Healthcare can’t govern the AI tools it hasn’t found yet
Nearly nine in ten healthcare leaders say security or compliance staff always or usually review AI-written code that touches patient data before it goes live, and seven in ten have still found an AI-built tool handling that data without IT or security knowing, according to Paubox.
Source: Paubox
These are the scripts, automations, and integrations staff put together with AI coding assistants. Here’s the catch: a code review only covers what someone submits, and a check for a business associate agreement (the contract HIPAA requires before a vendor handles patient data) only happens if someone reports the connection. Unless someone tells IT the tool exists, it gets neither. The survey didn’t ask whether reviewed code caused any problems, so it can’t say review failed. What it does show is the same organizations reporting both.
Real patient information reaches AI coding assistants at least some of the time while people build, test, or debug, according to 93% of respondents, and seven in ten say it happens frequently or usually. Each time, the data goes to the assistant’s vendor before the tool exists in final form.
Meanwhile, only half of the respondents have an implemented written policy on AI coding assistants. Most say they feel prepared to govern them anyway, and 93% say they have trained at least some staff on safe use. Paubox’s advice is to set one rule that test work uses synthetic data and to enforce it in the tools themselves, because training alone has not kept real patient data out of the assistants.
More than half the leaders say AI-generated code has contributed to hardcoded credentials, meaning passwords or API keys written into the code itself. About half say it has contributed to exposure of patient data or insecure data storage.
Shadow IT is software that staff adopt on their own, without sign-off from IT. One in four respondents names it as a concern. Seven in ten have found an AI-built tool handling patient data outside IT’s view. Patient data exposure and insecure code each worry more than half of them.
“An accurate and thorough HIPAA risk analysis is not only required by law, but it is also necessary to protect health information and prevent or mitigate ransomware attacks. If a HIPAA regulated entity doesn’t know what threats and vulnerabilities exist to its electronic protected health information (ePHI), they will often learn the hard way when their systems are hacked,” said Paula M. Stannard, Director, HHS Office for Civil Rights.
