What breaks when OneDrive is not paired with DLP and access monitoring for PHI?

Why This Matters for Security Teams

OneDrive can be a controlled collaboration platform, but PHI changes the risk profile immediately. Once medical records, claims files, referral documents, or care coordination notes enter shared storage, the question is not just whether the tenant is secure. It is whether the organisation can prove where PHI is stored, who accessed it, and whether sharing paths were appropriate. That is why data protection controls and monitoring need to work together with identity and access governance, not as separate projects. NIST SP 800-53 Rev 5 Security and Privacy Controls remains a useful reference for mapping these responsibilities.

The common failure is assuming platform permissions alone are enough. They are not. A file may be technically accessible to the right group while still being eligible for broad forwarding, external sharing, local download, or sync to unmanaged endpoints. Once that happens, PHI can leave the intended control plane without triggering a meaningful alert. If the organisation also uses automation, service identities, or agent-driven workflows to move files, governance needs to extend beyond human user accounts and into OWASP Non-Human Identity Top 10 concerns as well. In practice, many security teams encounter PHI exposure only after a mis-shared link, over-permissive sync client, or audit finding has already revealed it, rather than through intentional monitoring.

How It Works in Practice

DLP and access monitoring close different parts of the same gap. DLP helps identify PHI content, classify it, and restrict risky actions such as external sharing, copying to personal storage, or uploading to unsanctioned apps. Access monitoring shows who touched the data, from where, on what device, and under what authentication context. When both are in place, security teams can correlate sensitive content with user behaviour and detect events that would otherwise look normal in isolation.

In a OneDrive environment, the practical controls usually include:

• Classify PHI at upload or creation time using labels, fingerprints, or pattern matching.
• Block or warn on external sharing when files contain regulated data.
• Monitor downloads, sync activity, and link creation for unusual volume or location.
• Review privileged admin activity and service account access to shared repositories.
• Feed OneDrive events into SIEM so alerts can be triaged alongside endpoint and identity logs.

This aligns well with the control intent in NIST guidance, but implementation details vary by platform and licensing. Current guidance suggests that organisations should not rely on static folder permissions alone for PHI, because collaboration features can bypass the original access model. Stronger programs add session context, conditional access, endpoint posture checks, and investigation workflows so investigators can tell whether access was legitimate or simply technically allowed. For regulated workflows, security teams should also define which file actions are prohibited versus merely monitored, since ambiguity makes enforcement inconsistent.

When OneDrive is integrated with identity telemetry, access reviews become more meaningful because reviewers can see whether permissions were actually used, not just assigned. These controls tend to break down in environments with unmanaged endpoints and ad hoc external sharing because file movement escapes central logging.

Common Variations and Edge Cases

Tighter DLP often increases friction for clinicians, operations staff, and records teams, so organisations have to balance data protection against workflow speed and user frustration. That tradeoff is real, especially where PHI needs to move quickly between departments or partner organisations. Best practice is evolving toward policy-by-data-type rather than blanket restrictions, but there is no universal standard for this yet.

Some environments need stronger exceptions handling. For example, bulk exports for billing, research, legal hold, or interoperability may be legitimate, but they require explicit approval, tighter logging, and time-bound access. Shared mailboxes, delegated admin roles, and application identities can also complicate the picture because the account performing the action may not be the person reviewing the file. That is where identity governance becomes part of data protection, not a separate control family. If PHI is being accessed through scripts, connectors, or automated workflows, the organisation needs to know which non-human identities are authorised and how their access is reviewed.

For teams operating in highly distributed or bring-your-own-device environments, access monitoring must be paired with device trust and conditional access to be useful. Otherwise, alerts will show that PHI was opened, but not whether the device was managed, encrypted, or likely to leak data further. The practical lesson is simple: DLP stops some bad actions, monitoring explains the rest, and neither is enough alone when collaboration is broad and sharing is fast.

Related resources from NHI Mgmt Group

• What breaks when OneDrive integrations request broader access than the user action requires?
• What breaks when DLP monitoring is rushed into production?
• What breaks when session monitoring is missing from industrial remote access?
• What breaks when third-party access to PHI is not offboarded promptly?