly identified.

B. Actual negative cases correctly identified.

C. Predicted positive cases that are truly positive.

D. All cases receiving a positive result.

Correct Answer: A. Actual positive cases correctly identified.

Question 7

Why is local validation important before deploying an AI model developed elsewhere?

A. Local data and workflows may differ from those used during development.

B. Validation eliminates the need for human oversight.

C. A locally validated model cannot produce false positives.

D. Local validation guarantees that the model is legally approved.

Correct Answer: A. Local data and workflows may differ from those used during development.

Question 8

Which dashboard practice most improves interpretability of a hospital rate?

A. Displaying the rate without its denominator.

B. Using only a single colour for every result.

C. Defining the numerator, denominator, exclusions and reporting period.

D. Removing data-quality warnings from the display.

Correct Answer: C. Defining the numerator, denominator, exclusions and reporting period.

Question 9

What is a major risk of generative AI in hospital administration?

A. It can produce plausible but false information.

B. It can only process paper records.

C. It cannot generate text or summaries.

D. It automatically guarantees patient confidentiality.

Correct Answer: A. It can produce plausible but false information.

Question 10

During an EHR outage, which action is most appropriate?

A. Continue clinical work without documentation until the system returns.

B. Use approved downtime procedures and reconcile records after recovery.

C. Delete incomplete records created before the outage.

D. Disable all patient-identification checks.

Correct Answer: B. Use approved downtime procedures and reconcile records after recovery.