Healthcare can be a tough space for innovation. You want to move fast enough to stay competitive but not so fast that you compromise sensitive data, break compliance or build something you can’t maintain. It’s a tension that was highlighted in our recently commissioned industry research polled engineering, product and technology leaders across US healthcare organizations: 66% told us they spend much or somewhat more time managing operational and governance concerns than exploring innovation opportunities.

It’s not a surprising statistic, but it’s also not an inevitable one. To shed more light on successfully navigating innovation and compliance, we hosted a live panel discussion with David Pace, Executive Director at Merck Research Labs IT Enablement and User Experience, and two of our own team members, Development Team Lead Clarissa Borges and Principal Developer Joël Quenneville. They shared a few real-world tactics for balancing speed and security in the highly regulated healthcare industry.

Make secure choices easy and obvious

David Pace from Merck brought up a phrase during our talk that we’ve been thinking about ever since: happy paths. The idea is simple. Make it easy for people to do the right thing and make it obvious when they’ve wandered off course. Just one example: Merck launched a self-serve tool that allows people to compliantly publish internal websites with a few clicks vs. a multi-week process navigating enterprise security concerns and authorizations.

Joël shared how we embraced the happy path idea at the code level for a recent project. We made it easy for developers to safeguard protected health information (PHI) by using function names that included “with PHI” and “without PHI.” This small labeling choice serves as a bright red flag to catch potential issues in both human code reviews and AI-assisted security scans. The security risk (or lack thereof) sits right there in the function name, so it will feel wrong if you’re a developer typing the words “with PHI” when you’re working on a public page.

Treat AI like any other external vendor

AI presents an innovation opportunity, but in healthcare, there’s a ton of anxiety about security and compliance, too. In our survey, 59% of respondents told us they struggle significantly or moderately to evaluate new AI technologies consistently across governance, security, and operational requirements. But there’s an existing framework that can help you navigate the complexity: Think of AI as just another external service that you’re sending data to.

On a project involving an AI chat feature for product recommendations related to personal health issues, we used the top_secret Ruby gem (a thoughtbot open source project). It uses machine learning to identify sensitive information and filter it out from user messages before they ever reach an LLM. Then we added a second filtering layer to catch anything that slipped through before it reached a summary or another user.

But even with this mental model, governance still matters. At the enterprise level, Merck runs tiered AI governance. High-investment initiatives get a multidisciplinary review team spanning security, regulatory, risk management and AI expertise while smaller experiments run through approved tools like Gemini and Microsoft Copilot with lighter oversight. The goal is to reserve heavy governance for larger investments and risks.

Expect complexity as you modernize

At the enterprise level, the hardest architectural problems rarely show up in new systems. They show up at the seams where old and new meet. Healthcare teams told us that 52% of software initiatives fail frequently or usually because stakeholders underestimate integration complexity. The top challenges named: poor data quality and security concerns.

It’s a challenge enterprise teams know all too well, but half the battle may be knowing to expect these issues will inevitably pop up. At Merck, a multi-year effort to modernize the clinical development platform has meant building a clinical data layer that reconciles state-of-the-art tools with legacy systems, in-flight clinical trials, and data sources ranging from major hospital systems down to a single doctor’s office. That range in sophistication adds real complexity to any integration effort.

If you’re working on a newer project, Clarissa shared that codifying infrastructure by describing what you have—from VPCS to databases—decreases complexity down the line. This allows teams to build more confidently against the infrastructure, see versioning and review each other’s code.

Culture is the real balancing act

Ultimately, our panelists agreed that governance and innovation don’t have to be opposing forces. They recommend focusing on building a strong engineering, design and product culture that embraces creativity and experimentation while staying grounded in fundamentals.

If you’re navigating tension between speed and risk in a regulated environment, we’d love to help you think through the architecture, AI governance, or developer workflows that fit your team. Get in touch and let’s deliver reliable software for healthcare together.