The decision to use Gen AI in most health systems has already been made, and security was not in the room for it. Clinical and administrative staff adopted ChatGPT, Copilot, Gemini, and a growing set of clinical AI tools the same way they adopt anything that saves time on shift. Quietly, and without asking. Most of it was already available to them in the browser.
That leaves healthcare security teams with a practical problem. Protected Health Information (PHI) is already moving through those tools. It needs to be governed, logged, and defensible when a regulator or an auditor asks you to account for it. Most organizations cannot do that today.
Hospitals can block AI tools, but blocking only moves the demand somewhere you cannot see it. A nurse manager who can’t reach Copilot on a clinical workstation opens it on a phone. A billing analyst blocked from ChatGPT signs in through a personal account. The work still gets done, the patient data still moves, and the only thing your policy eliminated was your own visibility into it.
Blocking is not a sustainable security posture. It creates friction that drives shadow usage and erodes trust between security teams and the workforce. In healthcare, where staff already work under time pressure that makes any obstacle feel like a threat to patient care, that erosion happens fast.
The evidence for shadow use is not subtle, and it is specific to healthcare. A Wolters Kluwer Health survey of 518 providers and administrators found that 57 percent had encountered or used an unauthorized AI tool inside their organization, with 17 percent admitting to using one themselves (Wolters Kluwer Health, 2026). Broader workforce data points the same direction. The 2025 Verizon Data Breach Investigations Report found that 15 percent of employees access generative AI platforms from corporate endpoints at least twice a week, and 72 percent of those sign in using personal email addresses (Verizon DBIR, 2025).
Your staff has already settled the allow-or-block debate on your behalf.
PHI enters AI tools through ordinary work. A physician pastes part of a discharge summary into a chat window so it comes back in language the patient can actually read. Elsewhere a coder is working a batch of claims, uploads the spreadsheet, asks which entries look inconsistent, and moves on without thinking about it again. Care coordinators check medication questions the same way, several times a shift. None of this registers as a security decision to the person making it.
Ambient clinical documentation tools raise the stakes further. They capture an entire patient encounter and draft the note from it, so PHI flows continuously and automatically rather than through a discrete action someone could pause and reconsider. Here the exposure is the feature working exactly as designed.
The volume this produces is larger than most security teams expect. In a single healthcare customer environment, Menlo observed 276,000 file uploads to generative AI tools across one 30-day reporting period. No policy, visibility, or governance covered any of it (Menlo Security Threat Research, 2025).
That figure came from one organization across one month, and it surfaced only because someone finally had instrumentation at the layer where the uploads were happening.
Traditional data loss prevention cannot see it because the PHI never becomes the kind of object DLP was built to inspect. Conventional DLP monitors email attachments, file transfers, and traffic at the API level. Text pasted into a chat window never becomes a file and never crosses an email gateway, so there is nothing for the tool to catch.
The result is an exposure event that produces no alert, no log entry, and no compliance signal. DLP is doing exactly what it was built to do, watching doors that were the only doors when it was designed.
Two more gaps sit alongside it in the same layer. Your secure web gateway inspects the connection but cannot see what executes inside an encrypted session once that connection is established. Your endpoint detection tools monitor process execution and file writes, and pasting text into a browser tab does neither. Three well-functioning categories of control, and the browser session falls between all of them.
This matters for how you fix it. Tuning the existing tools harder will not close the gap, because none of them operate at the layer where the gap exists.
You find shadow AI use by auditing the proxy logs you already collect, and by treating their silence as a finding rather than a clean result. Most teams can run a targeted PHI exposure audit for generative AI tools without buying anything new.
One health system found exactly this pattern through a cyber-insurance audit rather than a breach. Data typed into web forms, pasted into AI tools, and submitted through browser-based clinical platforms was generating no logs, no alerts, and no compliance record. The gap had existed for as long as the tools had been in use, and the audit requirement is simply what forced someone to look for it.
A hospital can let staff use AI tools safely by governing the browser session rather than the tool itself. Put the controls in the browser session where the data actually moves, and the question of which AI platforms to permit stops mattering. The protection applies regardless of which one a clinician opens.
Menlo AI Adaptive DLP governs copy-paste, file uploads, and text entry inside the browser session itself. When a clinician pastes a discharge summary into a chat window, the PHI can be masked in real time before it reaches the AI platform. The clinician still gets the help they were looking for, and the patient identifiers never leave your control. That removes the choice between doing the work and following the policy, which is what produces shadow usage in the first place.
Because this operates at the session layer, it covers the tools you sanctioned, the tools you didn’t, and the ones that will launch next quarter. It also extends to the AI agents already running inside the browsers your staff use. Those agents move data at machine speed, with no human pausing to notice that something looks wrong.
None of this replaces the security tools you already run. Your network controls, endpoint protection, and email gateway are doing their jobs. Browser session governance covers the one layer they were never designed to reach, and that layer happens to be where generative AI lives.
The HIPAA Security Rule, the federal standard governing how electronic protected health information must be safeguarded, already reaches this activity through its audit control and transmission security standards. A browser session carrying PHI is a transmission event whether or not you are logging it, and that obligation exists today regardless of any pending rulemaking.
There is pending rulemaking worth tracking. In December 2024, the HHS Office for Civil Rights (OCR) issued a Notice of Proposed Rulemaking that would make several currently addressable specifications mandatory. Those include encryption of ePHI, required multi-factor authentication, and shortened incident reporting timelines (HHS OCR, 2024). As of September 2026, the rule remains proposed, and the existing Security Rule stays in force. Plan for the direction of travel, but be careful about telling your board the requirements have changed.
The more immediate pressure is enforcement posture. OCR has shifted from checking whether a risk analysis exists to examining how organizations act on what the analysis found. If your risk analysis identifies AI tool usage as an exposure and you cannot demonstrate any control or logging at that layer, the finding itself becomes evidence of inaction.
Can DLP stop healthcare teams from putting patient data into AI tools? Traditional DLP cannot, but session-layer DLP can. The distinction is where the control sits. Menlo AI Adaptive DLP operates inside the browser session and can mask PHI in real time as a clinician pastes, uploads, or types it, before that data reaches the AI platform.
Why can’t DLP see healthcare workers pasting patient data into AI tools? Conventional DLP inspects email attachments, file transfers, and API traffic. Pasted text produces none of those, so the PHI moves through a channel the tool has no visibility into. The exposure generates no alert, no log entry, and no compliance record.
How do we stop employees pasting patient data into AI tools when our DLP can’t see it? You add a control at the browser session layer, which is where the pasting happens. Menlo AI Adaptive DLP governs copy-paste, uploads, and text entry inside the session and can mask PHI before it reaches the AI platform.
What’s the best way to discover shadow AI use across a health system? Run a PHI exposure audit using your existing proxy logs, identifying traffic from clinical workstations to generative AI platforms. If that activity is not logged anywhere, that absence is your finding, because HIPAA audit controls require that you can account for PHI transmission. Traffic that never touches your identity provider is a strong signal of personal-account usage outside your tenant.
How do healthcare organizations stay HIPAA-compliant while adopting generative AI? By governing and logging PHI movement at the session layer instead of trying to prohibit the tools. The HIPAA Security Rule, the federal standard for safeguarding electronic PHI, applies its audit control and transmission security standards to browser sessions carrying PHI today. The compliance question is whether you can demonstrate control over those transmissions. Unsanctioned usage generates no records at all, which is why prohibition tends to work against compliance.
Does blocking AI tools actually reduce risk? Rarely, and it often increases risk. Blocking pushes the same work onto personal devices and personal accounts, where you have no visibility, no logging, and no ability to respond.
Can Menlo protect PHI in unsanctioned AI tools? Yes. The controls operate in the browser session rather than through integrations with specific platforms, so they apply to sanctioned tools, unsanctioned tools, and platforms that do not exist yet.
About the Author
Sameep Gidda is a Digital Marketing Campaigns Specialist at Menlo Security. Focused on GEO strategy, content marketing, and AI visibility, Sameep works to ensure Menlo’s expertise in browser security and agentic AI reaches the security professionals who need it most.
See how Menlo governs PHI across generative AI tools without blocking the tools your staff rely on. Schedule a demo.
Menlo Security
