When hospital staff build their own software: vibe coding and the question of who is responsible

Every week, in the surgical department of a French hospital, someone spent several hours copying the operating schedule by hand onto patient labels. A nurse manager replaced the task with a single HTML file that reads the export from the theatre planning software and prints the labels. He did not write the code himself: he described what he wanted to an AI model, and by his account the working version took about two hours to build. The file runs in the browser, makes no network request and keeps nothing once the tab is closed.

Thomas Gharmoul, head of innovation and AI at Hôpital Foch in Suresnes and an expert in digital health and AI for ANAP, the French national agency for health and social care performance, told this story in an interview for Tech Anatomy in November 2026. The practice is called vibe coding, and Gharmoul has co-written a white paper on it with the mathematician Sameh Mohamed. His starting point is that it is already happening inside hospitals, whether or not management knows.

What vibe coding means, and what it changes

The term was coined in February 2025 by Andrej Karpathy, a founding member of OpenAI who later led AI at Tesla. Karpathy described an extreme version of the practice: accepting whatever code the model produces, without reading it, for throwaway weekend projects. Gharmoul's definition is broader and more practical. A person describes the application they need in plain language, as if writing a specification for a developer, except that there is no team, no budget and no timeline, only the person and the model. One prompt, he says, does not produce a finished tool.

Hospital staff did not wait for AI to build their own tools: shared spreadsheets, sometimes holding patient data, have long escaped the IT department. What changes, in Gharmoul's account, is the scale: small tools for "daily irritants" that were never worth a procurement process can now be built in an afternoon. A commercial product for the label problem probably exists, he suggests, but bundled in a paid package that a single department would struggle to justify. Nobody at Foch, he adds, has tried to rebuild the patient record.

The case against banning it

Many hospitals responded to generative AI by blocking access to public chatbots. Gharmoul calls this, in translation, "putting a plaster on a wooden leg", a French expression for a remedy that leaves the problem untouched. The institution is legally covered, he says, but staff photograph their screen and ask a chatbot on their own phone. He recalled one establishment that, despite blocking access, recorded hundreds of thousands of connections to generative AI tools in a single month. He did not name it, and the figure could not be traced to a published source.

His alternative, set out in the white paper, is the CLAS, a Centre Local d'Applications en Santé (local health applications centre), with three parts: a sandbox where staff build applications with a language model inside a secured infrastructure, an internal store where finished applications can be shared across the hospital, and an organisational layer of people from innovation and IT who coach staff through the process. A committee decides which prototypes graduate to the store, with different classes depending on the risk an application carries. "It really is the irritant that defines the tool," he says (translated from French). The support team is there to help staff build their own tools, he adds, not to build them in their place.

Where a homemade tool becomes a medical device

The interview included a game, also released as a short episode, in which Gharmoul judged hospital scenarios as good or bad ideas. The first scenario was a junior doctor who vibe codes a dose calculator for his department on a Sunday evening. Gharmoul's answer was that the idea is good but needs a conversation, because a tool that calculates doses to be administered may "cross over to the medical device side", which brings "a whole set of regulatory questions that must not be dodged."

The European framework he is pointing to is the Medical Device Regulation (EU) 2017/745. Software that calculates a dose for an individual patient can qualify as a medical device. The regulation does allow hospitals to make and use devices in house without CE marking, under Article 5(5), but the conditions are strict. According to Commission guidance (MDCG 2023-1), the device must meet the regulation's safety and performance requirements, be made under a quality management system, be justified by the lack of an equivalent product on the market, be declared publicly and never be transferred to another legal entity. That last condition would apply to any plan to share such tools between hospitals. In the interview, Gharmoul drew a similar line: anyone can prototype with synthetic data, but moving an application up in status requires regulatory and technical milestones, because "the risks are too great to let things happen and let them spread."

Two readings of the same trend

One reading treats vibe coding as a release valve. Staff know their workflows better than any vendor, the tools are small, and a supervised framework carries less risk than the spreadsheets and personal chatbot accounts already in use. Gharmoul says he has not yet seen a tool that turned out to be useless or a whim.

A second reading focuses on what happens after the first version works. Code generated by a model may contain behaviour its author never asked about and cannot see, which Gharmoul himself flags as a source of security flaws. Each tool also creates a maintenance dependency. "What happens when the person who created the application leaves?" he asks. A hospital with dozens of such tools inherits dozens of small software products, each with an owner who may leave. Both readings accept that the practice is spreading; they differ on whether a framework can keep pace.

What the interview does not establish

The evidence discussed is anecdotal. Gharmoul said a hospital survey suggested that more than 30% of staff declare using AI even without an institutional tool, without naming the study, and that responses to his own maturity barometer for hospitals are still too few to publish figures. He acknowledged that his role biases his sense of how widespread vibe coding is. The white paper describes the CLAS as a model built on Foch's experience, but neither the interview nor the document states that it is in operation there, and the time savings it projects are estimates. The label generator also illustrates how blurred the line around health data is: a tool that runs offline still handles patient names and dates of birth.

What to watch

Two signals would show whether the framework holds up: a French hospital publishing figures on applications built, maintained and retired over time, and a first vibe-coded tool declared under the Article 5(5) in-house exemption. Disclosure is another open thread. Gharmoul argues that any AI component in a patient's care pathway should be disclosed to the patient. Since the 2021 bioethics law, Article L4001-3 of the French public health code requires this, but only for medical devices whose algorithms were trained on large datasets. At EU level, the AI Act's obligations for high-risk AI built into medical devices now apply from August 2028, after the 2026 digital omnibus postponed them. Google, meanwhile, announced in May 2026 that its search engine would generate small applications on request. If building software becomes that ordinary, the question for hospitals may move from who is allowed to build a tool to who is accountable for it once it is in use.

Listen to the episode

Quand les soignants codent : le vibe coding à l'hôpital - Thomas Gharmoul, Hôpital Foch

Listen · 41 min