Healthcare & life sciences · case-study · Mar 2026

The discharge-summary model was reading full patient names

A hospital's discharge-summary drafting step was handing the model complete patient identifiers. Here's what an Inspector caught in Watch mode — inside the hospital's own walls, nothing run.

The workflow you already run

Clinicians spend hours writing discharge summaries, so a model drafts the first pass: it reads the encounter record and returns a structured summary the clinician edits and signs. Faster days, happier staff. It reads, to everyone involved, like a productivity win — not a data-governance event.

The risk you can't yet see

But the encounter record handed to the model is the whole record: patient name, medical record number, date of birth, address — protected health information, travelling to the model because that's simply what was in the field. If the model runs anywhere but inside the hospital's walls, that PHI has left the building. And when a compliance officer asks which identifiers reached the model and whether any left the tenant, there is no record to answer with.

What an Inspector caught

Run in Watch mode, on the hospital's own infrastructure, an Inspector observed the same drafting call — touching nothing, changing nothing:

On record

Three direct identifiers it would have redacted before the model saw them. One address buried in free-text it would have flagged for review. All of it recorded and signed, on the hospital's own stack, with the model running in-tenant and nothing leaving the walls. Watch first — prove the exposure and the fix at zero risk, before an Inspector is trusted to touch a live record.

← All insights