PHI is reachable by identities nobody in your org owns.
Clinical systems accumulate integration accounts faster than anyone retires them. HL7 interfaces, imaging gateways, research pipelines and EHR connectors all run as non-human identities — and most of them were provisioned by a vendor implementation team that left years ago.
The frameworks that ask you to account for this data. Not certifications we hold.
Four things your team already knows — and cannot currently prove.
Vendor integration accounts outlive the vendor
EHR, PACS, lab and revenue-cycle integrations are installed with broad service-principal access "to make go-live work." Nobody revisits the scope after go-live, and the implementation partner is off the contract.
Clinical uptime beats least privilege, every time
No one will risk breaking a care-delivery interface to tighten a role. Without proof of exactly what an identity reaches, "reduce this permission" is an unacceptable clinical risk.
Research and production share a tenant
De-identified research pipelines and identified clinical data end up in the same subscription. One managed identity with subscription-level read is a HIPAA finding waiting for an auditor.
The OCR question has no owner
"Who has access to ePHI, and how do you know?" is answered today with an access-review spreadsheet from last quarter that covers humans only.
The same graph, pointed at your regulated data.
Start at the PHI, work backwards
Classify storage accounts, databases and datasets into a PHI trust zone, then list every human, service principal, managed identity and AI agent that can reach them — with the path and the privilege that grants it.
Scope safely, with evidence
Before you cut a permission you see exactly which resources that identity touches. Right-sizing an interface account stops being a clinical gamble.
Findings without sign-in logs
Legacy clinical integrations rarely produce usable telemetry. Verdicts are derived from role assignments and federation, so a silent interface account is still assessed.
Evidence an OCR auditor accepts
Every access statement decomposes to a scope string, a role definition and a snapshot timestamp — not a screenshot of a dashboard.
What a first snapshot typically surfaces.
Non-human identities holding subscription Owner over PHI-classified storage in one pilot tenant — none with a recorded owner.
Sign-in events for 41% of privileged identities in the same tenant. A behavior-based tool would have reported nothing.
From read-only consent to the first ranked PHI-exposure finding.
Find the reach you never granted.
A scoped assessment against your own Azure tenant. Read-only, agentless, and nothing is written to your environment — ever.
Free forever — 1 subscription, 500 identities · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available