Scanned healthcare records expose a blind spot in data security

At a glance

What this is: This breach analysis shows that the core risk was not the unknown intrusion method, but the exposure of scanned healthcare documents that most discovery tooling cannot classify reliably.

Why it matters: It matters to IAM, PAM, and data security teams because scanned records often sit outside ordinary inventory and access controls, yet they contain identity and health data with high regulatory impact.

👉 Read Sentra's analysis of the Unlimited Technology Systems healthcare breach

Context

Healthcare data security fails when organisations can index structured records but cannot see the scanned files that front-desk workflows create every day. Image-based intake forms, insurance cards, and identity documents often sit in file shares and document systems with no durable classification, which leaves them outside the controls most teams trust for regulated data.

The Unlimited Technology Systems breach is a useful case because the intrusion path was not disclosed, so the lesson has to come from the data that was taken. That makes this a governance problem for both healthcare providers and their business associates, including the identity and access assumptions that determine who can reach high-risk repositories.

For identity and data teams, the typical failure is not that the records do not exist. It is that the organisation cannot enumerate them, apply retention, or prove which human identities and service accounts had access when the breach occurred.

Key questions

Q: What fails when scanned documents are not included in data discovery?

A: The organisation loses visibility into the most sensitive part of its file estate. Scanned IDs, insurance cards, and intake forms can contain identity and health data that regulators treat as high risk, but image-only content often evades standard text-based discovery. That leaves incident response unable to answer what was exposed, and retention teams unable to remove documents that no longer need to exist.

Q: Why do scanned healthcare records create more governance risk than structured fields?

A: Structured fields can be inventoried, queried, and controlled with predictable rules. Scanned records are different because one file can combine multiple identity and health attributes, arrive through many intake channels, and persist in repositories for years. That combination makes them harder to classify, harder to retain correctly, and harder to defend after a breach.

Q: How do security teams know whether image-based PHI is actually governed?

A: They should be able to identify every repository that stores scans, prove that OCR or equivalent classification runs on those files, and show which identities can access them. If the team cannot answer those three questions quickly, the data is not governed in practice, even if the programme has written policies and inventory documents.

Q: Who is accountable when a business associate exposes scanned identity documents?

A: The business associate is responsible for protecting the data it processes, but the covered entity still needs contractual clarity about data types, retention, and access scope. Accountability also extends to internal owners who sent the files downstream without defining how long scans should live and who should be able to retrieve them.

Technical breakdown

Why scanned documents evade normal data discovery

Scanned documents are unstructured data, but unlike text PDFs or databases, the sensitive content exists only as pixels until optical character recognition is applied. Many discovery tools rely on pattern matching against structured text, so they miss images, faxed files, and embedded scans unless the pipeline explicitly extracts and classifies them. In healthcare, that creates a blind spot because intake packets often contain multiple sensitive fields in one file. The control problem is not merely classification accuracy. It is whether the pipeline treats image-based content as first-class regulated data or as opaque storage.

Practical implication: inventory OCR coverage for every repository that stores scanned files, not just structured datasets.

How healthcare repositories amplify identity and access risk

Scanned records tend to accumulate across portal uploads, scanner output directories, fax gateways, document management systems, and cloud storage. Once there, they are often replicated to vendors and retained indefinitely because no one owns the clean-up process. That storage sprawl matters to identity governance because access is usually broader than the business need requires. Human users, service accounts, and now AI systems may all be able to retrieve the same repository. If the repository is not classified and access is not scoped, the blast radius of any breach grows silently over time.

Practical implication: map repository access to named identities and remove broad access to scanned-document stores.

Why continuous classification changes breach response

Continuous classification does not stop intrusion, but it changes what the organisation can prove after one. If the team can identify scanned IDs, insurance cards, and intake forms in advance, it can answer the regulator's real question faster: what was exposed, for whom, and for how long. It also enables retention decisions, so documents collected for one-time verification do not remain indefinitely as reusable liability. In practice, this is a response and governance control, not a perimeter control.

Practical implication: apply continuous classification to reduce uncertainty, shorten notifications, and enforce retention on image-based PHI.

Threat narrative

Attacker objective: The objective was likely broad extraction of regulated healthcare and identity data that could support fraud, extortion, or downstream abuse.

1. Entry was present in a commercial data centre environment, but the public record does not disclose the exact intrusion vector.
2. Credential or access abuse is implied by the unauthorised actor's ability to remain in the environment from October 5 to October 10, 2025.
3. The impact was exposure of names, Social Security numbers, diagnosis codes, scanned IDs, insurance cards, and patient intake forms for 3,803,750 people.

NHI Mgmt Group analysis

Scanned-document blindness is now a governance failure, not just a discovery gap. The breach shows that organisations can hold highly sensitive identity evidence without being able to enumerate it. That is a control failure because regulators and incident responders care about what was exposed, not whether the file was easy to classify. Practitioners should treat image-based repositories as regulated data stores, not miscellaneous content.

Identity governance must extend to repositories that contain identity evidence. Driver's licences, government IDs, insurance cards, and intake forms are not just records. They are identity artifacts that should have explicit ownership, lifecycle rules, and access scoping. When scanned documents are spread across business associate systems, the organisation loses the ability to answer who could reach them and why. That makes access governance part of data security, not a separate programme.

Continuous classification is the only practical way to reduce blast radius in unstructured healthcare content. Manual review cannot keep pace with front-desk scanning, fax intake, and portal uploads. Discovery that does not read images, extract text, and classify the result leaves the highest-risk data invisible. The lesson is not to add more storage review effort. It is to build classification into the data lifecycle before the breach forces the question.

Business associate concentration turns a single repository failure into a systemic exposure event. Healthcare providers often send identity-rich documents downstream without enough precision about format, retention, or access scope. That creates a concentration risk where one vendor's repository can expose thousands of practices. The practical conclusion is that provider-side diligence must ask what data formats are held, not only whether a vendor has baseline security attestations.

What this signals

Healthcare security teams should expect scanned-document governance to move from an audit issue to an operational control issue. Once OCR, indexing, and AI search begin to surface image-based content, repositories that were previously obscure become searchable attack targets, so access governance and retention need to be aligned before those platforms are rolled out.

Identity evidence sprawl: scanned IDs, insurance cards, and intake forms behave like high-value identity assets but are often stored without identity-aware ownership. That means the next control conversation is not just about data classification, but about which users, service accounts, and AI systems can retrieve repository content. The practical response is to connect data discovery, IAM, and retention so visibility leads to deletion, not just reporting.

For practitioners

• Inventory scanned-document repositories Locate every file share, fax gateway, portal bucket, and document management system that stores image-based PHI or identity documents, then verify whether discovery tooling can read them end to end.
• Classify image-based files before retention expires Apply OCR and content classification to scanned IDs, insurance cards, and intake forms so retention policies can remove documents collected for one-time verification instead of keeping them indefinitely.
• Scope access to named identities Review which human users, service accounts, and AI agents can reach repositories that contain scanned documents, then remove broad access and document the business justification for each exception.
• Add format-specific vendor diligence Ask business associates to enumerate not just the data they hold, but the formats they hold it in, including scans, images, and PDFs, so contract terms and offboarding reflect the actual risk.

Key takeaways

• The breach exposes a familiar governance gap: organisations can secure structured data better than scanned identity evidence.
• The scale of the incident shows that business associate repositories can turn one access event into millions of patient exposures.
• The control that changes outcomes is continuous classification tied to retention and access scoping for image-based records.

Key terms

• Unstructured Data Classification: The process of identifying and labelling documents, presentations, PDFs, and similar content without relying on a fixed schema. In security programmes, the goal is not just finding files, but assigning enough context for policy, access control, retention, and monitoring to work consistently across environments.
• Business Associate: A business associate is any external organisation that handles PHI on behalf of a covered entity. The term matters because liability and security obligations extend beyond the primary healthcare provider, making third-party access governance, contract terms, and technical controls part of the same compliance chain.
• Continuous Classification: An ongoing process that inspects data as it is created, stored, moved, and accessed so its sensitivity stays current. For scanned content, this usually means OCR and metadata analysis before policy decisions such as retention, sharing restrictions, or deletion can be applied.
• Identity Evidence Continuity: The uninterrupted chain of records that shows how a control was defined, approved, executed, and reviewed. In audit settings, it is the difference between claiming compliance and proving it with traceable identity, access, and activity evidence across systems.

What's in the full article

Sentra's full analysis covers the operational detail this post intentionally leaves for the source:

• Step-by-step OCR and classification workflow for scanned PDFs, images, and other unstructured files
• Practical guidance for identifying hidden PHI in repositories that standard discovery tools often skip
• Repository-level examples showing how continuous classification supports retention and exposure analysis
• Operational detail on how to handle cloud, SaaS, and on-premises unstructured content inside your environment

👉 Sentra's full post covers scanned-document discovery, unstructured data classification, and healthcare governance implications.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to broader security and governance decisions.