Why identifying health-related data is often as difficult as securing it - and what organisations can do about both.
Vectra and Ground Labs were proud to be part of the recent HIMAA 2026 event and to meet the teams responsible for Health Information Management.
Healthcare runs on vast amounts of information: a single episode of care can produce clinical notes, images, test results, prescriptions, billing records and messages, which together can reveal a remarkably detailed picture of a person's health and life.
The core challenge for health organisations is to protect patient data, but reliably identifying it is difficult, and sensitive data rarely stays in a labelled medical record. It moves through people, systems, devices and partners, often faster than governance controls can keep up.
Health data is broader than many people assume. Beyond diagnoses and treatment records, it can include identifiers, genetic information, mental-health notes, disability status, sexual-health information, payment details, voice recordings, location data and even seemingly harmless operational metadata.
Context changes the meaning of data
A name, postcode or appointment time may seem harmless alone, but linked to a specialist clinic, medication or diagnosis code, it becomes highly revealing. This makes keyword searches and fixed classification rules unreliable.
Data is fragmented across the care ecosystem
Health services use many systems, from medical records, imaging and pathology to email, spreadsheets, research databases and paper. Copies multiply through exports, screenshots and backups, and convenience-built shadow systems can become long-lived repositories outside oversight.
Structured and unstructured data behave differently
Structured fields are easy to map and classify, but much sensitive content sits in free-text notes, scans, images, audio and messages. The same fact may appear in many formats, abbreviations or languages, making consistent discovery difficult.
|
In healthcare, privacy risk is rarely contained in one database. It emerges from the connections between people, systems and information. |
Care needs fast, wide access: Clinicians need information at the point of care, often under time pressure and across organisations. Overly strict controls delay treatment or push staff to workarounds, while loose controls increase exposure. Security must balance confidentiality, availability and patient safety.
People are part of the attack surface: Misdirected emails, weak passwords, excessive permissions, phishing and lost devices can undermine strong technical controls. High turnover, contractors, students and rotating teams make access governance harder.
Legacy tech and connected devices widen exposure: Medical devices and specialist systems often have long replacement cycles, limited logging and restricted patching. Years of integrations create hidden data flows, so teams may not see every system that receives or stores a record.
Third parties multiply the trust problem: Insurers, labs, cloud systems, software vendors and researchers all handle sensitive data. Each transfer adds contractual, technical and operational dependencies, and visibility drops further when subcontractors are involved.
Regulation provides an essential baseline, but a compliance-only approach can create a false sense of security. Information changes location, format, ownership and sensitivity over time. Protection must therefore operate as a continuous discipline rather than a periodic audit exercise.
Healthcare organisations should prioritise:
Personal and sensitive information is fundamental to effective healthcare, but its value is inseparable from the duty to protect it. The hardest part is not simply deploying another security tool. It is maintaining an accurate, living understanding of what data exists, what it reveals, where it moves and who can use it.
Organisations that treat discovery, classification and protection as connected capabilities will be better positioned to support care, earn patient trust and adapt to a rapidly changing threat and regulatory landscape.
We have learned from discussions over the last 2 days, that the Australian Health industry has a way to go before we can be confident that sensitive information is properly protected throughout its lifecycle. While many organisations are confident that data is well protected in the master database, that same data is often extracted, copied, merged, reported and logged. As a result, sensitive data often propagates across the environment on workstations, servers, databases and cloud storage, often without the level of protection that should be applied.
For HIMAA attendees, Vectra and Ground Labs offer a complimentary sensitive data discovery scan, to focus on the detection of sensitive health related information, personal information and payment related information. Contact us for more information.