70% of Healthcare Organizations Found an AI-Built Tool That Handled Patient Data Without It or Security Knowing, Paubox Report Finds
70% of Healthcare Organizations Found an AI-Built Tool That Handled Patient Data Without It or Security Knowing, Paubox Report Finds
New Paubox report says AI governance has to start with an inventory of every AI-built tool
SAN FRANCISCO--(BUSINESS WIRE)--Healthcare leaders are finding AI-built tools that handled protected health information (PHI) without IT or security knowing, according to new research from Paubox. Security reviews and Business Associate Agreement (BAA) checks only reach the tools on IT's list. The research covers AI-assisted development, in which healthcare staff use AI coding assistants to build their own tools, scripts, automations, and integrations.
"You can't protect an AI-built tool you don't know exists. Reviews, BAA checks, and policies only work on the tools IT can see, so finding every tool that touches patient data has to come first," said Rick Kuwahara, Chief Operating Officer of Paubox.
Share
The findings come from The CISO's guide to healthcare AI governance, a new report from Paubox, a HIPAA compliant email security company. Paubox surveyed 151 healthcare leaders in July 2026. Every respondent works at an organization that handles PHI electronically and uses AI coding assistants.
Most healthcare leaders (85%) say their organization's AI-built tools have already handled, stored, or transmitted PHI. That puts those tools under HIPAA like any other system that touches patient data.
Healthcare leaders report strong review controls, with 87% saying a security, privacy, or compliance professional always or usually reviews AI code that handles PHI before it goes live. A review only covers the tools someone submits for one, though. Only half (50%) have a fully implemented written policy on AI coding assistants.
Even with review rates that high, 51% of healthcare leaders say AI-generated or AI-assisted code has already contributed to PHI exposure.
The HHS Office for Civil Rights (OCR) has expanded its risk analysis enforcement initiative to cover risk management, so investigators now look for evidence that an organization acted on the risks it documented.
"You can't protect an AI-built tool you don't know exists. Reviews, BAA checks, and policies only work on the tools IT can see, so finding every tool that touches patient data has to come first," said Rick Kuwahara, Chief Operating Officer of Paubox.
The report recommends starting AI governance with an inventory, then building the other controls on it:
- List every AI-built tool, whether it touches PHI, and who owns it
- Review each listed tool before it goes live
- Check that each tool's outside services are covered by a BAA
- Re-run the inventory on a schedule as staff build new tools
The full report, The CISO's guide to healthcare AI governance, is available now at https://www.paubox.com/research/2026-cisos-guide-to-healthcare-ai-governance.
About Paubox
Paubox is a leader in HIPAA compliant email security for healthcare. Trusted by more than 9,000 organizations, including Cost Plus Drugs, Rippling, and Covenant Health, Paubox works with your existing platform to secure every email sent and received. Paubox is rated #1 on G2 and is recognized on G2's 2026 Best Healthcare Software Products list. Paubox offers HIPAA compliant email encryption, AI-powered inbound email security, archiving, data loss prevention, a secure email API for transactional messaging, forms, and email marketing.
Contacts
Media Contact:
Dawn Halpin
press@paubox.com
