Notifications
Clear all
Topic starter
18/08/2026 2:45 pm
TL;DR: Healthcare organisations are piloting AI at scale, but fewer than half have the security and governance needed to move pilots into production, according to Securiti. The operational bottleneck is fragmented data access, shadow AI, and broad entitlements, which turn AI adoption into a control problem before it becomes a model problem.
NHIMG editorial — based on content published by Securiti: DataAI Security: Why Healthcare Organizations Choose Securiti
By the numbers:
- More than 70% of healthcare organisations are piloting AI, but fewer than half have proper security and governance policies to take those pilots to production.
Questions worth separating out
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem.
Q: Why do broad entitlements make healthcare AI riskier?
A: Broad entitlements increase the chance that AI systems, users, or service accounts can reach records beyond the minimum necessary scope.
Q: What do security teams get wrong about Shadow AI?
A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem.
Practitioner guidance
- Build a unified data and AI inventory Catalogue where sensitive healthcare data resides, which AI tools touch it, and which users or services can access it.
- Right-size access to clinical and research data Review entitlements for clinicians, analysts, vendors, and automation services, then remove standing access that exceeds task scope.
- Treat shadow AI as an access-control problem Require approval and logging for AI tools that ingest healthcare data, including browser-based copilots and department-built workflows.
What's in the full article
Securiti's full blog covers the operational detail this post intentionally leaves for the source:
- Implementation examples for DataAI discovery, classification, risk detection, and automated remediation in healthcare environments
- Operational detail on policy-based access controls for masked PII and regulated clinical data
- Compliance workflow examples for HIPAA, GDPR, and DSCSA reporting across large system estates
- Use-case guidance for safe prompt monitoring and AI guardrails in clinical and research pipelines
👉 Read Securiti's analysis of healthcare DataAI security and AI governance →
Healthcare AI security is a data control problem, not just an AI one?
Explore further
18/08/2026 3:28 pm
Healthcare AI governance fails when data control is treated as a downstream problem. The article shows that most of the friction is not model capability but whether sensitive records can be found, classified, restricted, and monitored across hybrid environments. That is a classic governance pattern in regulated industries: innovation outpaces the control plane. Practitioners should treat AI readiness as a data access and accountability issue, not a pure analytics programme.
A question worth separating out:
Q: How can organisations tell whether AI governance is working?
A: They should look for continuous discovery coverage, real-time classification decisions, and evidence that prompts and responses are being inspected during the session. If controls only appear in policy documents or periodic reviews, the programme is tracking intent rather than control performance. Working governance leaves an operational trail, not just a compliance statement.
👉 Read our full editorial: Healthcare AI security depends on data control, not model ambition
