Episode 223 - Podcast with Michael Archuleta, Chief Information Officer, Mt. San Rafael Hospital and Clinics
From Legacy Systems to AI-Native Healthcare in Rural America

Ritu: Hello, listeners. Welcome to Season Seven of the Big Unlock Podcast. My name is Ritu Oberoi, and I’m managing partner at Damo Consulting and your host today. We are welcoming Michael Archuleta to our podcast. Michael is the Chief Information Officer at Mount San Rafael Hospital, where he has helped transform a rural critical access hospital into a nationally recognized leader in digital innovation, cybersecurity, and healthcare IT. Michael is a perennial Becker’s Hospital CIO to Know, nationally recognized speaker, advisor to health technology companies, and someone whose work has spanned cloud transformation, cybersecurity, and AI adoption — and more recently, one of the most significant technology initiatives in the hospital’s history: the transition to Oracle Health. We are really excited to have Michael here with us today. Thank you for joining us on the podcast.

Michael: Thank you very much. It’s definitely a pleasure to be here.

Ritu: Michael, would you like to tell us a little more about Mount San Rafael Hospital so our listeners have some context?

Michael: Mount San Rafael Hospital is located in Trinidad, Colorado. Las Animas County is actually the largest county in the state of Colorado, with a population of about nine thousand in the city and around fourteen thousand across the county as a whole. I’ve always had a passion for rural healthcare, and I’ve always stated that your zip code should never determine your healthcare outcomes — that is such a critical element. Here at Mount San Rafael, we believe that whether a patient comes to us, to Denver Health, or to UC Health, they should receive the same level of care. We focus heavily on innovation and technology enhancements because in rural America, unfortunately, zip code does still determine outcomes. But we’ve been fortunate to bring a lot of innovation to what we do, and we’re proud to be a nationally recognized rural healthcare hospital within the state of Colorado.

Ritu: You’ve described your Oracle Health implementation as much more than an EHR replacement, and you recently shared the principle of “follow the patient journey, not the org chart” — a really powerful leadership philosophy. Tell us more about this project, and what advice would you give other CIOs embarking on similar modernization efforts?

Michael: I’ve always said that if you work in healthcare, your new CEO is the patient — that’s the bottom line. As a technology and business leader, the goal is to build tools that benefit our patients both inside and outside the organization. Patient care is number one. We have to look at initiatives that enhance patient care outcomes, improve the way we share information, and give clinicians a complete view of the patient’s health — along with the right toolsets to drive better outcomes. AI, used as an enhancement tool, can create better outcomes, better automation, better operations, and better clinical documentation. We put specific AI algorithms into our radiology practice, and I can literally say those have been life-saving. When an organization is considering replacing a system or investing in something new, you have to ask: what’s the why? Is it better operations? Better patient care? Every digital investment we’ve made has had a patient-centric strategy attached to it, because that’s how critical it is. Hospitals and clinics are digital companies that deliver healthcare services — we have to move away from the brick-and-mortar theology healthcare has been built on. Our strategic partnership with Oracle Health allows us to move into the next era, utilizing AI-native technology built directly into the process itself, from the EHR to the patient portal. That is our mission moving forward.

Ritu: We had Dr. Bharat Sutariya on the podcast from Oracle Health, and he also talked about being AI-native and how that’s going to be a real game changer — having everything built in rather than increasing clicks. I think you’ve leapfrogged a lot of health systems by moving ahead with this implementation.

Michael: A hundred percent. This move to Oracle Health was a strategic investment in the future of this organization. By integrating true clinical AI with a modern, unified EHR system, we’re giving our caregivers technology that removes barriers. How do we remove those consistent clicks? How do we let providers be providers again, instead of being attached to a workstation? Incorporating ambient AI removes those barriers, enhances clinical documentation, and reduces burnout. Providers are constantly seeing patients and sometimes fall behind on documentation — doing it after hours or at home. We have to show we’re investing in technology to create better automation, better efficiencies, and reduced administrative strain, while strengthening the connection between physicians and patients. This positions our facility to deliver a high-performing, more connected, and more sustainable model of care for the region.

Ritu: With AI becoming embedded across clinical workflows, you talk a lot about cybersecurity as fundamentally a patient safety issue rather than just an IT responsibility. How do CIOs need to approach cyber resilience as an essential component of clinical quality rather than just operational risk?

Michael: Cybersecurity has to be — and I consistently repeat this — a core component of the overall organizational strategy, period. I was looking at some data points from a national survey sent to many health systems, and only about 43% of healthcare organizations provide basic cybersecurity awareness training to their end users. We have a major gap where organizations aren’t focusing enough on security, and healthcare has gone from being in the top ten to the most attacked industry. When I go to my board of directors, I focus on three elements — what I call FOR: Financial, Operational, and Reputational. If a cybersecurity breach happens, what are the financial consequences, the operational consequences, and the reputational consequences? Framing it that way tells the story of why we continue to invest in security. Deep fake technology, especially with AI, is becoming more advanced than ever — voice clips, video clips designed to look legitimate. You’re on a Zoom call and you genuinely don’t know if you’re speaking with a real person or a deep fake created by a threat actor trying to compromise your organization. Social engineering is equally critical. We did something a bit out of the norm: beyond penetration testing, policies, and procedures, we ran a social engineering exercise where an individual with a badge similar to ours tried to access the facility to see how much access they could gain across different departments. It opened everyone’s eyes — attentiveness and vigilance are extremely important, and cybersecurity can be physical. Showing those results, the video clips of the individual trying to gain access to the garage, different units, flashing her badge as she moved through — those were powerful learning moments. We can have the best policies and procedures in place, but if we’re not actively testing them, we won’t be successful. Consistent testing and validation of your cybersecurity program is critical. We’ve focused heavily on deepfake and phishing awareness — phishing emails are getting more advanced and harder to detect because threat actors are using AI to create them. That’s why I’ve always said: we have to fight AI with AI. We focus on EDR, SIEM, SOC, identity management, two-factor authentication, and micro-segmentation. And if we do not invest in our human firewall, we will not have a successful outcome, because your end users are either letting threat actors in or keeping them out. Building that human firewall is one of the most important things we do.

Ritu: Thank you, Michael — that was really comprehensive. Rohit, would you like to ask a question?

Rohit: Thank you, Ritu. Michael, I was thinking about what you said in relation to the use of generative AI tools like ChatGPT by employees. We know everyone is embracing these tools in their personal lives and bringing that into the business environment, where they might inadvertently expose proprietary information. What are your thoughts on how generative AI is being embraced organization-wide, and what AI governance initiatives do you have in place?

Michael: Generative AI sites like Claude and ChatGPT are currently blocked within our entire environment. There have been breach issues with ChatGPT where individuals put in proprietary information — if an end user doesn’t configure the session correctly in OpenAI, the algorithm absorbs that information, and theoretically it could be leaked, creating a massive breach. So we’ve blocked all those tools. Right now we’re investing more in Microsoft Copilot, which is being rolled out across the organization, integrated into our Office 365 environment and customized to how we operate. Free-range use of general generative AI tools could create a major security issue. Copilot is the approved application with all the appropriate security processes in place — all other generative AI tools are completely blacklisted.

Rohit: So people have access to Microsoft Copilot for regular use?

Michael: That is correct — it’s a designated, approved application with all the security processes we’ve developed in place. All other generative AI tools remain blacklisted.

Rohit: How are you seeing adoption of Microsoft Copilot across departments?

Michael: There are a lot of great use cases. Departments are using it for finance validation, working directly in spreadsheets, developing reports and breaking them down into more readable formats, generating ideas, enhancing policies and procedures, and validating information. Departments are customizing how it fits their specific workflows, how to accelerate their work, and how to make things more efficient. It has been a really good tool for the organization.

Rohit: One more question — what are some of the innovation initiatives or processes you follow, and how do you foster innovation within the organization?

Michael: One of the biggest initiatives we’re focused on right now is the RHTP program — the Rural Hospital Transformational Program. It’s about $50 billion over five years, each state applies separately, and the State of Colorado received approximately $160 million. Critical access organizations are going to apply for this, and it’s really going to transform how rural health delivers healthcare services. This is where you’ll see a lot more innovation coming out of rural America — healthcare has gotten behind the curve on digital transformation, and in rural America the pace has been even slower. These funds will allow organizations to move in the right direction if they strategically align their projects with the application process. For us, a big driver is focusing more on remote patient monitoring and in-home hospital initiatives. We have many remote patients who have difficulty coming in and tend to wait until things get worse before seeing a provider, rather than having their health consistently monitored. As I said from the start, your zip code should never determine your healthcare outcomes — but in rural America, people statistically live shorter lives than those in metro areas because it’s very hard to access the same level of services. Our model has been: how do we focus, strategize, innovate, and bring technology that actually matters to the organization? We’re a CMS five-star hospital — one of only two rural facilities in Colorado to receive that designation. We’ve been a beta site and an innovator, doing more with less. We’re incorporating AI to help providers select appropriate CPT codes based on their completed documentation — before AI, providers were essentially acting as billers and coders, which took them away from being doctors. Reducing those barriers, automating the right things, and getting to a place where your zip code truly does not determine your outcomes is the philosophy and the direction we are moving in. The acceleration of digital transformation is definitely here.

Ritu: Totally agree. One final question: CIOs are now expected to oversee not just traditional IT, but AI, cybersecurity, cloud strategy, and digital experience. How do you see the role of the healthcare CIO evolving over the next couple of years, and which leadership capabilities will become more important than technical expertise?

Michael: I am a technology executive, but we have to be business leaders first. We have to understand the organization as a whole — not just from a technology standpoint, but as a complete operational entity. The CIO is increasingly focused on creating automation that enhances revenue cycle initiatives, and on moving away from the old stereotype of IT as purely a cost center versus a strategic revenue contributor to the organization. The evolution is about focusing on better patient care outcomes, recruitment, reducing burnout, business continuity, and operational excellence. Everything we do now has a technology piece associated with it. But the CIOs who will really make a difference are those using technology for better outcomes — technology that truly matters, technology with a patient-centric initiative attached. Those are the game changers and the innovators moving forward as the CIO role evolves.

Ritu: Thank you for that answer, Michael. That brings us to the end of the podcast. Thank you so much for being our guest today.

Michael: Thank you very much. You both do an amazing job.

Rohit: Thank you, Michael.

—

Subscribe to our podcast series at www.thebigunlock.com and write us at info@thebigunlock.com    

Disclaimer: This Q&A has been derived from the podcast transcript and has been edited for readability and clarity.