Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Endpoint Security Enough to Secure AI in Healthcare?
What a healthcare IT team chose, what it covers, and the half of the problem it leaves open
In brief
-
Endpoint controls answer one question: which AI services staff can reach, and whether data leaves through them. They do not decide what an approved AI tool reads.
-
A healthcare IT team I worked with chose endpoint visibility over a workflow control. That solves the visibility problem and leaves the exposure inside approved tools in place.
-
Once a business AI account is approved, the endpoint treats it as a trusted destination, so a full patient record can flow to it. HIPAA's minimum necessary standard still applies to that flow.
-
Device DLP, enterprise browsers and virtual desktops all govern where data can go. None of them controls what the AI can see.
-
Agents widen the gap. An agent reads the whole screen and acts under the user's access, which no endpoint control was built to govern.
Not every conversation ends with a sale, and some of the most useful lessons come from the ones that do not. This summer my team and I worked with the IT and security leaders of a multi-site physician group. Their staff were adopting AI quickly, from ambient dictation to call center tools to general chatbots. An acceptable use policy existed, but nothing enforced it, and there was no central view of how anyone was using AI.
We proposed a sanctioned environment for AI work, with patient information tokenized before any model reads it. The team chose endpoint controls instead. Their reasoning is common, and so is the gap it leaves, which is why the decision deserves a close look.
What the team chose
The group's senior security engineer explained the decision in writing:
“Our focus is not on agentic AI at this time. Instead, we are evaluating solutions that operate closer to the endpoint that can give us visibility across all AI models and use cases.”
Senior security engineer, multi-site physician group
Visibility is a real need. A team cannot govern AI use it cannot see. Microsoft and LinkedIn found that 78 percent of AI users bring their own AI tools to work (Microsoft & LinkedIn, 2024), and the UK National Cyber Security Centre recommends discovering what is in use before choosing controls (NCSC, 2026). The trouble is that visibility is where an endpoint strategy starts, and it is also where it stops.
The first three steps
My co-founder followed up with the team and offered advice that did not lead with our product. His view was that the biggest problem would be the number of AI tools in use:
“I do think the major trouble you'll face is not forcing your teams onto a single AI system. Even if you're just getting a business ChatGPT account, that is going to make your lives a lot easier in managing those end users.”
“Best way to begin to understand those problems would likely be to start analyzing your network traffic for different AI providers and tools currently being called.”
RedactSure co-founder, in a follow-up email to the team
He laid out a sequence that any healthcare organization can start with:
-
Analyze current network traffic to see which AI providers and tools staff are already calling.
-
Choose the most popular tool and buy a business account with a business associate agreement, so the vendor is bound by HIPAA obligations for the PHI it handles (U.S. Department of Health and Human Services, n.d.-a).
-
Enforce at the endpoint, through one of the three approaches below.
Each step is worth doing. Together they still leave the hardest question unanswered.
What the three endpoint options cover
-
Device management with built-in DLP. The lightest touch. It uses tools many organizations already own to block unapproved AI services and watch for sensitive data leaving the device.
-
An enterprise browser. A middle ground. Policy follows the user inside a managed browser, with controls on copy, paste, upload and which sites can be reached.
-
Virtualization of the work environment. The strongest of the three. Work happens in a controlled virtual desktop, with stronger controls and auditing, at a higher cost and with more change for users.
All three govern where data can go: which AI services staff can reach, what can be pasted or uploaded, and what leaves the device. None of them changes what a model reads once data is inside an approved tool. That is the half of the problem an endpoint strategy leaves open.
The gap inside the approved tool
Standardizing on one business AI account with a business associate agreement solves a contract problem. It does not solve a data problem. Once the account is approved, the endpoint treats it as a trusted destination, so a full patient chart pasted into it passes every control. The same is true of approved ambient dictation and call center tools, which receive patient information by design.
HIPAA's minimum necessary standard asks covered entities to make reasonable efforts to limit the PHI they use or disclose to the minimum necessary for the intended purpose (U.S. Department of Health and Human Services, n.d.-b). An agreement makes the vendor accountable for the PHI it receives. It does not reduce how much PHI the model receives. A visibility tool will record that patient data went to the approved model. It will not have stopped the model from reading it.
Agents make the gap larger
An agent reads the whole screen, moves between applications and takes actions under a user's access. To an endpoint control, that looks like the user's own session in an approved browser. OWASP lists excessive agency, an AI system with more functionality, permissions or autonomy than its task needs, among the top risks for AI applications (OWASP, 2025). Setting agents aside for now postpones that question rather than answering it. The first prior authorization, coding or claims follow-up use case will arrive with no control over what the agent sees or does on each screen.
What a complete plan adds
Visibility, standardization and endpoint enforcement are the first three steps. The fourth makes the plan complete: control what the AI can see inside each approved workflow, so patient identifiers are tokenized before any model reads them, the AI can go only where policy allows, and a named person approves each consequential action. Without that step, an organization knows where its AI traffic goes and has no say over what its AI reads.
Where RedactSure fits
RedactSure supplies that fourth step. Staff and AI agents work in a governed browser environment where patient identifiers become tokens on the screen before the model reads it. The AI can go only where policy allows, a named person approves consequential actions, and every step is logged for the SIEM. Endpoint tools still do their job. Everyone else controls where data can go. RedactSure controls what the AI can see.
Frequently asked questions
Is endpoint security enough to secure AI in healthcare?
No. Endpoint controls show which AI services staff use and stop data leaving through unapproved ones. They do not limit what an approved AI tool or agent reads, which is where the minimum necessary standard applies.
What is the first step in securing AI use in a healthcare organization?
Find out what is in use. Analyzing network traffic for AI providers shows which tools staff already rely on, which tells you what to standardize on and what to block. It is the first step, not the whole plan.
Does a business associate agreement make it safe to send PHI to an AI tool?
A business associate agreement makes the vendor accountable for the PHI it handles. It does not reduce how much PHI the model receives, and the minimum necessary standard still applies. Confirm the details with counsel.