Stripe announced on 19 August that it is acquiring OpenRouter, the gateway that routes AI requests across more than 400 models from over 80 providers. The New York Times reported the price at $7.5 billion; Axios put it above $8 billion. Stripe disclosed no terms. NVIDIA, Zoom and Lovable already route through it.
Patrick Collison framed it in one sentence. Tokens are the central currency for companies building with AI.
Currency, from the company that built the pipes for the last one.
Most coverage filed this under payments strategy. For anyone who runs a hospital, a practice or a health plan, it belongs in a different folder — and the reason has almost nothing to do with Stripe.
The arrangement healthcare quietly relies on.
Nearly every health system in the country solved patient payments the same way. Use a processor that never touches the medical record, and rely on the payment-processing exemption under HIPAA.
That is why Stripe does not sign a business associate agreement and does not act as a business associate. It holds PCI Level 1 certification for card data, not HIPAA certification for health data. A hospital can take a card payment through Stripe entirely lawfully, provided protected health information never enters the system — not in an API field, not in metadata, not in an invoice line, a receipt or a webhook.
The important thing about that arrangement is what it rests on. It was never a judgment about the vendor being careful. It was a judgment about the vendor being structurally incapable of holding the thing that matters. Nothing can leak that never arrives.
Why de-identification is not the answer it appears to be.
The reflex at this point is to say that anything sensitive would be stripped or de-identified before it went anywhere near a model.
Rocher, Hendrickx and de Montjoye tested that assumption and published the result in Nature Communications in July 2019. Using a generative model, they found that 99.98% of Americans were correctly re-identified in any available anonymised dataset using just 15 characteristics, including age, gender and marital status.
Fifteen ordinary attributes. Not names, not diagnoses. The kind of fields that sit in a billing record, a marketing list or an appointment reminder.
That finding moves the risk from theft to matching, and matching is far cheaper than theft. It is also why the more serious exposure in healthcare is not the medical record at all. It is the money.
Offshore reinsurance: where accountability disappears.
Healthcare risk capital sits offshore at scale, and lawfully. The Cayman Islands has led the market in healthcare captives for thirty-five years and held 136 registered medical malpractice companies writing $3.2 billion in premiums as of the third quarter of 2024. Academic medical centres, national hospital chains and mid-sized regional systems all underwrite their own malpractice exposure through captives domiciled in Cayman, Bermuda and Vermont.
The Prospect Medical collapse shows what that structure does when it is tested.
Prospect Medical Holdings owned Waterbury Hospital in Connecticut. Like many operators, it chose to self-insure rather than buy commercial malpractice cover. It told regulators it would pay defence costs and settlements directly, up to $7.5 million per case in Connecticut and Rhode Island. In exchange for that promise, it was permitted to operate with no commercial policy beneath it.
Prospect set aside no money to honour that promise. There was no reserve. The commitment existed on paper and nowhere else.
The insurance subsidiaries that were supposed to hold the risk were located in Vermont and in the Cayman Islands. Pennsylvania's insurance department described what that placement achieved in plain words: it put them beyond Pennsylvania's reach. A state regulator could not examine the entity that was supposed to be protecting that state's patients.
Commercial reinsurance did sit above the self-insured layer, and it never paid a dollar. Those contracts obligated the reinsurers only once Prospect had paid its own share in full. Prospect could not pay its share, so the reinsurance never attached. A $7.5 million threshold that is never funded does not transfer risk. It blocks anyone from reaching the coverage above it.
No regulator caught this, because none was required to look. Connecticut's insurance department confirms that state law permits health systems to meet malpractice obligations through self-insurance, with no state responsibility for solvency oversight. Rhode Island received no required financial filings from Prospect after 2019 while the company continued self-insuring until 2025, and took no action.
Prospect filed for bankruptcy in January 2025. More than 300 lawsuits seeking over $800 million were frozen. The injured patients became unsecured creditors, likely to recover pennies on the dollar. The Cayman entity, Connecticut Healthcare Insurance Company, entered a winding-up proceeding involving a $26 million payment to Prospect and sought recognition of that Cayman process in a Texas bankruptcy court.
Bob Dorn died at Waterbury Hospital in March 2022. He had severe dementia and was, according to the complaint, left unattended with solid food. His death certificate records asphyxia from food blocking his airway. The reserve that was supposed to answer for his death was never funded, and the entity that was supposed to hold it sat where his state could not examine it.
Two towns away, over the same period, one of the country's largest cartel logistics cases was building — a network thirty years deep, running through the federal prison at Danbury and out to Mexican and Texas operations. While that network moved product through Danbury, its largest payroll and data protections sat in Cayman and Belgium reinsurance shells, and the community vulnerability was the difference between what those books insured and what they never intended to cover.
That architecture is not unique to Prospect, and it is not unknown to regulators. The Financial Action Task Force has flagged the insurance sector as a laundering vulnerability for two decades and identifies reinsurance specifically: offshore entities overpay for coverage, pushing money into reinsurers that eventually reaches primary carriers. The business is cross-border by design and frequently brokered by intermediaries the issuing company does not supervise.
The finding is the structure itself. It was built so that no domestic regulator could reach it, and arrangements built to be unreachable attract everyone who needs to be unreachable.
Maryland found its own version through a whistleblower rather than a regulator. Nonprofit hospitals there used Cayman captives to avoid the 3% premium tax commercial insurers pay. The state insurance regulator put the loss at a conservative $2 million a year, and the hospitals then asked the legislature to exempt them retroactively from the tax they had avoided. Testimony in that proceeding described it as a tax they had strategically evaded for years. Virginia and North Carolina systems have been reported on for decades with these same issues, and with fentanyl connection issues, and each reporter, whistleblower and Schedule III researcher — most of whom were only looking for technical infrastructure improvements to address fund losses — has met extreme blowback, including blackballing. The Congressional Research Service reported in March 2026 that nonprofit hospitals consistently fail to meet community benefit obligations under all but the broadest definitions.
The math that makes the structure work.
A captive is profitable to the degree that money comes in reliably and goes out rarely.
Start with what comes in. Those 136 Cayman medical malpractice companies wrote $3.2 billion in premiums as of the third quarter of 2024.
But what is supposed to be covered compared to what actually is covered is much more. So where are the non-covered actions and funds — or is it an actuary hand note, followed by a few bad actors treating executives to a good time somewhere?
Here is where it gets interesting. A reserve is not money in a vault. It is an estimate of claims not yet made, and that estimate decides how much cash the captive actually has to hold. Set it low and the captive looks fully funded on the same money.
The actuary who writes it is hired and paid by the group being assessed. That is the control. One professional opinion, commissioned by the people it examines.
Nobody else in the chain has a reason to argue. The captive manager exists because captives exist. The broker, the fronting carrier and the domicile all earn on volume rather than on whether the reserve is adequate. The industry's largest annual conference is held in the domicile that writes the policies, paid for by the firms that service them.
That is what holds a thin reserve in place. Not a conspiracy. A note from one actuary, and a room full of people whose income depends on nobody questioning it.
And the money can leave. A captive may release reserves it decides it no longer needs and pay them up to the parent as a dividend — lawful, routine, and the exact shape of the $26 million paid from Connecticut Healthcare Insurance Company to Prospect that later became the subject of a Cayman winding-up proceeding. Or, as the federal and bad actor followers term it, illicit funds can walk in and walk out as they please without worrying about any regulators or clamps on their funds' freedom. The written-off amounts can be as high as into the billions without anyone ever questioning the relationships. This is also where Mexico, Texas, Southern cartels and international cartels can learn more about what regions they want to dilute or desiccate.
Now what actually goes out. The National Practitioner Data Bank recorded 11,440 paid malpractice claims across the entire United States in 2023, totalling roughly $4.8 billion — an average near $420,000 per paid claim, rising to about $463,000 by 2025. Roughly 28% of paid claims came in under $100,000, and only about 11% exceeded $1 million.
Hold that against the premium figure. The money written into the healthcare captives of one offshore jurisdiction comes to about two-thirds of every dollar paid to every injured patient by every practitioner in the United States in a year.
The reason those numbers can sit that far apart is the pursuit rate. The Harvard Medical Practice Study found that roughly 1.53% of patients injured by medical negligence filed a claim — about sixty-five negligent injuries for every one that becomes a claim.
So the liability is real and it is almost never collected. The captive holds the difference as float, offshore, in a jurisdiction with no direct corporate income tax, for the years a malpractice matter takes to resolve. Slow claims are not a problem for this structure. Slow claims are the product.
None of that is fraud. Captives are a legitimate tool used well by serious institutions. The difficulty is what the arrangement rewards. Moving malpractice exposure into a captive feels prudent and reads well to a board, and it pays a benefit whether or not anyone ever funds the reserve — because the claims mostly do not come. The check that would expose an underfunded captive happens about one time in sixty-five, and by then the executive who approved it has usually moved on.
That is how Prospect promised $7.5 million a case, set aside nothing for years, and nobody noticed. The structure is built around an event that rarely happens. It happened three hundred times at once, and there was nothing behind it.
What actual oversight requires.
None of this is an argument that oversight is impossible. It is an argument about what oversight actually takes.
Catching an underfunded reserve is not a matter of reading one filing. It takes actuarial judgment — somebody who can look at a loss triangle and see that the assumptions moved before the numbers did. And it takes human intellect that recognises a pattern across years, across entities and across the regulatory record: the filing that stopped arriving, the domicile that changed, the reserve that fell while exposure grew, the language in a disclosure that is doing more work than it should.
Neither of those is a checkbox. Neither can be done by whoever has spare time at quarter end.
That is the work that gets cut first, because in a good year it produces nothing visible. A compliance function is measured in events that did not happen, which is the hardest thing to defend in a budget meeting and the easiest thing to defer.
Maryland found its problem through a whistleblower. Connecticut found its through a bankruptcy. In both cases the pattern had been visible for years to anyone whose job was to look for a pattern. Nobody's job was.
None of which is an argument for doing it by hand.
The failure in every case here was not that somebody used the wrong tool. It was that nobody was assigned to look at all. Rhode Island received no filings for six years. Maryland's arrangement surfaced through a whistleblower. Connecticut's surfaced through a bankruptcy. In each one the material was available and the pattern was legible. There was simply no one reading.
That gap is precisely what this software is good at closing. A model will read four hundred filings and hold all of them in view at once. It will flag the six where reserves fell while exposure grew, notice that a domicile changed, catch the same unusual phrasing in three unrelated disclosures, and register that a document which arrived every quarter for six years stopped arriving. It does this on filing four hundred with the same attention it brought to filing one, which no person does.
What it will not do is decide that any of it matters.
That judgment — anomaly or pattern, thin explanation or ordinary one, escalate now or watch another quarter — needs somebody who carries professional responsibility for being wrong, and who has sat in enough rooms to know when an explanation is working too hard. A model has no stake in the answer. That is exactly what makes it useful for the reading and useless for the deciding.
So the right arrangement is not fewer people running software. It is the same people covering ground they could never previously cover, with something reading ahead of them.
And that is worth saying plainly to whoever signs the budget. Compliance functions have spent two years being told that AI means headcount reduction. The evidence in this article says the reverse. Every failure described here happened inside an institution that already had too few people watching too much surface. Software that expands the ground a small team can cover is the argument for keeping the team, not for cutting it — and it is the only version of this technology that would have caught a single one of these cases.
What this has to do with a router.
Nothing has broken, and payments are unaffected. OpenRouter's own policy is genuinely good: prompts are not retained unless a customer opts into logging, zero data retention can be enforced globally or per request, and providers that do not retain data cannot train on it.
Three things sit outside that, and all three appear in the documentation.
There is a discount for turning logging on, which is a commercial incentive to weaken your own posture and exactly the setting an engineer changes to reduce spend without telling compliance. Protection is the union of the gateway's policy and whichever downstream provider actually received the request, so unenforced routing means unknown terms. And zero retention does not apply to plugins and tools you choose to enable, such as web search.
None of that changed in August. The owner did.
The relevance is not that Stripe will do anything with health data. It is that an institution willing to route its risk capital through an entity its own state cannot examine will route its data on the same logic, for the same reason, with nobody checking either one. The governance failure is identical. Only the asset changes.
And the exposure is priced. IBM's 2026 Cost of a Data Breach study, conducted by Ponemon across 602 organisations, puts the average healthcare breach at $6.64 million — the costliest sector for the thirteenth consecutive year. The United States average across all industries is $11.5 million, more than double the global figure.
But the more useful number is who gets blamed. Business associates were involved in an average of 34% of healthcare breaches between 2018 and 2026, and in the first half of 2026 that reached 43%. Nearly half of all healthcare breaches now arrive through a vendor.
That creates a convenient exit. When the breach lands at the third party, the health system announces that a vendor was compromised, that the relationship is under review, and that it is moving to a new provider. The statement writes itself. The failure is attributed to somebody else's infrastructure. And nothing about the institution's own decision — what data it handed over, on what terms, with what oversight — is ever examined.
The regulation does not accept that trade. A business associate agreement distributes responsibility; it does not transfer liability. A covered entity remains accountable for patient and regulator notification even when the breach originates entirely with the vendor, and can be held liable where it knew, or by exercising reasonable diligence should have known, of a pattern of practice constituting a material breach of that vendor's obligations.
Reasonable diligence is exactly the standard a vendor swap fails. Replacing the supplier answers who was holding the data when it leaked. It does not answer why the data was there, who approved sending it, or whether anyone read the terms — and those questions survive the change of supplier entirely.
Change Healthcare is the scale marker. Roughly 190 million individuals affected, about $3.7 billion spent on cleanup by its parent, and a federal investigation still open. Every provider downstream of that breach could truthfully say a vendor was compromised. It did not make the data any less theirs.
Why the answer is still to buy the AI.
Everything above argues for governing the path. None of it argues against the tool, and treating it as an argument against the tool would be the expensive mistake.
Bought as a service, AI is not a capital asset. It is publishing — research, drafting, production, distribution. An ordinary operating expense, deducted in the year it is paid, with nothing to depreciate and no capital to raise. Congress moved the same direction on the build side: Section 174A restored immediate expensing for domestic software development for tax years beginning in 2025, reversing the rule that forced those costs to be spread across five years.
So the largest companies on earth are raising billions and depreciating a decade of steel and silicon. A health system can buy the same capability, expense it in the quarter it used it, and get documentation relief, prior-authorisation drafting and coding support for less than the cost of one contract nurse.
That is not a close call. AI is cheap, immediately deductible, and the correct purchase.
The discipline costs nothing.
Enforce zero retention at the account level rather than per request, so no individual engineer can trade it away for a discount. Confirm prompt logging is off, and lock the setting.
Pin anything touching clinical work to a named provider with a verified policy instead of letting a router choose on price. Disable plugins on those workloads.
Ask the gateway vendor directly whether they will sign a business associate agreement. If the answer is no, keep the medical record out of it — exactly as the institution already does with payments.
Then write the date down. Ownership of a component in the data path changed in August 2026. When someone asks in eighteen months whether anybody noticed, the useful answer is a dated note rather than a recollection.
None of that delays a single deployment. It is an afternoon of configuration and one memo.
Two things to take out of all of it.
Do not let AI replace your boots on the ground. The tools are worth buying and worth buying now, but they read what they are handed. They do not walk a floor, notice that a filing stopped arriving, catch that a number moved in the wrong direction two years running, or register that the person explaining a structure is uncomfortable explaining it. Every failure in this piece was visible to somebody standing in the right room. Nobody was standing there.
And check what your banking actually covers. Most commercial arrangements protect against fraud — an unauthorised transaction, a forged instrument, a compromised credential. Far fewer protect against loss: a counterparty that cannot pay, funds that turn out to be unrecoverable, a reserve that was never funded in the first place. Those are different products, priced differently, and the difference only becomes visible on the day it matters.
Then check it again against how money actually moves now. Wires and instant rails settle with finality. Once the payment is gone there is no recall window, no chargeback and no disputing party holding the funds while somebody works out what happened. Digital assets sit further outside again — deposit insurance covers a deposit at an insured bank, not a token balance, and custody terms vary enormously in what happens if the custodian fails. A great deal of the protection people assume is automatic was written for cheques and card rails, and does not follow the money onto the instruments a treasury team now uses every day.
And the vendor question runs in both directions. An institution that does not examine its own suppliers should assume its bank may not be examining its suppliers either. Every payment touches processors, gateways, aggregators and analytics vendors, each of them handling account information, and the diligence on that chain is only as strong as whoever was assigned to check it. A bank that has never looked has gaps it cannot describe — especially the ones that never bother to see where their shareholder and member data sits every second. There are famous cases of data sets passed on and used illicitly for decades, through nothing more exotic than an absence of vendor oversight. And the account holder inherits every one of those gaps without being shown a map.
Ask which one you hold, ask who else touches the money on its way through, and get both answers in writing.
The mine was never where the money was in a gold rush. It is in whoever weighs what comes out. The only question worth putting to a vendor this quarter is what else the scale can see.
About us.
Hako Shikin LLC has been making things for other people's brands since 1997, out of Virginia Beach, Virginia. It is the brand partner for brands that cannot afford a bad headline: one house that stays accountable from the first conversation to the pallet on the dock, rather than a chain of vendors each holding a piece and none of them holding the date. Four arms do the work. Huang Goodman for public relations, strategy and program management. Hako Shikin for production, routed across more than 1,400 vetted American manufacturers. POPS4 for the catalogue, 70,000+ products across 200+ brands. Prosecco4 for events. The people who call are usually holding something that matters and a date that will not move, and what they are looking for is rarely a proposal. It is somebody who picks up, gives them the real number, and is still standing there when the truck arrives.
If you are building from what is left, you are not finished.
-Jenny Huang Goodman MPA MSc MHSA jenny@huanggoodman.com