AI Could Transform Healthcare Operations. PHI Is Why It Hasn't.

01Healthcare has the most to gain from AI — and the most to lose

The AI companies serving healthcare have proven the clinical upside: ambient scribes that document the visit, imaging AI that flags the stroke, precision-medicine platforms that match patients to trials. Those tools live inside applications you've vetted, and they should keep doing what they do.

But the operational middle of healthcare (coding, prior auths, denials, referrals, receivables) has barely been touched. Not because AI can't do the work. Because every screen in that work holds protected health information, and nobody could responsibly let a model read it.

The biggest operational prize and the highest breach stakes are one and the same: the value is locked behind the PHI.

02Two lanes of healthcare AI

03What the co-workers actually do

• Coding and billing. Draft CPT/DRG coding from documentation, scrub claims before submission, and classify denials by root cause so the upstream fix happens, not just the rework.
• Prior authorization. Pull the worklist, chase status across payer portals, assemble the clinical-documentation packet, and queue it for a named person's approval. Auths that don't slip mean surgery dates that don't slip: operational speed is a health outcome.
• Accounts receivable. Match remittances to accounts, work the aging report portal by portal, and draft appeal packets for one-click human approval.
• Patient communication. Draft condition-aware responses, reminders, and instructions, personalized to the patient's situation. Your staff review and send them, and identifiers stay masked from the model throughout.
• Referral intake. Read the fax queue, match or create the record, check eligibility, and draft the outreach. Today, 30–50% of referrals are never completed, and every one of them is missed care.
• Trend analysis for operations. Analyze de-identified utilization and demand patterns to inform supply inventory, staffing, and production planning. This is the analytics your teams wanted but could not run on real data.
• Research on real records. Analyze actual studies and clinical data with personal identifiers redacted at the screen layer, unlocking work your privacy office currently has to refuse.

04The blast-radius argument

In late 2025, Anthropic disclosed that it had disrupted the first reported large-scale cyber-espionage campaign orchestrated by an AI agent: a state-sponsored group used an AI coding agent to run 80–90% of the attack autonomously, from reconnaissance and exploit development to credential harvesting and exfiltration, against roughly thirty organizations, at thousands of requests per second.

That was one vendor's disclosure, but the exposure is general. Application and cloud infrastructure, however well built, was never designed to withstand adversaries operating at AI speed and AI scale. Healthcare has been the most expensive breach target for fourteen consecutive years, and the attacks are about to get faster and cheaper to mount.

You can't perimeter your way out of that. What you can control is the blast radius: if the environment an attacker reaches holds tokens instead of patient data, the perfect attack exfiltrates nothing worth having. That is the design principle underneath RedactSure. PHI is masked at the screen layer before any model sees it, real values resolve only on approved destinations, and the audit trail itself holds no patient data. The architecture is aligned with PHI data-minimization requirements from the first design decision: the safest record is the one that was never exposed.

05Shadow AI is already in your buildings

While the sanctioned path doesn't exist, staff improvise. In our conversations with provider organizations, including a health services organization with thousands of employees, the pattern repeats: acceptable-use policies on paper, no technical controls in practice, and employees pasting notes and records into personal AI tools nobody can see or audit. A ban produces invisibility, not safety. The fix is one sanctioned door that is more capable than the shadow tools, while generative-AI category blocking on the web gateway you already own closes every other door.

06Where to start

One workflow, one department, 60 days. Prior-auth follow-up and denial appeals are the proven candidates: the pain is weekly, the hours are measurable, and the approval stays with your staff. Baseline the cycle time in week one, then let the numbers make the case to your board: hours returned, denials worked that were being written off, zero PHI exposure events.