The short answer. Healthcare AI tools expose patient data for three ordinary reasons: clinicians and staff paste it into tools the organization doesn’t control, the tools the organization does control can often reach more data than the user should see, and nobody can tell afterwards which data an answer drew on. The fix is structural. Give staff a sanctioned tool whose AI reads only what each user is allowed to see, and keep a record of the sources behind every answer.
Where the exposure happens
Staff use personal accounts
Netskope’s healthcare threat research found that 81% of data policy violations at healthcare organizations involved regulated healthcare data, with the rest made up of source code and other secrets. Personal AI account use among healthcare workers fell over the year but was still 71%, down from 87% (Netskope Threat Labs, as reported by HIPAA Journal, May 2025). Netskope also found that 88% of healthcare organizations use generative AI apps directly, and 96% use apps that train on user data.
When protected health information goes into a personal account, the organization has no Business Associate Agreement with the vendor and no record of what was shared. Under HIPAA, a covered entity may disclose protected health information to a business associate only with satisfactory assurance, documented in a business associate contract (45 CFR 164.502(e) and 164.504(e)).
Sanctioned tools see too much
The second problem shows up inside approved tools. An AI assistant connected to a shared drive answers from whatever it can reach. Varonis found that 99% of organizations have sensitive data that AI tools can easily surface (Varonis, 2025 State of Data Security Report). HIPAA’s minimum necessary standard asks covered entities to limit uses and disclosures of protected health information to the minimum necessary for the purpose (45 CFR 164.502(b)). An AI that can read everything a department ever saved can’t meet that standard for the person asking.
Nobody can reconstruct the answer
IBM’s 2025 research found that 13% of organizations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls. 63% of organizations had no AI governance policy or were still developing one (IBM and Ponemon Institute, 2025). When a privacy officer asks which records an AI answer relied on, most tools have nothing to show.
Six safeguards to require
| Safeguard | What it prevents |
|---|---|
| A sanctioned tool staff actually prefer | PHI going into personal accounts |
| Access enforced where the AI reads | An answer drawing on records the user can't see |
| Answers tied to named internal sources | Unsupported answers entering clinical or operational decisions |
| A setting that declines questions your documents can't answer | The AI filling gaps from general knowledge |
| Protection against instructions hidden in uploaded files | A document redirecting the AI |
| A record of how each source was used | An audit you can't answer |
A ban on public AI tools without a sanctioned alternative doesn’t stop the use. It moves it to personal accounts, where you can’t see it.
Where Mithra fits
Mithra is a governed AI workspace for an organization’s own documents. In healthcare that means the material staff ask about all day: policies and procedures, clinical protocols, formulary guidance, compliance manuals, payer rules and research protocols. It doesn’t connect to your EHR at launch.
Documents go into permissioned Library spaces, and space membership decides whose questions can reach which documents. That’s the minimum necessary principle enforced where the AI reads. Each file is tokenized on upload with a Token ID, a timestamp, its owner and its metadata, and every answer carries a Trusted, Partial or Untrusted label, or General Knowledge when no internal document applies. View Evidence opens each cited source.
Admins set the limits once in the Guardrail Center. They can exclude documents from retrieval by metadata value, block restricted topics and, with “Use only your data sources” turned on, have Mithra decline questions the organization’s documents can’t answer. AI Threat Protection runs on every query and detects prompt injection, including instructions hidden inside uploaded files, and flags attempts to extract sensitive data. Each document’s Data Lineage view shows when it was cited in a response or viewed as evidence.
A Trusted label means well supported by your documents. The clinician or analyst still makes the call.
Frequently asked questions
Is it a HIPAA violation to put patient data into ChatGPT?
Entering protected health information into an AI tool whose vendor hasn’t signed a Business Associate Agreement with your organization is generally an impermissible disclosure under HIPAA’s business associate rules (45 CFR 164.502(e)). Check the specific product and contract with your privacy officer.
How do healthcare organizations control what AI tools can see?
By putting access controls where the AI retrieves data, so each user’s questions reach only the documents that user is allowed to see, and by excluding sensitive or outdated material from retrieval entirely.
Why do healthcare workers still use personal AI accounts?
Usually because the sanctioned option is missing or harder to use. Netskope reported personal account use by healthcare workers at 71% in 2025, down from 87% the year before.
About Mithra Technologies Inc.
Mithra Technologies Inc. is building the trust infrastructure for enterprise AI. Centered on its cryptographic Single Source of Truth (SSOT®), Mithra enables organizations to establish verifiable AI through trusted enterprise content, cryptographic proof, complete data lineage, provenance and governance. Designed to work across any AI model, Mithra helps enterprises deploy AI that is more transparent, explainable, auditable and resilient while reducing the risks associated with misinformation, unauthorized data usage, cyber threats and the emerging quantum era.