Survey: 70% of Healthcare Organizations Find Shadow AI Tools Handling Patient Data Unmanaged by IT
A Paubox survey of healthcare leaders finds that while nearly 90% say security or compliance staff review AI-written code touching patient data, 70% have still discovered AI-built tools handling that data without IT or security knowledge. This points to a shadow IT problem: code review only covers what is submitted, and HIPAA business associate agreement checks only happen when a connection is reported. 93% of respondents say real patient data reaches AI coding assistants at least some of the time during build, test, or debug, with 70% saying it happens frequently or usually, meaning data is sent to the assistant vendor before the tool is finalized. Only half of organizations have an implemented written policy on AI coding assistants, despite most feeling prepared and 93% claiming some staff training. More than half of leaders say AI-generated code has contributed to hardcoded credentials, and about half report it has contributed to patient data exposure or insecure data storage.
Remediação
Paubox recommends enforcing a technical rule that test and development work use synthetic data rather than relying on training alone, since training has not prevented real patient data from reaching AI coding assistants. Paula M. Stannard, Director of the HHS Office for Civil Rights, is quoted emphasizing that a thorough HIPAA risk analysis is legally required and necessary to identify threats to ePHI before organizations are compromised, including by ransomware.
Linha do tempo
-
Survey: 70% of Healthcare Organizations Find Shadow AI Tools Handling Patient Data Unmanaged by IT
ler a análise desta fonte ocultar
A Paubox survey of healthcare leaders finds that while nearly 90% say security or compliance staff review AI-written code touching patient data, 70% have still discovered AI-built tools handling that data without IT or security knowledge. This points to a shadow IT problem: code review only covers what is submitted, and HIPAA business associate agreement checks only happen when a connection is reported. 93% of respondents say real patient data reaches AI coding assistants at least some of the time during build, test, or debug, with 70% saying it happens frequently or usually, meaning data is sent to the assistant vendor before the tool is finalized. Only half of organizations have an implemented written policy on AI coding assistants, despite most feeling prepared and 93% claiming some staff training. More than half of leaders say AI-generated code has contributed to hardcoded credentials, and about half report it has contributed to patient data exposure or insecure data storage.
Remediation
Paubox recommends enforcing a technical rule that test and development work use synthetic data rather than relying on training alone, since training has not prevented real patient data from reaching AI coding assistants. Paula M. Stannard, Director of the HHS Office for Civil Rights, is quoted emphasizing that a thorough HIPAA risk analysis is legally required and necessary to identify threats to ePHI before organizations are compromised, including by ransomware.