# Article Name 7 Tools to Detect Shadow AI in Healthcare (2027) # Article Summary Compare 7 tools for shadow AI in healthcare by what each finds, what it blocks at the prompt, and which vendors publish a HIPAA business associate agreement. # Original HTML URL on Toriihq.com https://www.toriihq.com/articles/seven-tools-to-detect-shadow-ai-in-healthcare # Details Physicians are already using AI at work, and much of what they use arrives through a browser tab or an expense report rather than an IT ticket. An AMA survey found that 81% of physicians use AI professionally, more than double the rate when the AMA first asked in 2023 (AMA, 2026). Chatbots, transcription apps, and note summarizers nobody approved are what shadow AI in healthcare looks like, and each one puts protected health information (PHI), the patient data HIPAA regulates, a single paste away from a vendor with no contract. Federal regulators are moving toward a written inventory of the AI software a hospital runs. Under the HIPAA Security Rule update proposed on January 6, 2025, HHS would expect AI software that touches electronic PHI to be listed in a technology asset inventory that feeds the risk analysis (Federal Register). It is still a proposal, and the federal regulatory agenda on Reginfo.gov (RIN 0945-AA22) projects final action for July 2027. The seven tools below split into two halves by where each is strongest, and most hospitals need one from each. Torii, Microsoft Defender for Cloud Apps, Grip Security, and Reco are built to find and govern, telling you which AI apps are in use and who is using them. Netskope, Harmonic Security, and Prompt Security are built to inspect the prompt and stop patient data before it leaves, and Netskope also discovers at scale. Ask every vendor about a business associate agreement (BAA), the HIPAA contract under which a vendor agrees to protect the PHI it handles, and the security vendors' entries note which ones publish one. Our list of shadow AI discovery tools covers the general market, while hospitals add PHI, BAAs, and personal devices to the test. ## Torii For a hospital or health system, Torii turns each AI tool a clinician, coder, or billing team starts using into an inventory entry with an owner, its users, and its spend. Discovery draws on the IdP, SSO, expense and contract software, desktop agents, direct integrations, and the browser extension, which catches the apps that never pass through SSO. Expense feeds add the AI tool someone bought on a card and expensed, and the AI Management Platform page says Torii "finds AI that's actually in use, even tools with no billing trail." A new AI app can open a review instead of waiting for the next cleanup. The Shadow IT discovery workflow fires on "New app discovered," posts a Slack notification, and sends an application form to the first person using the app. Once they submit it, the app moves to In review, so the privacy office works from a queue, and since the form fields are configurable, an admin can add a question about patient data (Torii doesn't ship one). From there, an admin can soft-block a site through the extension's Blocked Sites list or, on the Enterprise plan, keep a closed app's Google access revoked. Offboarding removes access wherever a connector exists and sends the rest to the app owner as a tracked task, a step our comparison of employee offboarding software covers in more depth. The extension's data loss prevention (DLP) checks text typed into nine AI chat tools, including ChatGPT, Claude, Gemini, and Microsoft Copilot, for personal identifiers and financial details, per Torii's DLP help article. The check runs on the device, so prompt text isn't sent to Torii, and the user is warned, offered an anonymized version, or blocked. It is not built to detect PHI, and it doesn't reach AI scribes, file uploads, or personal devices and accounts, so pair it with one of the prompt-protection tools below. Pros: - Finds AI tools outside SSO through expense data and the browser extension - New AI tools land in an In review queue, with a form sent to the first user - Ties each AI tool to an owner, its users, and its spend, and offboards wherever a connector exists - Browser DLP warns on or blocks personal and financial details in nine AI chat tools, checked on the device Cons: - No PHI-specific detection and no coverage of AI scribes, file uploads, or personal devices, so patient data needs a second tool - Blocking is a soft block through the extension, and keeping a closed app's Google access revoked needs the Enterprise plan ## Microsoft Defender for Cloud Apps Many health systems already pay for Microsoft Defender for Cloud Apps, because Microsoft's service description includes it in Microsoft 365 E5, A5, and G5 and in EMS E5. Its catalog lists over 31,000 cloud apps, each scored on more than 90 risk factors, per the Microsoft Learn docs, and Microsoft's product page counts more than 1,000 generative AI apps among them. Admins filter discovered apps by Category = Generative AI, alert on new ones with a policy, and can filter vendors by HIPAA when vetting a tool. Blocking has a boundary that matters on a hospital floor full of personal phones. Microsoft's guide to managing generative AI apps says an app tagged Unsanctioned is blocked only on devices onboarded to Defender for Endpoint, so a clinician's own laptop or phone sits outside it, and warn-and-educate is the softer setting. Blocking works at the app level, while prompt inspection lives in Purview, a separate product. Our guide to detecting shadow AI walks through the traffic-log discovery this approach relies on. Contract coverage is the simpler question for Microsoft customers in healthcare. Microsoft states that "The Microsoft HIPAA Business Associate Agreement is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA," and Defender for Cloud Apps is on the in-scope list (Microsoft Learn). A BAA is a contract term, though, and it says nothing about how the tool is configured. Defender shows no owner or spend for an app, and Torii adds both by syncing Defender's Cloud Discovery apps and users across multiple accounts (Torii's Defender integration). It skips log streams that anonymize user data, a privacy setting some security teams turn on. Pros: - Already licensed for health systems on Microsoft 365 E5 - A HIPAA filter on a catalog of more than 31,000 apps - Covered by Microsoft's BAA by default Cons: - Blocking reaches only devices onboarded to Defender for Endpoint - No prompt inspection without Purview, and no owner or spend view ## Netskope Netskope handles discovery and prompt inspection on one platform, as long as traffic runs through it. The AI suite on the Netskope One platform was renamed Netskope Skylight in September 2026, and according to Netskope's generative AI page, its Cloud Confidence Index rates over 370 generative AI apps and 82,000+ SaaS applications. Netskope calls its personal-account control instance awareness, which gives a clinician's personal ChatGPT and the hospital's enterprise tenant different rules. On the prompt side, Netskope One DLP and Skylight AI Guardrails inspect prompts and responses in real time and coach users toward sanctioned tools. According to Netskope's healthcare page, it uses over 3,000 data identifiers, exact data matching, and OCR for scanned medical documents, plus templates for HIPAA and HITECH (the Health Information Technology for Economic and Clinical Health Act) and an audit trail of identity, action, data classification, device, and location. Netskope's own customer data makes the case for prompt controls in hospitals. In healthcare, regulated data made up 89% of generative AI data policy violations, against 31% globally, and users switching between personal and enterprise accounts rose from 5% to 10% (Netskope Threat Labs, Healthcare 2026). The data runs from December 1, 2024 to December 31, 2025. Rollout takes more work than for any extension-based tool on this list. Netskope only sees what is steered through its client or the network, although the client runs on managed and unmanaged devices. There is no owner, spend, or license view, and netskope.com carries no BAA statement, so ask Netskope directly. Pros: - Separates personal AI accounts from corporate instances of the same app - Healthcare DLP with exact data matching and OCR for scanned documents - HIPAA and HITECH policy templates plus an audit trail of identity, action, and device Cons: - Traffic has to route through Netskope, a bigger project than an extension - No published BAA - No owner, spend, or license data ## Harmonic Security Harmonic Security is the most PHI-specific prompt tool on this list. Its healthcare page says "Our PHI model reads each prompt and file in full context, so privacy standards hold even in conversational AI, where a name and a date of birth arrive in the middle of a sentence rather than in a labeled field" (Harmonic Security). It recognizes unstructured EHR excerpts and blocks PHI headed to an unapproved AI tool or a personal account, then points the clinician to the approved one. The healthcare models (clinical trials, EHRs, and general PHI) launched in September 2025 and ship switched off, according to Harmonic's product update. Someone has to turn them on. Harmonic reports discovery across 10,000+ apps, personal accounts included, and prompt-level controls on 1,000+ AI apps at about 200ms of inline latency, on its pricing and healthcare pages. It publishes a HIPAA BAA, and the "HIPAA attested" badge on its site is Harmonic's own, with no auditor named. Deployment runs through Intune, Jamf, Kandji, or Group Policy, and coverage ends where the extension or endpoint agent isn't installed, which leaves unmanaged personal devices outside it. Harmonic keeps no spend, contract, license, or offboarding data, so the owner and renewal questions stay with another system. Pros: - Detection models built for PHI and EHR text - A published HIPAA BAA - Blocks PHI bound for unapproved tools and redirects the clinician to the approved one - Deploys through the MDM tools hospitals already run Cons: - Covers only devices where its extension or agent is installed - No inventory of owners, spend, or offboarding ## Prompt Security (SentinelOne) Prompt Security, acquired by SentinelOne in September 2025 per SentinelOne's 10-Q, is now sold as the Prompt Security Platform. A browser extension identifies which AI apps employees use, then blocks a service outright or allows it while filtering prompts that carry sensitive data, redacting them before submission, and coverage extends to AI code assistants and homegrown AI apps. The healthcare proof comes from Elder Outreach, a HIPAA-covered long-term care provider that rolled Prompt Security out to about 150 employees and found a generative AI chat function inside its outsourced payroll tool (Prompt Security case study). Shawn Parker, the provider's IT director, said "What we needed was visibility that could prevent breaches from happening in the first place." For employee AI use, documented coverage is the browser extension, so native desktop apps and personal devices without it remain open questions. Prompt Security holds no spend, contract, or license data, and we couldn't confirm a BAA from a SentinelOne page, so ask SentinelOne. It's the natural pick for a hospital already running SentinelOne Singularity. Pros: - Finds AI apps and redacts sensitive prompts in one extension - A published healthcare case study from a HIPAA-covered provider - Covers AI code assistants and homegrown AI apps Cons: - Employee-use coverage is documented for the browser extension only - BAA not confirmed on a SentinelOne page ## Grip Security Grip Security finds AI sign-ups by reading corporate email flows, browser activity, and IdP and SSO data, with no agents to install. A clinician who signs up for an AI note tool with a work email shows up even if IT never connected it to SSO, and Grip ties the app to that identity and can revoke access. Grip's coverage numbers need careful reading, because discovery and configuration scanning are counted separately. Its pricing page says it monitors more than 100,000 AI and SaaS apps. Configuration scanning is what an SaaS security posture management (SSPM) tool does, checking how each app is set up, and Grip's covers a narrower 70+ integrations. For a system with many affiliated facilities, pricing is annual per human user, so cost tracks headcount rather than the number of apps. Setup takes about 10 minutes through the API, backfilling usage history takes about five days, and the Try-and-Buy trial runs 30 days at no cost with up to five API connections. Grip says it is not a cloud access security broker (CASB), so it doesn't inspect prompts and needs a prompt tool beside it. Our research found no BAA statement. Security teams already running it can hand the inventory to IT and finance, since Torii syncs the apps and users Grip discovers (Grip Security integration). Pros: - Finds AI sign-ups outside SSO through email flows - Ties each app to an identity and can revoke access - A 30-day trial and about 10 minutes to deploy Cons: - Not a CASB, so no prompt inspection - Configuration coverage is far narrower than discovery ## Reco A Microsoft 365 Copilot agent summarizing a care-team thread, or a Slack agent working in a channel where staff discuss a patient's discharge, is AI that arrived inside tools the hospital already approved, and Reco is built to watch it. The product now leads with security for AI agents in Microsoft 365 Copilot, Salesforce, and Slack, across 18 agent platforms, built on the Reco Graph of identity, permissions, connectivity, and activity (Reco). Reco's SSPM+ package maps findings to SOC 2, ISO 27001, NIST, and more than 20 other standards, and Reco's site lists posture coverage for 260+ SaaS apps and 1000+ detection controls. HIPAA isn't named in that framework list, so ask how Reco maps to it. Nothing on Reco's product pages describes prompt inspection, PHI detection, or a spend view. Pricing isn't public, and no BAA statement turned up in our research, which leaves both for the sales call before a trial touches clinical systems. Pros: - Sees AI agents inside sanctioned SaaS such as Microsoft 365 Copilot and Slack - Maps findings to SOC 2, ISO 27001, and NIST - Threat detection with more than 1,000 controls Cons: - No prompt-level PHI controls - Agent-first positioning, so SSPM-only buyers should confirm SSPM+ is in the quote ## How to Choose a Tool for Shadow AI in Healthcare The proposed HIPAA rule is a useful starting point, because it describes the list every tool here helps build. HHS wrote that "Regulated entities cannot understand the risks to the confidentiality, integrity, and availability of their ePHI without a complete understanding of these assets," in the same Federal Register proposal. Building that inventory is the find-and-govern tool's job, and while the privacy office works through it, a prompt-level tool keeps PHI from leaving. Past the inventory, shadow AI governance in healthcare depends on which gap your health system has. A system already on E5 can start with Defender and add an owner and spend layer on top. Heavy switching between personal and work accounts points to Netskope or Harmonic, while AI inside approved apps is where Reco or Prompt Security fits.