AI is an expected part of daily work across healthcare and life sciences. A study by Eliciting Insights found that 75% of U.S. health systems use at least one AI application, up from 59% a year earlier. Regulators are planning for it as well: in January 2026, the FDA and EMA jointly released ten guiding principles for good AI practice in drug development.
The models behind this work run on patient records and proprietary research data, which makes AI data security in healthcare and biotech a deciding factor in every AI initiative. These organizations already operate under some of the strictest data protection obligations of any sector, and every new AI tool creates another place where sensitive data is at risk.
Before the next AI project goes live, it’s worth asking a harder question: would your current protections hold if an attacker went looking for that data inside your AI workloads?
Why Healthcare and Biotech Breaches Carry the Highest Cost
Healthcare has always been one of the most targeted industries for cybercriminals. IBM’s 2025 Cost of a Data Breach Report put the average healthcare breach at $7.42m, the highest of any industry studied.
Speed is part of the problem; healthcare breaches took an average of 279 days to identify and contain, five weeks longer than the global average. Every extra week gives attackers more time inside systems that hold sensitive records.
Breach volume is also climbing; HIPAA-regulated organizations reported 772 large breaches to the HHS Office for Civil Rights in 2025, a new annual record.
The numbers:
- $7.42 million average cost of a healthcare data breach
- 279 days average time to identify and contain a healthcare breach
- 772 large healthcare breaches reported in 2025
- 192.7 million individuals affected by the Change Healthcare breach
What Change Healthcare Taught the Sector
In February 2024, ransomware hit Change Healthcare, a UnitedHealth Group subsidiary that processes claims and payments for much of the U.S. healthcare system. The attackers got in through a Citrix portal that lacked multi-factor authentication, they then moved through the network for nine days before deploying ransomware.
The final count of affected individuals reached 192.7 million, the largest healthcare breach in U.S. history. Pharmacy claims and medical billing were disrupted across the country.
The root cause was a single missing control on a single access point. AI tools add new access points, new integrations, and new vendor connections. Each one needs the same scrutiny Change Healthcare’s remote portal should have received.
Any AI tool that can access private data needs the right set of security parameters: Setting AI Infrastructure Security Foundations in Regulated Environments
Research Data is a Prime Target Too
Attackers also go after the research behind biotech and pharmaceutical work. Clinical trial datasets and drug development reports hold value for years, and they can’t be reissued like a compromised password. That makes biotech data security a matter of protecting intellectual property as much as personal information.
The June 2026 Novo Nordisk incident is a prime example: An extortion group called FulcrumSec claimed to have stolen more than a terabyte of data after the company declined a $25 million ransom demand. The group says it spent more than two months inside Novo Nordisk’s networks.
This isn’t an isolated case; an analysis of 172 incidents targeting the pharmaceutical sector in the first nine months of 2025 found attackers concentrating on research data and regulated intellectual property.
AI models and the datasets used to train them now appear on attackers’ lists of valuable assets. A trained model reflects years of research investment and the sensitive data it learned from. Clinical trial data security now has to extend to every model, dataset, and environment that touches trial information.
Where AI Adds New Exposure
Shadow AI
“Shadow AI” means AI tools that employees use without IT approval or oversight. It’s usually well-intentioned; a clinician wants to summarize notes faster, or a researcher wants a quick read on a dataset.
But the risk is measurable: in IBM’s 2025 research, one in five organizations reported a breach involving shadow AI, and only 37% had policies to manage AI or detect shadow AI. Organizations with high levels of shadow AI paid an average of $670,000 more per breach.
For most organizations, AI governance in healthcare begins here: knowing which tools are in use and what data is going into them.
Access Controls Haven’t Caught Up
IBM found that 97% of AI-related breaches occurred where proper access controls were missing. AI pilots often launch quickly with broad permissions so teams can test ideas, but those permissions tend to stay in place once the pilot becomes a production tool.
Problematic areas include:
- Service accounts with administrator-level rights to data stores
- API keys saved in code repositories or shared notebooks
- Model endpoints reachable without strong authentication
- Shared credentials used across multiple teams
Data Pipelines Multiply Sensitive Data
AI workloads copy, transform, and stage data in new locations, often outside the systems where security controls were first applied.
Sensitive data can end up in:
- Training and fine-tuning datasets
- Vector databases used for retrieval
- Prompt and output logs
- Development and test environments
Each copy needs the same protection as the original. Encryption and access policies on the electronic health records (EHR) don’t automatically follow the data once it moves into an AI pipeline.
A Security-First Approach to AI on Sensitive Data
Know Your Data
Every AI project should start with a clear record of the data it will use and where that data comes from.
- Classify patient data and research IP before any dataset is approved for AI use.
- Map where each approved dataset travels once an AI workload picks it up.
- Remove identifiers the model doesn’t need.
- Record each approval so you can show regulators which data went where.
De-identification lowers risk without removing it. Even properly de-identified data retains some risk of re-identification, so these datasets still need access controls.
Set Strict Access Controls
AI systems should follow the principle of least privilege from the first day of a pilot. Permissions are far easier to set correctly at the start than to pull back later.
- Give each service account and model endpoint only the access its task requires.
- Require MFA on every remote and administrative access path, including AI platforms and data science notebooks.
- Store API keys and credentials in a secrets manager with automatic rotation.
- Segment AI environments from core clinical and research systems.
- Encrypt data at rest and in transit at every stage of the pipeline.
Treat AI Workloads Like Other Production Systems
Once an AI tool handles regulated data, it’s a production system. It should meet the same standards as your EHR or lab information system.
- Apply change control and version control to models and the pipeline code around them.
- Log access to models and the data they use, and keep those logs for audit.
- Include AI components in vulnerability scanning and penetration testing.
- Feed alerts from AI systems into your existing security monitoring.
For a structured way to govern these systems over time, NIST’s AI Risk Management Framework is a useful reference.
Are your engineering teams securing the machine learning pipeline? Applying DevSecOps Principles to AI Development
Regulatory Expectations Are Clear Enough to Act On
HIPAA and FDA requirements apply to patient and research data wherever it goes, including into AI tools. Regulators have also signaled where those requirements are headed, which gives teams a reliable basis for planning now.
The HIPAA Security Rule Update
HHS proposed the first major overhaul of the HIPAA Security Rule since 2013 in January 2025. The proposed requirements include:
- Multi-factor authentication and encryption as mandatory controls
- Asset inventories
- Semiannual vulnerability scans
- Annual penetration testing
The rule is still a proposal; HHS currently targets July 2027 for final action. Once it’s published, organizations would have roughly 240 days to comply with most provisions.
FDA Expectations for AI in Drug Development
For biotech and pharmaceutical teams, the FDA’s draft guidance outlines a risk-based, credibility-focused framework for AI used to support regulatory decisions. Showing credibility means knowing where training data came from and proving it hasn’t been altered. That places data security squarely inside regulatory readiness.
Is Using AI Tools HIPAA Compliant?
This is the big question, and the straightforward answer is: it depends on the tool and how it’s used. An AI tool can support HIPAA compliance when the vendor signs a Business Associate Agreement and PHI is protected by the required safeguards. Consumer AI tools without a business associate agreement shouldn’t receive PHI.
Protect Data, Then Roll Out AI Tools
Much of the AI work in healthcare and biotech depends on people agreeing to share their information. Patients share it to receive care, trial participants share it to advance research. Both do so expecting their data will be handled with care.
That trust should not be handled lightly. Organizations that protect it well earn room to do more. Over time, the strength of an organization’s data protection will set the limit on how much value it gets from AI.
SMS has designed and secured IT infrastructure for organizations where a data breach carries serious consequences. Our expansive experience shapes the way our platform engineering team approaches AI workloads in healthcare and biotech.
Our engineers secure the data pipelines and networks that feed AI tools, and we put governance and compliance frameworks in place that support your HIPAA and FDA obligations. When your team is stretched, we take on the heavy lifting so AI projects keep moving.
