{"resourceId":"uthsch-ai-governance-hsais-procurement-audit-20260609","versions":[{"version":"external-d855b462dbecdf45bcc077abd6a98db6d25a72ea52090ae6d2b01034a8a9edef","resource":{"id":"uthsch-ai-governance-hsais-procurement-audit-20260609","title":"UTHealth Houston audit: seven of 15 large software buys lacked HSAIS AI classification assessments","organization":"UTHealth Houston Auditing & Advisory Services","sector":"Public academic health science center / university system audit","geography":"United States (Texas; UT System)","publishedAt":"June 9, 2026 (issue date); PDF modified July 28, 2026","publicationDate":"2026-06-09","eventDate":null,"sourceName":"UT System / UTHealth Houston internal audit report HSC25AS0001","sourceLabel":"Artificial Intelligence Governance assurance engagement report","sourceUrl":"https://utsystem.edu/sites/default/files/documents/ut-system-reports/2026/uthsch-artificial-intelligence-governance-report/uthsch-artificial-intelligence-governance-report.pdf","evidenceClass":"government-audit","outcomeClass":"mixed","topics":["governance-procurement","data-security","operating-model"],"finding":"UTHealth Houston internal audit concludes overall AI deployment governance is adequate but identifies high-risk inconsistency: of 15 software purchases over $100K in the Jan 1–Feb 28, 2026 scope (14 renewals, 1 new), six renewals and one new purchase were not assessed for Heightened Scrutiny Artificial Intelligence System (HSAIS) classification by Information Security. A medium finding notes HOOP 235 still requires AI Governance Committee approval even though management says the committee no longer approves AI systems. Management committed Coupa AI-identification triggers, an HSAIS checklist aligned to SB 1964/DIR/UT System, and a HOOP 235 update (policy update targeted January 15, 2027).","sledRelevance":"Concrete campus/health-university procurement control failure mode: AI risk classification not consistently triggered on large software renewals. Why now: Texas SB 1964 / DIR AI implementation remains an active operating constraint for Texas public institutions, and this PDF was not previously archived for campus-operations despite relevance alongside the archived SUNY AI governance audit.","evidence":"Four-page assurance report, fieldwork ended May 4, 2026, issued June 9, 2026, retrieved as official UT System PDF. Sample limited to >$100K purchases in a two-month window; conclusion of 'adequate' governance coexists with a High-rated observation. Not a GenAI outcome evaluation.","architectureImplications":"Procurement systems (e.g., Coupa) need AI-identification fields that automatically notify Information Security before purchase/renewal completes; AI inventory and HSAIS classification must cover renewals, not only new buys.","governanceImplications":"Written policy must match actual approval pathways. Committee-approval language that no longer reflects practice creates compliance fiction; update HOOP-like policies when operating models change under state AI statutes.","securityPrivacyImplications":"Missing HSAIS classification risks inadequate heightened scrutiny for systems that may process sensitive health/education data, with explicit regulatory noncompliance risk cited by auditors.","caveats":"Single institution, short sample window, internal audit rather than external performance audit of AI accuracy or benefits. Academic medical context differs from general campus admin, though procurement control lessons transfer. Management responses are commitments, not verified closures.","streamIds":["campus-operations"],"roles":{"sales":"Public university and health-campus buyers under state AI rules need procurement workflows that catch AI features on renewals, not just shiny new copilots. UTHealth's audit found seven of fifteen >$100K buys lacked HSAIS classification assessments despite an overall 'adequate' governance conclusion. Sell process design—intake questions, security notification, inventory—rather than another model license. Do not claim this audit proves peer institutions fail similarly.","engineering":"Engineering due diligence should verify whether purchasing systems flag AI features, whether renewals enter the AI inventory, and whether written policy still demands committee approvals that no longer occur. Map HSAIS or equivalent state criteria into a checklist tied to inventory records. Prerequisites include recent purchase samples, named system owners, and InfoSec capacity to assess. Constraints: UTHealth's sample is two months and >$100K only in an academic medical setting. Proof of value is closed-loop resampling showing completed classifications after Coupa-style triggers go live.","delivery":"Delivery work is control remediation rather than a new model deployment: add an AI identification question on software requests, notify Information Security automatically, implement an HSAIS checklist aligned to statute/DIR guidance, backfill inventory for missed renewals, and rewrite policy to match the live approval path. Ownership is joint between supply-chain/procurement and the CISO, with audit-committee follow-up on the High observation. Acceptance is sampled evidence that renewals and new buys receive timely classification—not merely a committed implementation date."},"roleDetails":{"sales":{"customerProblem":"Large software renewals can introduce or expand AI capabilities without consistent heightened-scrutiny classification, creating regulatory and oversight gaps.","stakeholders":["CISO / Information Security","Procurement / Supply Chain","AI governance committee","Audit committee","System owners"],"discoveryQuestions":["Do renewals over threshold require AI/HSAIS assessment today?","What system forces an AI identification question at purchase request?","Does written policy still require committee approvals that no longer occur?","How is the AI System inventory kept complete for embedded AI?"],"valueHypothesis":"Tightening procurement-triggered AI classification can reduce oversight gaps like those sampled at UTHealth, without claiming improved clinical or administrative outcomes.","potentialEngagement":"Procurement-control gap assessment: sample 15 recent >$100K software actions against HSAIS/AI inventory requirements and draft Coupa-style control changes.","unsupportedClaims":["Guaranteed SB 1964 compliance via any vendor product","Institution-wide AI risk elimination","Measured operating savings from governance fixes"]},"engineering":{"fit":"Public university/health-campus AI governance integrated with procurement and information security review.","architectureIntegration":"Purchase-request workflow field for AI use; automated notify to InfoSec; HSAIS checklist artifacts tied to AI inventory records; policy repository aligned to live process.","prerequisites":["Access to recent purchase/renewal samples","Documented HSAIS/state criteria","AI System inventory process","Named system owners accountable to request assessments"],"constraints":["Two-month, >$100K sample only","Health-science regulatory overlay","Policy update may lag statute guidance"],"security":"Ensure HSAIS classification and enhanced assessment/tracking occur before AI-capable systems process sensitive data; treat missing assessments as High risk per this audit's rating.","proofOfValue":["Re-sample purchases after control change for 100% assessment completion","Verify inventory entries for previously missed renewals","Confirm policy text matches actual approval authority"]},"delivery":{"work":"Implement procurement AI identification, InfoSec notification, HSAIS checklist, inventory backfill, and HOOP/policy update project.","dependencies":["Coupa/procurement platform admins","Information Security","General counsel/policy owners","System owners for renewals"],"ownership":"Joint: VP Supply Chain / procurement process owners and CISO; audit committee oversight for closure.","skillsAdoption":"Train requesters and system owners to identify AI features in renewals and to request assessments; train InfoSec on SB 1964 HSAIS checklist.","governanceCheckpoints":["Control design approval","Pilot on purchase requests","Audit follow-up on High observation closure"],"acceptanceCriteria":["AI identification question live on software procurement requests","Sampled >$100K renewals show completed HSAIS/AI assessments","Updated policy reflects actual AI approval pathway"],"risks":["Owners fail to request assessments despite new fields","Checklist theater without substantive review","Policy update slips while practice remains noncompliant"]}},"retrievedAt":"2026-09-17T03:05:55Z","enrichedAt":"2026-09-17T03:05:55Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Audit focuses on governance staffing/process adequacy rather than frontline workforce displacement; notes institutional risk that reliance on AI requires more controls and staffing.","procurementImplications":"Renewals must be treated as AI-risk events; procurement and InfoSec need a forced handoff. Contract language alone is insufficient if classification never runs.","operatingModelImplications":"AI governance operating model must synchronize statute-driven HSAIS processes, inventory, procurement systems, and written policy—or 'adequate' frameworks still miss high-dollar renewals.","sourceVerification":{"openedUrl":"https://utsystem.edu/sites/default/files/documents/ut-system-reports/2026/uthsch-artificial-intelligence-governance-report/uthsch-artificial-intelligence-governance-report.pdf","referenceExcerpt":"We noted six renewals and one new purchase were not assessed for HSAIS classification by Information Security.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}