.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
REPORT
2025 healthcare email security report
Key insights from 180 email-related healthcare breaches and actionable steps to protect your organization.
REPORT
2025 healthcare email security report
Key insights from 180 email-related healthcare breaches and actionable steps to protect your organization.
What the survey data shows
Governance has to start with an inventory: every AI-built tool, and whether it touches PHI.
Review and BAA checks, the controls these organizations rely on, only reach tools on IT's list, and seven in ten have already found that an AI-built tool handled PHI without IT or security knowing.
These figures describe AI-assisted development at organizations that handle PHI: staff using AI coding assistants to build tools, scripts, automations, and integrations. Paubox surveyed 151 healthcare leaders in July 2026.
- 50% have a fully implemented written policy on AI coding assistants
- 54% say AI code has contributed to hardcoded credentials or API keys
- 61% name PHI exposure as a top concern about AI-assisted development
Downloads
The full report, plus standalone cuts sized for different audiences.
The CISO's guide to healthcare AI governance
A survey of 151 healthcare leaders on AI-assisted development. It argues that governance has to start with finding every AI-built tool, and closes with a seven-step checklist that begins with an inventory.
Get the reportExecutive summary Governance starts with an inventory of AI-built tools
The report's argument in brief, with its headline figures, including 85% saying AI-built tools have handled PHI and 54% reporting hardcoded credentials.
Download the executive summaryInfographic AI-generated code contributed to security or privacy issues
Nine figures that set what healthcare leaders say gets reviewed against what they say AI code has already contributed to.
Download the infographicExcerpt AI-built tools already handle patient data
85% say AI-built tools have handled PHI, and 6% of these leaders couldn't say whether theirs had.
Download excerptExcerpt Real patient data goes into the build
93% of healthcare leaders say real PHI reaches AI coding assistants at least some of the time while staff build, test, or debug.
Download excerptExcerpt IT's controls cover the tools on its list
Review and BAA checks reach only tools on IT's list, and 50% have a fully implemented written policy on AI coding assistants.
Download excerptExcerpt AI-built tools handled PHI without IT or security knowing
70% found that an AI-built tool handled PHI without IT or security knowing, and 51% say AI code contributed to PHI exposure.
Download excerptExcerpt Leaders rank shadow IT low on list of concerns despite hidden AI-built tools
25% name shadow IT as a concern, while 70% have already found an AI-built tool outside IT's view.
Download excerptExcerpt Governance starts with finding every tool
A seven-step checklist that starts with an inventory, set against OCR's expanded enforcement of the HIPAA risk management standard.
Download excerptCharts
The 6 figures behind the findings, each with its own base and scale. Percentages come from a survey of 151 healthcare leaders, fielded July 2026.
Whether AI-built tools have handled PHI
Share of organizations whose AI-assisted tools have handled, stored, or transmitted PHI. n=151
Source: Paubox, The CISO's guide to healthcare AI governance.
How often staff enter real patient information into AI coding assistants
Share of organizations, while building, testing, or debugging applications. n=151
Source: Paubox, The CISO's guide to healthcare AI governance.
AI governance controls organizations report
Share of organizations reporting each control. Each bar comes from a separate question. n=151
Source: Paubox, The CISO's guide to healthcare AI governance.
Whether organizations have found that an AI-built tool handled PHI without IT or security knowing
Share of organizations. n=151
Source: Paubox, The CISO's guide to healthcare AI governance.
AI-generated code contributed to security or privacy issues
Share of organizations reporting each issue. Multiple selections allowed. n=151
Source: Paubox, The CISO's guide to healthcare AI governance.
Biggest concerns about AI-assisted development involving PHI
Share of organizations naming each concern. Multiple selections allowed. n=151
Source: Paubox, The CISO's guide to healthcare AI governance.
Statistics
Every figure in the report. Figures describe organizations that handle PHI and use AI coding assistants. n=151
AI-built tools and PHI, 2026
| Response | Share of organizations |
|---|---|
| Yes, AI-assisted tools have handled, stored, or transmitted PHI | 85% |
| No | 9% |
| Don't know | 6% |
Real patient information entered into AI coding assistants, 2026
| Frequency | Share of organizations |
|---|---|
| Frequently | 28% |
| Usually | 42% |
| Occasionally | 18% |
| Rarely | 5% |
| Never | 7% |
| Don't know | 1% |
| At least some of the time (frequently, usually, occasionally, or rarely) | 93% |
Preparedness to govern AI-assisted development, 2026
| Response | Share of organizations |
|---|---|
| Very prepared | 34% |
| Prepared | 51% |
| Neutral or unsure | 10% |
| Unprepared | 3% |
| Very unprepared | 1% |
| Don't know | 2% |
Security, privacy, or compliance review of PHI-handling AI code before deployment, 2026
| Frequency | Share of organizations |
|---|---|
| Always | 41% |
| Usually | 46% |
| Sometimes | 9% |
| Rarely | 2% |
| Never | 1% |
| Don't know | 1% |
BAA verification before AI-built tools connect to third-party services, 2026
| Frequency | Share of organizations |
|---|---|
| Always | 46% |
| Usually | 40% |
| Sometimes | 9% |
| Rarely | 2% |
| Never | 1% |
| Don't know | 1% |
BAAs with AI coding assistant vendors, 2026
| Coverage | Share of organizations |
|---|---|
| All applicable vendors | 41% |
| Most applicable vendors | 42% |
| Some applicable vendors | 12% |
| No applicable vendors | 1% |
| Don't know | 3% |
Written policy on AI coding assistants, 2026
| Status | Share of organizations |
|---|---|
| Fully implemented | 50% |
| Partially implemented | 34% |
| Currently being developed | 11% |
| No policy exists | 3% |
| Don't know | 2% |
Staff training on safe use of AI coding assistants, 2026
| Response | Share of organizations |
|---|---|
| Yes, all staff | 62% |
| Yes, some staff | 30% |
| No | 5% |
| Don't know | 2% |
Whether organizations have found that an AI-built tool handled PHI without IT or security knowing, 2026
| Response | Share of organizations |
|---|---|
| Yes | 70% |
| No | 30% |
AI-generated code contributed to security or privacy issues, 2026
| Issue (multiple selections allowed) | Share of organizations |
|---|---|
| Hardcoded credentials or API keys | 54% |
| Exposure of PHI | 51% |
| Insecure data storage | 51% |
| Missing or inadequate encryption | 44% |
| Software vulnerability or coding bug | 30% |
Biggest concerns about AI-assisted development involving PHI, 2026
| Concern (multiple selections allowed) | Share of organizations |
|---|---|
| HIPAA compliance or audit gaps | 66% |
| Exposure of PHI | 61% |
| Insecure or vulnerable code | 54% |
| Lack of governance or oversight | 46% |
| Shadow IT | 25% |
| Third-party vendor risk | 17% |
| No significant concerns | 3% |
Governance headline measures, 2026
| Measure | Share of organizations |
|---|---|
| Prepared or very prepared to govern AI-assisted development | 85% |
| Security, privacy, or compliance always or usually reviews PHI-handling AI code | 87% |
| Always or usually verify a BAA before third-party connections | 87% |
| All or most AI coding assistant vendors have BAAs | 83% |
| Trained all or some staff | 93% |
Sample composition, 2026
| Segment | Share of organizations |
|---|---|
| Total respondents | 151 |
| IT or security leaders | 77% |
| Clinical or operations staff | 9% |
| Developers or engineers | 8% |
| Executives | 2% |
| Compliance or privacy officers | 1% |
| Other roles | 3% |
| Hospitals or health systems | 63% |
| Healthcare consulting or services organizations | 13% |
| Health insurance payers | 9% |
| Behavioral or mental health providers | 9% |
| Ambulatory or physician groups | 3% |
| Digital health or health technology companies | 3% |
| Organizations with 201 to 5,000 employees | 76% |
| AI coding assistants formally adopted | 88% |
| AI coding assistants used informally | 12% |
| Margin of error, 95% confidence | +/- 8% |