Unauthorized AI use is becoming a healthcare governance problem, not just an IT procurement issue. A separate Axios event preview puts data governance on the agenda as teams work out who can approve, monitor, and constrain AI deployments.
Health care's emerging risk: unauthorized AI agents
Axios reports that unauthorized AI agents are entering healthcare systems, creating security and privacy challenges for organizations handling sensitive patient information. It cites a striking measure of the approval gap: 72% of health industry leaders report AI tools being used without formal IT approval. That figure describes reported use without approval; it does not establish how many agents have accessed patient records or caused an incident.
The distinction matters for response planning. A team cannot assess the risk of a tool it has not identified, particularly if the tool can receive clinical text, retrieve internal documents, or act within an existing workflow. Healthcare data leaders should start by mapping which AI tools staff use, what information those tools can receive, and whether their access is covered by existing security reviews. The immediate question is not whether every use is harmful, but whether the organization can see and govern it.
- Unapproved tools can sit outside normal access reviews and logging, leaving security teams unable to reconstruct what data was shared or which actions were taken.
- Patient-data controls need to apply at the point where staff enter information into an AI tool, not only when a vendor is formally added to the approved stack.
- Agent approval should include a named owner, defined permissions, monitoring, and a way to revoke access when a workflow or vendor changes.
WATCH: Conversations on data governance in the AI era
Axios is promoting an upcoming conversation featuring tech leaders on data governance in the AI era. The event preview points to a broader operational question: how organizations set rules for data use as AI becomes part of everyday products and workflows. It is a discussion announcement, not a report of new requirements, agreed standards, or outcomes from the event.
For teams deploying AI, governance becomes concrete when a use case moves from a demonstration into production. Someone must decide which data is permitted, who can authorize access, how outputs are checked, and what evidence is retained for later review. Those decisions are especially relevant to synthetic-data projects: a dataset's intended use, provenance, and validation should be documented before it is used to develop or evaluate a model. The event offers a prompt to examine those internal decisions, rather than a substitute for making them.
- Product and data teams should make approval criteria explicit so AI experiments do not quietly become production dependencies.
- Engineering, security, and compliance owners need a shared record of permitted data uses and the controls attached to each deployment.
- Teams using synthetic data should document its source, intended purpose, and evaluation limits instead of treating the label as a blanket privacy assurance.