A nurse at a mid-size hospital types a patient's symptoms, diagnosis history, and medication list into ChatGPT to draft a care summary.

• Faster than the EHR
• Gets the job done
• Nobody flags it
• Nobody even knows it happened

That patient's protected health information just left the hospital, with no audit trail, no HIPAA compliance check, and no way to get it back. This isn't a hypothetical. It's happening in 40% of hospitals right now. Here's the number that should make headlines: healthcare data breaches cost an average of $7.42 million per incident in 2025, the highest of any industry. And organizations take 279 days on average to even detect one. That's nine months of your data being accessed before anyone notices.

But the scariest part isn't the external hackers. It's the inside problem. Shadow AI, staff using unauthorized tools like personal ChatGPT accounts, consumer cloud apps, and random SaaS is now present in 4 out of 10 hospitals. Every single one of those interactions is a potential HIPAA violation. Every single one adds an average of $670,000 to breach costs when it's eventually discovered.

“Ban” AI Tools Is Not the Answer, Here Is Why

• When staff are left with no choice but consumer AI tools, it's usually because approved systems are too slow, too clunky, or simply don't exist yet.
• The demand for better workflows is real and justified
• Blocking ChatGPT without replacing it with better just means staff inventing their own fixes instead of using their own systems.
• If this doesn't stop, it just goes further underground and becomes harder to track.
•  Work done around goes undetected and is another potential breach waiting to happen

The actual problem is structural. Patient data is scattered across incompatible systems, nobody has a single source of truth, and clinical staff are filling the gaps. The fix isn't a policy memo; it's building the foundation that makes safe AI use possible in the first place, a unified data infrastructure where:

• Patient records live in one governed, secure, common space.
• AI tools can be deployed internally without data ever leaving the organization's control.
• Audit trails exist by default, built in from the start, not added after a breach force issue.
• Every system is internally connected to other systems, so nothing falls through the gaps.

97% of organizations that experienced an AI-related security incident had zero proper AI access controls in place. That's not an AI issue, that's a data governance problem that AI just made visible.

So here's what I genuinely don't know: Do you think health systems will fix the data foundation first and then deploy AI properly, or will they keep bolting AI onto broken infrastructure until a breach so massive and devastating leaves no choice for them?