Topic starter
20/08/2026 5:32 pm
TL;DR: Non-covered entities under HIPAA can still expose electronic protected health information through SaaS, cloud, endpoints, and AI workflows, and Strac’s article argues that classification alone does not reduce the underlying data-loss risk. The practical issue is governance: organisations outside HIPAA scope still need discovery, redaction, access control, and auditability where health data moves through modern systems.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Discover What is Not a Covered Entity Under HIPAA in 2026”.
Key questions
Q: How should organisations protect e-PHI if they are not a HIPAA covered entity?
A: They should treat HIPAA status as a legal classification, not a security boundary.
Q: Why does HIPAA status not eliminate health-data risk in SaaS and AI systems?
A: HIPAA status only tells you whether the organisation has direct regulatory obligations.
Q: What are the signs that e-PHI controls are failing outside HIPAA scope?
A: Common signs include publicly shared files, overbroad guest access, PHI appearing in tickets or chat logs, and AI tools receiving raw health data without redaction.
Practitioner guidance
- Deploy continuous e-PHI discovery across SaaS and cloud Scan collaboration tools, storage, tickets and endpoint content for health data so sensitive information is visible before it is shared or exported.
- Apply redaction and masking at workflow entry points Redact or tokenise PHI in emails, chats, documents and AI prompts before those systems can redistribute the data into downstream tools.
- Review external sharing and collaborator permissions Identify publicly shared files, guest access and excessive permissions that allow e-PHI to leave its intended control boundary.
Bottom line: Non-covered entities can still create the same exposure problem that HIPAA is meant to constrain, because e-PHI moves through the systems and identities that actually handle the data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:19 pm
Classification is not governance: HIPAA status answers who is regulated, not whether e-PHI is at risk. Once sensitive health data enters SaaS, cloud or AI workflows, the security problem becomes discovery, access scope and remediable visibility. The practitioner conclusion is simple: legal scope is not a substitute for data control.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should security teams do when AI workflows can access health data?
A: Security teams should define which data the workflow may retrieve, what it may output, and what must be redacted before any tool call is made. They also need logging for prompts, connector activity and data exports so health-data movement can be audited. Without those controls, AI connectivity becomes an uncontrolled dissemination path for e-PHI.
👉 Read our full editorial: HIPAA non-covered entities still need data controls for e-PHI