From the Campus Operations edition of September 16, 2026
UTHealth Houston audit: seven of 15 large software buys lacked HSAIS AI classification assessments
UTHealth Houston Auditing & Advisory Services · Public academic health science center / university system audit · United States (Texas; UT System)
- Publisher
- UT System / UTHealth Houston internal audit report HSC25AS0001
- Original publication
- June 9, 2026 (issue date); PDF modified July 28, 2026
- Source retrieved
- 2026-09-17
What happened
UTHealth Houston internal audit concludes overall AI deployment governance is adequate but identifies high-risk inconsistency: of 15 software purchases over $100K in the Jan 1–Feb 28, 2026 scope (14 renewals, 1 new), six renewals and one new purchase were not assessed for Heightened Scrutiny Artificial Intelligence System (HSAIS) classification by Information Security. A medium finding notes HOOP 235 still requires AI Governance Committee approval even though management says the committee no longer approves AI systems. Management committed Coupa AI-identification triggers, an HSAIS checklist aligned to SB 1964/DIR/UT System, and a HOOP 235 update (policy update targeted January 15, 2027).
Why it matters
Concrete campus/health-university procurement control failure mode: AI risk classification not consistently triggered on large software renewals. Why now: Texas SB 1964 / DIR AI implementation remains an active operating constraint for Texas public institutions, and this PDF was not previously archived for campus-operations despite relevance alongside the archived SUNY AI governance audit.
Evidence and measured results
Four-page assurance report, fieldwork ended May 4, 2026, issued June 9, 2026, retrieved as official UT System PDF. Sample limited to >$100K purchases in a two-month window; conclusion of 'adequate' governance coexists with a High-rated observation. Not a GenAI outcome evaluation.
Limitations and uncertainty
Single institution, short sample window, internal audit rather than external performance audit of AI accuracy or benefits. Academic medical context differs from general campus admin, though procurement control lessons transfer. Management responses are commitments, not verified closures.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-17; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Large software renewals can introduce or expand AI capabilities without consistent heightened-scrutiny classification, creating regulatory and oversight gaps.
- Stakeholders
- CISO / Information Security
- Procurement / Supply Chain
- AI governance committee
- Audit committee
- System owners
- Discovery questions
- Do renewals over threshold require AI/HSAIS assessment today?
- What system forces an AI identification question at purchase request?
- Does written policy still require committee approvals that no longer occur?
- How is the AI System inventory kept complete for embedded AI?
- Value hypothesis
- Tightening procurement-triggered AI classification can reduce oversight gaps like those sampled at UTHealth, without claiming improved clinical or administrative outcomes.
- Potential engagement
- Procurement-control gap assessment: sample 15 recent >$100K software actions against HSAIS/AI inventory requirements and draft Coupa-style control changes.
- Unsupported claims
- Guaranteed SB 1964 compliance via any vendor product
- Institution-wide AI risk elimination
- Measured operating savings from governance fixes
Pre-sales engineering
Role takeaway
- Fit
- Public university/health-campus AI governance integrated with procurement and information security review.
- Architecture and integration
- Purchase-request workflow field for AI use; automated notify to InfoSec; HSAIS checklist artifacts tied to AI inventory records; policy repository aligned to live process.
- Prerequisites
- Access to recent purchase/renewal samples
- Documented HSAIS/state criteria
- AI System inventory process
- Named system owners accountable to request assessments
- Constraints
- Two-month, >$100K sample only
- Health-science regulatory overlay
- Policy update may lag statute guidance
- Security
- Ensure HSAIS classification and enhanced assessment/tracking occur before AI-capable systems process sensitive data; treat missing assessments as High risk per this audit's rating.
- Proof of value
- Re-sample purchases after control change for 100% assessment completion
- Verify inventory entries for previously missed renewals
- Confirm policy text matches actual approval authority
Delivery
Role takeaway
- Work
- Implement procurement AI identification, InfoSec notification, HSAIS checklist, inventory backfill, and HOOP/policy update project.
- Dependencies
- Coupa/procurement platform admins
- Information Security
- General counsel/policy owners
- System owners for renewals
- Ownership
- Joint: VP Supply Chain / procurement process owners and CISO; audit committee oversight for closure.
- Skills and adoption
- Train requesters and system owners to identify AI features in renewals and to request assessments; train InfoSec on SB 1964 HSAIS checklist.
- Governance checkpoints
- Control design approval
- Pilot on purchase requests
- Audit follow-up on High observation closure
- Acceptance criteria
- AI identification question live on software procurement requests
- Sampled >$100K renewals show completed HSAIS/AI assessments
- Updated policy reflects actual AI approval pathway
- Risks
- Owners fail to request assessments despite new fields
- Checklist theater without substantive review
- Policy update slips while practice remains noncompliant
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Procurement systems (e.g., Coupa) need AI-identification fields that automatically notify Information Security before purchase/renewal completes; AI inventory and HSAIS classification must cover renewals, not only new buys.
Governance
Who approves, reviews and stays accountable for outcomes?
Written policy must match actual approval pathways. Committee-approval language that no longer reflects practice creates compliance fiction; update HOOP-like policies when operating models change under state AI statutes.
Security and privacy
What data, permissions and controls need testing?
Missing HSAIS classification risks inadequate heightened scrutiny for systems that may process sensitive health/education data, with explicit regulatory noncompliance risk cited by auditors.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Audit focuses on governance staffing/process adequacy rather than frontline workforce displacement; notes institutional risk that reliance on AI requires more controls and staffing.
Procurement
What should contracts, pricing and exit terms secure?
Renewals must be treated as AI-risk events; procurement and InfoSec need a forced handoff. Contract language alone is insufficient if classification never runs.
Operating model
Which teams own the service once it runs?
AI governance operating model must synchronize statute-driven HSAIS processes, inventory, procurement systems, and written policy—or 'adequate' frameworks still miss high-dollar renewals.
Publication history
- 2026-09-16Campus Operations · Issue 114 resources
Stable resource ID: uthsch-ai-governance-hsais-procurement-audit-20260609