A multi-hospital healthcare network has deployed eScan Business DLP to enable the controlled use of generative AI while preventing sensitive patient information from being transmitted to external AI platforms.
As hospitals increasingly adopt generative AI for clinical documentation, medical research, discharge summaries and administrative workflows, the use of public AI platforms such as ChatGPT, Claude and Gemini has created new data-governance challenges. Patient names, medical records, diagnoses, laboratory results and clinical histories can potentially be exposed when entered into external AI services.
According to eScan, its endpoint Data Loss Prevention (DLP) solution blocked or prevented hundreds of attempted transfers of patient data to public AI platforms during the implementation.
The deployment uses an endpoint DLP agent to monitor data movement across clinical and administrative computers. Before information is transmitted to an external AI platform, the system can inspect content, identify sensitive information, apply classification and enforce policies to allow, monitor or block the transfer.
eScan Business DLP's AI Platform Protection capability is designed to monitor data exposure to AI services including ChatGPT, Claude and Gemini. Its content-aware controls can discover and classify sensitive information, while behavioural analysis and AI/ML-based capabilities support data protection and risk identification.
The healthcare network established classifications covering patient information, personally identifiable information and confidential clinical data, alongside policies determining which AI platforms could be used for different workflows. Approved AI instances could be used for specific research, administrative or clinical activities, while sensitive data transfers to unauthorised platforms were restricted.
The blocked attempts included patient-identifiable information, medical histories, diagnoses, laboratory results and other confidential healthcare data. eScan said the activity demonstrated that such incidents were not necessarily malicious, but could result from clinicians and staff incorporating public AI tools into routine workflows.
“Healthcare organisations are caught between two genuine pressures: enable innovation and protect patient privacy. Both matter,” said Govind Rammurthy, CEO & MD, eScan. “You don't need to restrict innovation. You need to control data flow.”
