The Real Cost of Not Knowing Where Your Patient Data Lives

A hospital that can't locate its patient data can't answer a HIPAA auditor, and it can't answer the finance team asking why storage keeps growing. Both questions come down to what the CISO is asking: where does our patient data live, and who, or what, can touch it?

Patient data moves. It leaves the EHR in exports to cloud warehouses, gets saved to file shares, and ends up within reach of AI tools. Service accounts, API keys, and AI agents now reach patient data alongside employees, and they inherit whatever access they are handed. Acquisitions bring in systems nobody fully mapped, and cloud migrations leave copies behind. An AI assistant pointed at a shared drive reads whatever the drive holds, including files nobody has reviewed in years.

Hospitals already know what rigor looks like

Hospitals hold patient charts to a standard they don't apply to the data behind them. Walk into any hospital and ask how a chart gets handled. Entries are timestamped. Duplicates are flagged and reconciled on sight. Outdated information doesn't sit next to the current version waiting for someone to trip over it. Clinicians get trained and audited, and sometimes disciplined, over recordkeeping errors, because a stale or duplicated chart is dangerous.

Ask a hospital about its data infrastructure and the answers get vague. Nobody can say how many unreconciled copies of a record are floating across systems, or how old the oldest untouched file in storage is. A chart audit has never been run on the data estate itself.

Data left behind by disabled or suspended user accounts in Microsoft 365, Google Workspace, AWS S3, and Azure keeps getting backed up and protected. So do duplicate files and datasets nobody remembers creating. None of it has an expiration date or an owner. Every copy gets the same protection as an active patient record, and the hospital pays full price for all of it.

What the gap costs

Roughly a third of what a typical healthcare organization stores is redundant, obsolete, or trivial, and removing it is where the first savings come from. Back up only active, critical data, and tier or delete the cold remainder, and storage and backup costs fall 60 to 80 percent a year. For one large enterprise, the projected savings reach $34 million.

Storage is only the first line. Add classification, audit readiness, DLP tuning, and risk remediation, and a typical healthcare organization stands to avoid an estimated $28 to $37 million in cost and risk.

Data governance, identity, and AI are one audit

Treat these as three separate projects and each one inherits the others' blind spots. Data governance tells you what exists and who owns it. Identity tells you who, and what, can reach it. AI governance tells you what the models and assistants did with it. A hospital that answers only the first question still can't say whether a service account or a copilot can read the oncology files it just classified.

Identity is where this gets harder. In a health system, non-human identities, such as service accounts, integration keys, and now AI agents, often outnumber clinicians and staff, and they rarely have an owner or a review date. Cyera's acquisition of Oasis Security, announced in July, puts that problem inside the same platform as data classification, so a single policy can decide what every person, machine, and agent is allowed to see and do. An over-privileged account that touches PHI shows up next to the PHI it touches.

AI governance follows from the same inventory. Cyera's AI Guardian inventories the AI systems in use, shows what sensitive data each can reach, and monitors prompts and responses so risky PHI sharing can be flagged or blocked. It also surfaces unapproved "shadow AI" assistants that clinicians or back-office staff adopted on their own. An AI tool can only be governed once someone knows what data sits behind it, which is why the data audit comes first.

Run the audit

Run the same audit on the data estate that hospitals already run on charts. Ask what exists, what condition it's in, whether it still belongs, and who owns it.

Audit prep gets shorter. When a regulator or a plaintiff's attorney asks what the hospital has and where it lives, the answer already exists. Nobody assembles it by hand. AI projects, from a documentation assistant to a diagnostic model, launch from an accurate inventory instead of a guess.

Cyera runs the chart audit on the data estate continuously. It scans cloud, SaaS, and on-prem stores, labels sensitive data by type, including PHI and PII, and maps which people, service accounts, and AI tools can open it. 

That first scan tends to surface the same things this post describes: files still owned by accounts that were disabled years ago, and duplicate EHR exports that nobody remembers making. Each finding comes with an owner, or a flag that it has none. That lets the security team decide what stays and what goes before the next backup cycle bills for it.

Because the inventory, the access map, and the AI activity all live in one place, the same scan produces evidence mapped to HIPAA, HITRUST, and GDPR. The next audit request becomes a report to export, not a project to staff.

Run the audit once and a hospital CISO has the answer in hand. Here's where the data lives. Here's who can touch it.