A valid login proves who. It proves nothing about what the agent may do.
On September 23, 2024, an AI note-taker joined a virtual hepatology rounds meeting at an Ontario hospital. Nobody in the meeting had invited it. It arrived through the personal calendar of a physician who had left the hospital fifteen months earlier and was still on the recurring invite. It transcribed a discussion of seven patients, then emailed the summary and transcript to 65 people on the list. Twelve of them no longer worked there.
Nothing in that chain was hacked or forged. The invite worked, the calendar worked, the account worked. The only thing that had expired was the reason for any of it to exist, and no system was checking for that. That was a transcription bot. It could listen and send an email.
The agents hospitals are rolling out now can schedule appointments, start prior authorizations, help manage patient flow and support discharge planning. A new survey suggests a large share of health care organizations let at least some AI tools and agents in without asking IT first.
I think that changes what shadow AI means, and most of the governance conversation hasn't caught up.
What the Number Says, and What It Doesn't
Imprivata, an identity-and-access vendor, published the research on September 15, 2026. Vanson Bourne surveyed 250 U.S. leaders responsible for identity security or AI strategy across health systems, integrated delivery networks, single hospitals, academic medical centers, and specialty hospitals.
Seventy-two percent said AI tools or agents are deployed without formal IT approval at least occasionally.
That number is easy to inflate, so read it carefully. It does not mean 72% of AI deployments are unauthorized. It does not mean every unapproved tool is an autonomous agent, and it does not tie any deployment to an incident. It says that in most of these organizations, the approval process gets skipped some of the time. The report ends with a product pitch, and its methodology page describes respondents by organization type, bed count and seniority but says nothing about fieldwork dates, recruitment, response rate, weighting or the questionnaire. I'd weigh it accordingly.
It is still hard to wave away, mostly because of what sits next to it. Twenty-eight percent of these organizations already have agentic AI in production, 44% are piloting it and another 21% expect to implement within a year. Eighty-eight percent expect agents to work with at least some autonomy across clinical and operational workflows. Ninety percent expect operational or productivity gains, and 70% expect clinical gains.
Those are hopes, not results. They tell you where the budget is going.
Then there is the detail I keep coming back to. Among organizations where a chief AI officer oversees AI strategy, 73% reported tools deployed without formal IT or security approval. With a CIO in charge, it was 54%. With a CISO, 44%.
The report offers the charitable reading, that dedicated AI leaders may simply find more of what was always there. Maybe. Either way, appointing someone to own AI did not make the shadow go away.
Shadow AI Now Has Write Access
Pasting patient information into an unapproved chatbot is a privacy problem. An unapproved agent is an execution problem. It can open a system, pull a record, call another application, and change a workflow before anyone reviews what it did.
Imprivata's own examples make the point. Scheduling sounds administrative until an agent moves an appointment without grasping why it was urgent. Prior authorization runs between the EHR, a payer's process, and supporting documentation. Discharge planning reaches into pharmacy, transportation, and post-acute care. Each of those crosses system boundaries, and some cross organizational ones.
A bad action doesn't stay on one screen. It travels.
We already have a preview of what an agent does when a system says no. In June, an OpenAI research agent studying public medicine spending in Australia kept getting refused by a Services Australia statistics portal, so it found another way in. It retrieved non-public files and, according to Services Australia, wrote records to an internal server. Officials said no personal data appeared to have been taken, and a forensic review was still underway when Prime Minister Anthony Albanese disclosed the incident. His summary of the agent's behavior was that it "didn't accept no for an answer."
That wasn't a hospital, and nobody told the agent to break in. That is exactly why it belongs in this conversation.
A Login Is Not a License
Authentication tells a system who is asking. Authorization decides what that identity may do, in this context, right now. Enterprise IT has long fused the two through a user account and a role, and for people that mostly works, because a person clicks one thing at a time and can be asked what they meant.
Agents break that bargain. Across clinical workflows, 35% of the surveyed organizations run agents under delegated clinical identity, and another 46% use a mix of service accounts and delegated identity. Only 16% rely on service accounts alone. Delegated clinician identity is part of the picture in 81% of them. A role designed for a person who reads, thinks, and then acts is now held by software that can chain actions across applications faster than anyone can review them.
That is how scope quietly expands. An agent allowed to read a record should not be able to amend it just because both buttons live in the same application. Permission to prepare a prior-authorization package is not permission to submit it. Access granted for one patient's workflow should end when the task does.
This is the same gap I keep writing about in every sector, just with patients attached. Governance lives in the approval file. Behavior happens at runtime.
A login is an approval-time fact. Everything the agent does after it is runtime, and that is where the oversight has to live.
Now look at what leaders say about their own control. Eighty-six percent are fairly confident they have, or soon will have, visibility into agent activity. Eighty-six percent are fairly confident they can fully control and govern agent actions today. Only 14% report known visibility gaps. Put that beside the 72%, and beside the 17% who think existing identity approaches work without adaptation, and it reads less like confidence than like organizations that haven't looked yet. The questions measure different things, so this isn't proof of failure. It is a tension I would not ignore.
The plumbing explains some of it. Seventy-one percent said IT manages agent provisioning, 49% said security does, 47% use approved self-service, 41% provision by department, and 37% acknowledge ad hoc or unapproved deployment. The report notes respondents could pick more than one answer, which is the point: most organizations run several provisioning models at once. Oversight looks similar. Fifty-three percent require human review for high-risk clinical actions, 40% for high-risk operational ones, 26% rely on spot or exception-based review, and 25% let agents run fully autonomously within defined guardrails. Those are stated policies, not tested ones.
One anonymous respondent in the report, a senior manager at a health system, describes an AI tool that automatically exported patient information in batches. They could pinpoint it quickly only because the audit logs were good. Their organization decided not to expand AI until its monitoring matured. It is an unverified anecdote in a vendor report, but it is also a better governance policy than most I've seen written down.
HIPAA Already Asked This Question
HIPAA does not mention AI agents, and it doesn't need to. The Security Rule in effect today is deliberately technology-neutral. It already requires a risk analysis, access to electronic protected health information that is authorized only when appropriate for the user's role, and mechanisms that record and examine activity in systems holding that data. HHS proposed tougher cybersecurity modifications at the end of 2024. They remain a proposal, and the current rule still governs.
Here is the part that should make a compliance officer uncomfortable. The Security Rule also expects regulated entities to reevaluate their safeguards when their environment changes, and HHS names newly adopted technology as the example.
An agent nobody approved never triggered that evaluation. Shadow AI is not just a policy gap. It is, almost by construction, a gap in the risk analysis the rule already demands.
The Privacy Rule's minimum necessary standard adds pressure, with a caveat that matters. It generally requires limiting uses, disclosures and requests for protected health information to what the purpose requires, but it does not apply to disclosures to or requests by a provider for treatment. It is not a blanket restriction on clinical exchange. For internal uses and most administrative workflows, though, purpose and scope are exactly what an agent's permissions should be built around.
Time-bound credentials fit that logic. Imprivata's report recommends permissions that are time-bound and context-aware, and Sean Kelly, its chief medical and growth officer, told Axios that hospitals should consider a "moat of credentials" that lets an agent do a task only for a set time. That is a vendor's recommendation, not a HIPAA mandate, and the legal analysis still turns on the workflow, the data, the parties and state law. But think back to Ontario. Authority that expired with its purpose would likely have kept that note-taker out of the meeting.
The Hospitals This Survey Can't See
Axios points out that rural hospitals and clinics, with tight budgets and overworked staff, may need AI the most and be the most exposed. I think that's right, and the Imprivata data can't tell us either way. The smallest size band in the survey is 100 to 249 beds, with 15 respondents. Nobody in the sample came from an organization under 100 beds. A standalone critical access hospital, capped at 25 inpatient beds, couldn't have shown up at all.
So the logic has to carry the argument. Small providers face the most pressure to strip out administrative work and are the least likely to have people for security engineering, vendor review, or continuous monitoring. Ban agents outright, and the experimentation goes underground. Let them in loosely and sensitive workflows end up behind weakly governed credentials.
The way out is to make the approved path faster than the improvised one. Shared procurement standards, contract terms that build in identity and audit requirements, and managed identity services can do that for organizations that will never hire an AI governance team. Any funding for new AI capability should also cover inventory, integration, monitoring, and incident response. Buying the agent without paying for its controls doesn't save money. It moves the cost from operations into risk.
What Belongs on the Board's Desk
Start with an inventory that includes discovered agents, not just sanctioned ones, along with the AI features vendors have switched on inside software you already license. Every entry needs an accountable owner, an approved purpose, a status, the systems it touches, and the kinds of data within reach. If that inventory depends on people volunteering what they've installed, it will be wrong. Tie it to technical discovery and procurement.
Approve tasks, not tools. The authorization record should say whose authority the agent carries, where that delegation applies, which actions need a human, and when the credentials expire. Clinical and administrative uses deserve separate risk decisions, because a routine scheduling or discharge action can still change someone's care.
Log what agents actually do across systems, in a form an investigator can reconstruct. Test for prompt injection and unauthorized action, and for the failures your own risk analysis surfaces, like permission creep, the wrong tool called at the wrong moment, and handoffs between agents that nobody owns. And build the off switch before you need it. Suspend the agent, revoke its credentials, contain what it already set in motion.
Boards don't need model-performance dashboards dressed up as governance. They need evidence that controls are keeping pace with deployment.
Do we know which agents are active? Does each one have its own identity and an owner? Is its authority scoped to a task and limited in time? Do high-consequence actions get the review we promised? Are the exceptions we found actually getting closed?
Ontario's privacy commissioner told that hospital to audit its offboarding, so that access, calendar invites included, ends when people leave. It sounds like housekeeping. It is the whole problem in miniature. Authority that outlives its purpose doesn't announce itself. It just keeps working, with a valid login, until it does something nobody approved.