Healthcare Runs on Compute Now: How AI, Data Centers, Cloud Infrastructure, and Energy Are Reshaping Healthcare Delivery

Every healthcare organization in the United States is now running its clinical operations on infrastructure itdoes not own and, in most cases, could not independently rebuild: cloud platforms, graphics processingunits, foundation models, data centers, electrical grids, and a small number of cybersecurity andinteroperability vendors sitting beneath all of it, largely unexamined. This report calls that dependencywhat it is, an unpriced concentration risk, and it tests the assumption that this infrastructure will simply bethere when a hospital needs it. The evidence says otherwise. A single cyberattack on one claims clearinghouse disrupted direct patientcare at 74 percent of surveyed hospitals nationwide in 2024. A single flawed software update from onecybersecurity vendor detectably disrupted services at 759 hospitals five months later, more than a fifth ofthose disruptions patient facing. Both events shared the same underlying cause, a level of concentration incritical infrastructure that no hospital board had modeled as a clinical risk. Meanwhile, the next layer ofthat infrastructure, the data centers and electrical capacity an AI enabled healthcare system will require, isbeing built against transformer lead times that have roughly doubled since 2020 and now stretch past threeyears for the largest units, inside a grid expected to carry a data center load that grows from roughly 24gigawatts to 100 gigawatts nationally by 2030. This report introduces the Clinical Sovereignty Stack, a ten layer model of the dependencies that now sitbetween electricity and a patient's care, and the Koru Clinical Sovereignty Index, a scoring framework thatlets a health system, an investor, or a regulator measure how exposed a given organization is across sevenspecific dimensions of that stack, including the growing risk posed by autonomous AI systems operating asattackers in their own right. The conclusion is not that hospitals should attempt technologicalindependence, an outcome this report considers both impossible and undesirable. It is that clinicalsovereignty, defined here as strategic control over critical dependency rather than self sufficiency, hasbecome as material to healthcare risk as the credentialing and regulatory dependencies this institute hasalready documented in The Speed Illusion, Report 005, and The Veto Outside the Model, Report 007, andalmost nobody in the industry is currently measuring it. Author: Marcus J. Frazier | Koru Health, a Koru Capital Management Company | Published by the Koru Research Institute | Korucm.com ORCID: 0009-0005-5094-9040