The PHI your clinicians are pasting into personal AI

A nurse summarizes a complex patient history in ChatGPT before handoff. A revenue-cycle specialist asks Claude to help code a tricky claim. Neither is doing anything malicious — they are trying to get home before 9 PM. But the moment a name, an MRN, or a diagnosis code lands in that prompt, PHI has left the building for a service with no obligation to protect it.

A 2026 Wolters Kluwer survey found that most healthcare workers still use personal AI accounts for work. Banning the tools hasn’t worked anywhere it has been tried; the productivity pull is too strong. The answer isn’t to block AI. It’s to secure the data on every path AI touches — the apps your people use, and the agents your teams are starting to run against clinical systems.

Two surfaces, one problem: the data

Healthcare AI risk now shows up in two places at once, and most tooling sees neither clearly.

BlueAspen is data security for AI: one policy engine and one detection stack behind both surfaces. It inspects and controls the data itself — inline, at the moment of the call, not in a report after the fact.

Catching PHI the way an auditor would accept

A regex can see that something “looks like” an identifier. That is where most DLP tools stop, and it is why they drown clinical workflows in false alarms. BlueAspen runs the real validators, so a finding is defensible and a non-match isn’t noise:

• NPI — Luhn check digit with the 80840 prefix rule, not just a ten-digit shape
• DEA — the DEA registration check-digit algorithm
• MBI, ICD-10, CPT — each validated against its own format and range rules
• PCI — card numbers pass the Luhn checksum the networks themselves use

That’s part of 60+ context-scored patterns across PHI, PCI, PII and secrets — each finding carrying the rule that fired and why, tuned for low false-block. A compliance artifact, not a classifier’s guess.

On the employee side: redact the prompt, don’t block the clinician

For people using AI, enforcement lives on the request leg — what they type or upload. A prompt carrying an NPI and a diagnosis can have the sensitive fields redacted in place (an NPI becomes [REDACTED]) while the clinical question still reaches the model, so the work gets done. This surface fails open by design: if a policy can’t be reached, no one is ever blocked from caring for a patient.

On the agent side: screen the reply, and fail closed

The half most tools miss is what comes back. When a clinical agent calls an EHR tool over MCP, the patient record returns on the result leg — and that is exactly where the leak is. BlueAspen screens the tool’s answer before the agent or model ever sees it, and redacts regulated fields in place while keeping the reply valid.

On ingress and agent-to-tool paths, the posture is the opposite of the employee side: a call BlueAspen can’t judge never reaches the data, and a misconfigured gateway refuses to start rather than fail silently. Fail-closed where it guards data; fail-open where it would block a person working.

Find the AI you didn’t know about

You can’t secure what you can’t see. BlueAspen surfaces AI usage, MCP servers and agents from the traffic itself — including the shadow ones no registry knows about — across 40 providers and a catalogue of roughly 6,000 AI domains. The Employee Proxy is a TLS-inspecting forward proxy plus a lightweight endpoint agent; it sees browser, desktop and app traffic to AI, not just the obvious destinations.

Where this fits

BlueAspen complements the DLP and CASB you already run — those sit on files, web and email; we sit inside AI and agent protocol traffic, on the data path, where they can’t reach. The platform detects PHI, PCI, PII and secrets and gives you an audit-grade record of every finding and decision. (It does not make any organization “HIPAA-compliant” on its own — it gives compliance and security teams the evidence and control they’ve been missing.)