Scanned healthcare records expose a blind spot in data security

At a glance

What this is: Sentra highlights that scanned healthcare documents can hide sensitive data at scale, making unstructured files a major blind spot in breach assessment and discovery.

Why it matters: This matters because IAM, NHI, and data security teams need visibility into who can reach scanned records, what those files contain, and how long they persist.

Context

Healthcare organisations often have good visibility into structured records but very poor visibility into scanned documents, which are unstructured and difficult to classify at scale. That gap matters because the most sensitive content in intake packets, ID images, and insurance cards is frequently stored in formats discovery tools cannot read reliably.

The article centres on a healthcare data security problem with a clear identity angle: scanned documents often contain government IDs, Social Security numbers, insurance details, and patient intake data, yet they sit outside normal inventory and retention controls. In practice, that creates a governance blind spot across covered entities and their business associates.

Key questions

Q: What fails when scanned documents are not included in data discovery?

A: The organisation loses visibility into the most sensitive part of its file estate. Scanned IDs, insurance cards, and intake forms can contain identity and health data that regulators treat as high risk, but image-only content often evades standard text-based discovery. That leaves incident response unable to answer what was exposed, and retention teams unable to remove documents that no longer need to exist.

Q: Why do scanned intake forms and ID images increase healthcare breach impact?

A: They concentrate personal and health information into files that are easy to store, hard to classify, and often retained far longer than necessary. Once a repository is exposed, those files can reveal Social Security numbers, government IDs, policy details, and service information in a single object, multiplying the downstream notification and privacy burden.

Q: What are the signs that scanned-document controls are failing?

A: Common signs include front-desk scan folders, fax gateways, and upload repositories that no one can inventory confidently, plus retention rules that exist on paper but are not enforced in storage systems. If answering a simple question about how many scanned IDs are stored requires a manual search, the control is failing.

Q: Who is accountable for scanned-document risk in healthcare vendor ecosystems?

A: Accountability sits with both covered entities and business associates. Covered entities need to know what data they send, in what format, and for how long it stays accessible, while vendors need to classify and protect that data consistently. In practice, the relationship should include explicit retention, discovery, and offboarding expectations.

Technical breakdown

Why scanned PDFs and images evade discovery

Scanned documents are not structured records. They are images or image-based PDFs, so the sensitive data inside them exists as pixels until optical character recognition extracts usable text. Many discovery tools are strong against columns, tables, and named fields, but weaker against image-based content, especially when the same file also contains signatures, handwriting, or mixed layouts. In healthcare, that means front-desk scans, faxed forms, and portal uploads can sit in repositories without ever being classified as containing regulated data. The technical problem is not storage alone. It is the gap between content format and machine-readable classification.

Practical implication: classify image-based repositories separately and verify that discovery actually processes scanned files rather than skipping them.

OCR at scale is a governance control, not just a parsing step

Optical character recognition turns scanned images into text that can then be classified, but OCR is only useful when it is applied consistently across the right repositories and followed by policy logic that can distinguish sensitive identifiers from ordinary reference numbers. In healthcare, a scanned intake packet may contain a Social Security number, insurance policy number, diagnosis code, and government ID image in one file. That makes the control problem one of extraction, classification, and retention together. If any of those steps fail, the organisation still cannot answer what the file contains or why it remains stored.

Practical implication: treat OCR coverage and classification accuracy as measurable governance controls, not as an IT convenience feature.

Identity-aware access determines breach blast radius

Once scanned records are discoverable, the next question is who and what can reach them. That includes human identities, service accounts, and increasingly AI systems that index shared content for retrieval. Access control does not stop an intrusion, but it determines how much the intruder can collect after entry. In healthcare environments, business associates often aggregate data from many providers, so a single repository may contain records tied to thousands of practices. That concentration makes repository permissions, share exposure, and retention hygiene directly relevant to breach impact, especially when the data was never intended to remain searchable forever.

Practical implication: map repository access to specific identities and reduce standing reach to scanned PHI wherever possible.

Threat narrative

Attacker objective: The objective was access to valuable regulated healthcare and identity data that could be copied, resold, or abused at scale.

1. Entry occurred through unauthorized access to a commercial data center environment, although the root cause has not been publicly disclosed.
2. The exposed environment contained scanned identity and healthcare documents alongside structured patient data, which expanded what an attacker could extract once inside.
3. Impact came from the scale and sensitivity of the material taken, including records tied to millions of individuals and thousands of healthcare providers.

Breaches seen in the wild

• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Scanned-document visibility is now a core data security control, not a back-office hygiene task. The breach shows that organisations can have strong controls around structured systems and still lose the files that matter most when they are stored as images or scanned PDFs. The governance gap is not simply missing data. It is missing machine-readable understanding of regulated content. Practitioners should treat unstructured document discovery as part of breach readiness, not a separate archival concern.

Healthcare business associates have become concentration points for identity and document risk. When one downstream processor holds intake forms, insurance cards, and government IDs from thousands of practices, a single compromise becomes a multi-tenant privacy event. That changes how covered entities should evaluate vendor exposure. The useful question is not whether a business associate has a security report. It is whether it can enumerate the scanned documents and identity data it stores on behalf of others, and whether retention is justified.

Identity governance now extends beyond access reviews into content reachability. Human users are only part of the problem. Service accounts, search tools, and AI indexing layers can all surface scanned records once those repositories are connected to modern retrieval workflows. That is a governance shift, not just a tooling shift. Practitioners should assume that content previously buried in a file share can become instantly searchable once connected to automation, which makes repository permissions and content classification a joint control plane.

Retention failure is the named concept this breach exposes: verification images kept long after their purpose has expired. Scanned IDs and intake forms are often retained because nobody owns their deletion. That creates an avoidable liability window where stale identity evidence remains available for exfiltration or misuse. The practical lesson is that deletion policy is part of privacy governance, and in healthcare the absence of a retention decision is itself a control failure.

Continuous discovery changes incident response by shortening the answer to a hard question. After a breach, regulators and patients want to know what was taken. Organisations that can read their own scanned repositories can answer that much faster than those relying on manual file-by-file forensics. That speed matters because response quality depends on knowing which records existed, where they were stored, and who could reach them before the intrusion was detected.

What this signals

Scanned-document governance is becoming a measurable part of healthcare identity security. The practical issue is not whether an attacker can reach a database row but whether the organisation can locate and classify the identity evidence hidden in image-based files. That shifts the control conversation toward discovery coverage, retention enforcement, and vendor-held document inventories rather than only access reviews.

Content reachability will matter more as AI indexing reaches older repositories. A scanned insurance card that was once obscure can become instantly searchable when connected to modern retrieval or indexing layers. Healthcare teams should therefore treat file-share permissions, scan retention, and repository classification as prerequisites for safe automation, not as post-deployment cleanup.

For practitioners

• Inventory image-based document stores Locate scanner output folders, fax repositories, portal upload locations, and document management systems, then confirm whether discovery tools read scanned content or skip it.
• Test classification against real files Pick one repository and measure whether you can identify files containing Social Security numbers, government IDs, or insurance card images without manual file-by-file review.
• Apply retention to scanned identity documents Define a deletion schedule for verification images and intake scans, then enforce it across business systems and shared repositories.
• Add document-format diligence to vendors Ask business associates to enumerate the data types and formats they hold, including scanned documents, and how they classify and delete them.
• Map reachability for scanned PHI Review which human identities, service accounts, and indexing systems can access scanned healthcare files, then reduce standing permissions where possible.

Key takeaways

• Scanned healthcare documents create a visibility problem because they often contain regulated identity data but remain outside the scope of ordinary discovery tooling.
• The UTS breach illustrates how unstructured files can expand impact even when the intrusion path is undisclosed, because the response problem becomes what was taken.
• Healthcare teams should inventory scanned repositories, enforce retention, and demand the same document-format visibility from business associates.

Key terms

• Scanned Documents: Image-based files such as scanned IDs, insurance cards, intake packets, and faxed forms that often contain regulated data but are difficult to classify automatically. In healthcare, they are a governance problem because their content is visible to humans but opaque to many discovery tools.
• Unstructured Data Discovery: Unstructured data discovery is the process of finding and identifying sensitive information inside formats that are not easy to query, such as audio, video, images, and mixed media files. It combines extraction, classification, and policy mapping so security and compliance teams can govern data that would otherwise remain hidden.
• Business Associate: A business associate is any external organisation that handles PHI on behalf of a covered entity. The term matters because liability and security obligations extend beyond the primary healthcare provider, making third-party access governance, contract terms, and technical controls part of the same compliance chain.
• Retention Enforcement: Retention enforcement is the automated application of time-based data lifecycle rules. It ensures records are deleted, quarantined, or archived when a defined retention period expires, rather than relying on manual cleanup. This control is essential where sensitive data spreads across many systems and is easily forgotten.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management through a practitioner lens. It helps security and identity teams connect governance decisions across people, systems, and non-human access paths.