“The challenge is not simply whether organizations have privacy and security policies, but whether they can verify that those policies work in practice.”
By: Michela O’Toole
Overview
AI-based technology is creating new opportunities to improve patient care and streamline healthcare operations. It is also raising questions about how healthcare organizations protect patient information when adopting new tools. The challenge is not simply whether organizations have privacy and security policies, but whether they can verify that those policies work in practice.
An October 2026 report from Clearwater Security & Compliance highlights this gap. Although participating organizations had taken steps to establish AI governance, many could not verify which AI tools were operating in their environments or fully validate their vendors’ safeguards. These findings do not establish widespread HIPAA violations, but they raise important questions about oversight as AI becomes more embedded in healthcare.
How Healthcare IT and AI Are Helping
Healthcare information technology supports everything from patient records to communication and billing. AI is adding new capabilities, including tools designed to improve medical imaging.
Shields Health’s use of GE HealthCare’s Sonic DL for 3D offers one example. In an August 2026 announcement, GE HealthCare reported that Shields had begun using the technology clinically in December 2025. According to the announcement, the technology can shorten MRI scan times while maintaining diagnostic accuracy. Faster scans may improve the patient experience and help providers serve more patients.
These benefits show why healthcare organizations are interested in AI. They also make careful implementation essential: clinical usefulness does not, by itself, establish that a tool’s handling of patient information satisfies privacy and security requirements.
Privacy Risks and Existing HIPAA Duties
AI tools that receive patient information can create risks if organizations do not understand what data is collected, where it goes, or who can access it. Inappropriate access, use, or disclosure can expose sensitive information and potentially create legal liability.
The HIPAA Rules apply to covered entities and business associates, rather than every organization that holds health-related information. The Security Rule requires administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information, or ePHI.
A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity may qualify as a business associate. Where required, a business associate agreement must address the vendor’s handling of that information. Organizations therefore need to evaluate both the technology and the legal arrangements supporting its use.
A claim that a product is “HIPAA compliant” should not end that review. HHS does not recognize private Security Rule certifications as establishing compliance, and outside certification does not relieve a covered entity of its legal obligations. Compliance requires attention to how a tool is actually deployed and used.
What Healthcare Organizations Cannot Verify
Clearwater’s report drew on responses from 105 organizations, including hospitals and health systems, physician and dental groups, health plans, and software and technology companies serving healthcare. Its findings should be understood as results from that participating group, rather than a definitive measure of every U.S. health system.
According to Clearwater’s summary, 91% could not verify what AI was running in their environments. Only 14.3% fully validated their vendors’ AI controls, and just four in ten could demonstrate control over how data was sent to AI tools.
The report also found that 42% identified sensitive or proprietary data leaking through AI tools as their greatest internal AI-related concern. That figure measures concern about leakage; it does not mean that 42% had experienced a leak.
These findings suggest a gap between establishing policies and demonstrating effective oversight. An organization may have an acceptable-use policy or vendor agreement while still lacking the technical visibility needed to determine whether its requirements are being followed. AI introduced through existing vendors can make that oversight more complicated, particularly when additional providers or subcontractors become involved in processing information.
An Evolving Regulatory Landscape
AI in healthcare operates within an existing legal framework, even as lawmakers and regulators consider additional requirements. Gaps in AI-specific regulation do not suspend organizations’ current HIPAA obligations.
Federal efforts to strengthen healthcare cybersecurity are already underway. HHS announced proposed changes to the HIPAA Security Rule in December 2024, with publication in January 2025. The proposal seeks to strengthen protections for ePHI and clarify regulated entities’ security responsibilities. HHS distinguishes those proposed changes from the current Security Rule, which remains in effect during the rulemaking process.
States have also pursued healthcare AI legislation. A June 2025 American Medical Association article reported that 250 health AI-related bills had been introduced across 34 states at that point. That dated snapshot illustrates state interest in the issue; introduced bills should not be confused with enacted requirements.
The practical challenge for healthcare organizations is to meet existing duties while tracking the additional rules that may apply to particular tools and uses.
Conclusion
AI’s potential to improve healthcare does not eliminate the need to understand how it handles patient information. Clearwater’s findings highlight the importance of moving beyond written policies toward safeguards organizations can demonstrate and enforce.
Health systems should take stock of the AI tools operating in their environments, review how vendors and subcontractors handle patient data, enter into business associate agreements where required, and establish clear limits on what information can be sent to AI tools. They should also test whether access restrictions and other safeguards work in practice.
These steps support existing legal obligations while helping organizations prepare for evolving regulation. The goal is to make the privacy and security of patient information part of AI adoption from the start.
