Topic starter
18/08/2026 2:45 pm
TL;DR: Healthcare organisations are piloting AI at scale, but fewer than half have the security and governance needed to move pilots into production, according to Securiti. The operational bottleneck is fragmented data access, shadow AI, and broad entitlements, which turn AI adoption into a control problem before it becomes a model problem.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “DataAI Security: Why Healthcare Organizations Choose Securiti”.
By the numbers:
- More than 70% of healthcare organisations are piloting AI, but fewer than half have proper security and governance policies to move those pilots into production.
Key questions
Q: How should healthcare organisations stop data access problems from blocking AI adoption?
A: They should treat data access governance as the foundation of AI rollout.
Q: Why do broad entitlements make healthcare AI riskier?
A: Broad entitlements increase the chance that AI systems, users, or service accounts can reach records beyond the minimum necessary scope.
Q: What breaks when shadow AI is only managed as an app risk?
A: App-only management misses the prompt, model, and inference session where the real exposure occurs.
Practitioner guidance
- Implement unified data access governance Map where sensitive healthcare data lives across cloud, EHR, IoMT, and legacy systems, then standardise policies so access can be reviewed and enforced consistently.
- Discover and classify shadow AI pathways Inventory AI tools, connectors, and downstream data flows so unapproved systems cannot quietly inherit access to clinical or research data.
- Right-size entitlements for clinical workflows Limit access to masked or purpose-specific data where full records are not needed, and align permissions with clinician and data-team roles.
Bottom line: Healthcare AI adoption stalls when security teams cannot prove where sensitive data lives or who can access it across fragmented systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:28 pm
Healthcare AI security is fundamentally a data governance problem: model capability does not matter if the organisation cannot prove where sensitive data sits or who can touch it. The article shows that fragmented data estates create an access-control blind spot across cloud, EHR, IoMT, and legacy systems. Practitioners should treat data access governance as the precondition for any safe AI programme.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should healthcare teams prioritise access control over model deployment?
A: They should prioritise access control first whenever the AI use case touches sensitive, regulated, or clinically significant data. If the data layer is not governed, model deployment simply scales the exposure. The correct sequence is discover, classify, restrict, then operationalise the AI workflow once least-privilege access is in place.
👉 Read our full editorial: Healthcare AI security depends on data control, not model ambition