Policies exist. Enforcement often does not. How CFOs, CIOs, and CISOs can close the gap before PHI leaves the building.
This month, Johns Hopkins Bayview Medical Center began notifying 3,182 patients that their information may have been exposed. A staff member uploaded a spreadsheet to a public AI tool the hospital had not approved.
If your organization has an AI policy but cannot prove a control behind it, this is your budget risk too. It lands on finance whether the leak starts in a clinic, a billing office, or an FP&A team.
Title graphic reading Shadow AI Is a Finance Problem, with subtext: one spreadsheet, one unapproved AI tool, 3,182 patients notified.
What Happened at Bayview
Hopkins discovered the problem on September 21, 2026 during an internal review. The spreadsheet covered patients treated between May and September 2026. It may have included names, admission and treatment dates, medications administered, provider names, medical record numbers, and account numbers.
Hopkins said the file did not include Social Security numbers or other financial data. Notices began going out about a month later, with a year of free credit monitoring.
Healthcare IT News reported that the staffer appears to have chosen a consumer AI tool to help crunch some numbers. The prompt and tool history were deleted, and Hopkins asked the tool developer for further deletion. Straight Arrow News reported that Hopkins has not said whether the developer confirmed it.
Here is the detail finance leaders should not skip. Hopkins IT guidance issued in 2025 already told users not to enter clinical data into unapproved AI tools. No public account says whether this employee was trained on it.
The policy existed. The data left anyway.
Notice the task, too. This was number crunching, and that is finance work.
In my FP&A work across seven hospitals, patient-level spreadsheets were the working files. Analysts, revenue cycle teams, and quality teams all handled them.
Even a file with no PHI can carry contract rates and margin detail you would not hand to a stranger.
Why a Trained Employee Still Takes the Risk
Annual HIPAA training does its job against the threats it was built for. Paper charts left out. Phishing links, snooping, and unencrypted email.
The annual training I complete covers those rules well. It does not walk through what happens when you paste an analysis into a personal AI account on your phone. That gap is where the risk now sits.
From the payer side, the pressure behind that shortcut is easy to see. Documentation, appeals, and analysis requests pile up. An AI tool turns an hour of work into a few minutes.
Four drivers show up again and again:
Friction. The approved option is slow, clunky, or does not exist yet.
Perception. Many employees treat a chatbot like a calculator, not a third party that stores what they type.
Lag. Vetting an AI vendor takes security review, a business associate agreement, and legal review. Commercial tools move faster than that.
False comfort. Removing a name and a medical record number does not meet HIPAA's Safe Harbor standard, which lists 18 identifier types including dates and geographic detail.
None of these is malice. All of them are predictable.
This is not new. Healthcare IT News covered shadow IT in 2019, when a NextPlane survey of 750 IT professionals found that 67 percent of end users or teams had brought in their own collaboration tools. What changed is what people paste into them.
The Governance Gap in Numbers
Two new surveys put numbers on the problem. Both are vendor-sponsored, so read them as directional.
Clearwater's 2026 benchmark surveyed 105 organizations, including hospitals, physician groups, health plans, and technology vendors. Most had built AI committees and written acceptable-use policies.
Even so, 91 percent said they cannot verify all the AI running in their environments. Only 14.3 percent fully validate their vendors' AI controls.
Only four in 10 can demonstrate that they control how data is sent to AI tools. Nearly half of those with AI policies lack technical enforcement. And 80 percent spend less than 5 percent of their security budgets on AI security.
Bar chart of healthcare AI governance gaps: 91 percent cannot verify all AI, 80 percent spend under 5 percent of security budgets on AI security.
Imprivata and Vanson Bourne surveyed 250 U.S. healthcare leaders. Seventy-two percent admitted some AI tools or agents are deployed without formal IT approval.
Yet 86 percent said they are fairly confident they can fully control and govern agent actions today. Those two numbers sit uncomfortably together.
IBM's 2026 breach report points the same direction. Law firm summaries of the report say shadow AI incidents more than doubled, from 20 percent to 43 percent, and that those breaches averaged $5.39 million.
Those are summaries, not proof of cause. They are still a signal worth budgeting against.
What an Incident Costs
IBM puts the average healthcare breach at $6.64 million in 2026, down from $7.42 million in 2025. Healthcare has been the costliest industry for 13 consecutive years.
Do not use that number as your estimate. Averages include very large events. A 3,182-record incident has a different cost profile.
Build your own from the cost lines Hopkins is already carrying: mailed notices, credit monitoring, a patient call center, forensic and legal review, and staff hours. Then add regulatory exposure on top.
HIPAA's 2026 civil penalty figures run up to roughly $2.19 million per year for identical violations at the highest tier. OCR applies lower annual caps to the lower three tiers under its enforcement discretion. The tier turns on what you knew and how fast you fixed it.
OCR keeps pressing on risk analysis. Warby Parker paid a $1.5 million civil monetary penalty in 2025 tied to risk analysis and risk management failures. IBM's data also suggests roughly one in five shadow AI incidents drew a regulatory fine.
Whether an event is a reportable breach is a legal call for counsel and your privacy officer. This article is planning input, not legal advice.
I wrote earlier about who actually pays when a vendor gets breached. The same question applies here. If an employee sends PHI to a tool with no business associate agreement, there is usually no contract language moving that cost to anyone else.
Ask your broker three questions before renewal:
How does the carrier assess AI governance?
Do any exclusions touch unapproved software or unsanctioned cloud storage?
What do retentions look like for a small-record-count event?
I cannot tell you how your carrier answers. You want the answer before an incident, not after.
Then run a simple test. Add the annual cost of an approved AI tool plus the controls around it.
Compare it with the probability-weighted cost of an incident, using your own numbers in low, base, and high scenarios. If the first number is clearly smaller, you have your budget case.
Four Levers the CFO Controls
Policy is not the CFO's lever. Money, procurement, and reporting are.
1. Fund the approved path first. A ban without an alternative sends usage out of sight. Budget enterprise AI licenses with a business associate agreement, no training on your inputs, and defined data retention.
Then tell staff exactly what they can use.
2. Control the spend. Shadow AI can arrive as a small monthly subscription on a corporate card. Review card and expense lines in Ramp, Brex, Expensify, or whatever your team uses.
Hold vendor payment in AP until the BAA and security review are on file, whether your ledger is NetSuite, Sage Intacct, Oracle, or Acumatica.
Then give AI software its own account in your chart of accounts. Spend you can see is spend you can variance-report. A monthly budget-to-actual review on that account surfaces unplanned tools quickly.
3. Budget the controls, not just the policy. Discovery, data loss prevention, and logging are what turn a policy into evidence. Fund them as risk reduction, and put the number next to your incident scenario.
Only four in 10 organizations in Clearwater's data could show they control how data reaches AI tools.
4. Ask for evidence. Attestations are not evidence. Ask your CISO each month for three figures: AI tools discovered, AI tools approved, and vendor controls validated.
A widening gap between the first two tells you where to look.
Who Owns What
Shadow AI crosses four desks. When it crosses four desks, nobody owns it. IBM's findings, as summarized by Help Net Security, say fewer than one in five breached organizations coordinate their governance teams with their security teams.
Ownership matrix for shadow AI: CFO funds and gates spend, CIO runs intake, CISO detects and logs, Compliance documents risk and training.
Here is a working split:
CFO: funding, procurement gates, scenario math, and board reporting.
CIO: the approved tool catalog and how fast a request moves from ask to answer.
CISO: discovery, data loss prevention, logging, and vendor control validation.
Compliance and privacy: the HIPAA risk analysis, business associate agreements, breach determinations, and training content.
The weakest link is usually intake speed. If a request to use an AI tool takes months, staff will not wait.
Set a target turnaround with the CIO and hold the group to it. Your risk team should set the number.
One option is a fast lane for low-risk requests, such as tools that never touch PHI, with a slower review for anything that does. Your CIO and CISO should design it.
Compliance owns training content, so ask one question. Does our annual module cover personal devices and personal AI accounts? If the answer is no, that is a content fix, not a new program.
Payers and providers share this exposure but not the same data. Payers hold member claims and risk adjustment files. Providers hold clinical detail.
Either kind of file in the wrong tool can trigger a breach review.
Give your audit or finance committee one page each quarter. Show AI tools discovered, tools approved, spend on the AI account, and open items from the risk analysis. That puts shadow AI in the same dollar terms as every other risk you report.
I covered the CFO and CIO working relationship on cyber resilience in my earlier playbook on phishing attacks that bypass MFA. The same partnership applies here. For the data side, my piece on what your data needs before an AI investment delivers lays out what to have in place first.
For the budget side of the same risk, see my CFO financial risk and budget planning guide for healthcare cybersecurity.
Agents raise the stakes. Imprivata's survey found 28 percent of leaders already run agentic AI in production and another 44 percent are piloting.
One hospital manager in the report described an AI that exported patient information in batches, and audit logs are how the team found it. My rule of thumb: if an agent cannot be logged, it should not touch PHI.
Four-step CFO framework for shadow AI: fund approved tools, control spend, budget controls, and ask for evidence, shown in navy and gold.
The Next 30 Days
The cost of waiting is not hypothetical. Hopkins is mailing letters, funding credit monitoring, and running a call center because of one file. Your version of that file may already exist.
Start here:
Ask your CISO for AI tools discovered on your network and devices, next to the approved list.
Pull 90 days of card, expense, and AP lines for AI software.
Ask compliance whether annual training covers personal AI accounts.
Confirm your HIPAA risk analysis names AI tools.
Put approved-tool funding and control costs into your next planning cycle as a scenario.
If you want help turning that list into a budget, reply and tell me where your approval process stalls.
P.S. Does your annual HIPAA training mention personal AI accounts on personal devices? Reply with yes, no, or not sure. I read every response.
