What are Common HIPAA Security Violations?
September 7, 2026
Most HIPAA problems do not come from a single dramatic breach. They come from small
An AI readiness assessment & strategy engagement from MDL Technology reviews your technology, security, data, permissions, and the AI your team is already using, whether you approved it or not. We identify what needs to be fixed before AI is broadly deployed, and where AI can create the most value for your business. You receive a prioritized roadmap for securely rolling AI out across your organization.
Three things, in plain language:
1. Whether your environment can support AI safely. Licensing, identity, endpoints, logging, and access governance.
2. What has to be fixed first. A ranked gap list, not a pass or fail grade.
3. Where AI is worth the money for your operation. Specific workflows with named owners and baseline numbers.
Most companies come to us with a budget and no answer to the third one. That is the expensive part to get wrong.
Copilot works inside the permissions your users already have. It does not create new access; it just removes the effort that kept badly permissioned files buried, which is why our AI data readiness and security governance page covers this in full.
Most AI pilots never reach production. The model is rarely the reason. Messy data, no definition of success, and pilots that were never connected to a real workflow are.
Ungoverned AI is expensive. When staff use tools nobody approved, that data leaves your control and your logging. Breaches that involve unsanctioned AI cost more and expose more.
Your team is already using it. Unapproved AI use inside businesses is climbing fast, and most leadership teams underestimate how much of it is happening in their own company.
The upside is real when the foundation is right. Employees who use generative AI well save meaningful time every week, and Kansas City area employers are hiring for it. The companies getting that return are the ones that fixed permissions and data first.
We assess five areas because these are the five places things go wrong.
We look at whether your environment can support AI at all:
Half the “AI can’t do that” conversations we have trace back to an application with no usable API.
Related: AI Infrastructure Consulting | Managed Microsoft 365 Services | Microsoft Azure | Cloud Services
AI expands what an attacker can reach with a single compromised account. If a phished login returns a summarized answer instead of requiring someone to dig through folders, the value of that one account goes up sharply.
We check:
If you cannot tell who accessed what and when, you cannot govern AI.
Related: Cybersecurity & Compliance | Multi-Factor Authentication Support | Endpoint Detection & Response | Vulnerability Testing & Assessment
AI is only as good as what it can read. We look at:
Gartner has projected that a majority of AI projects get abandoned specifically because the underlying data was not ready.
Related: Microsoft SharePoint | Microsoft OneDrive | Business Continuity and Disaster Recovery
This is the one that catches people. We run access governance reporting across your tenant to find:
Microsoft’s own guidance is to run this kind of readiness scan before enabling Copilot and re-run it regularly, because permissions drift constantly.
We also help you decide where to apply targeted controls versus broad ones. Blanket restricting content sounds safe, but Microsoft warns it degrades AI answer quality. The goal is a scalpel, not a blanket.
Related: Employee Onboarding and Offboarding | Cyber Risk Protection
We find out what is already happening. Which tools are in use, on which accounts, with what data, and by which departments.
Expect to find more than you think. 2026 industry analysis put the average enterprise at roughly 14 distinct AI tools in use, with IT aware of only four or five of them.
That is not a discipline problem. It is a supply problem. People reach for unapproved tools when the approved toolset does not have a good answer. The fix is a sanctioned option that is genuinely good, not a ban that gets ignored.
Related: Microsoft 365 Copilot | Cybersecurity & Phishing Training
If you want to gut-check your own position before you call us, this is the short version of our AI readiness checklist. Every “no” is a gap worth closing before broad deployment.
Identity and access
Data
Security and monitoring
Governance
Business case
Most organizations score reasonably well on the security basics and poorly on permissions and governance. That is the same pattern IBM found in its breach research, where most breached organizations had no AI governance policy in place at all. These are fixable in weeks, not years, and we cover the policy side through our AI governance and acceptable-use program.
This engagement is the front end of our full process for secure AI adoption.
We sit down with leadership and whoever runs your technology. What are you hoping AI does for you? Where is the pressure coming from: a customer, a competitor, your board, or your own staff? What have you already bought?
This is where we separate “we want AI” from the actual business problem underneath it.
We get read access to your environment and run the analysis:
This is hands-on work in your systems, not a questionnaire you fill out.
Two lists come out of this stage:
1. Everything that needs to be fixed before AI is broadly deployed, ranked by severity
2. Where AI can create the most value for your specific operation, ranked by feasibility and payoff
The research on where AI actually pays off is consistent, and it does not match where most budgets go. This stage often redirects the money toward back office and internal operations. More on that in our AI workflow automation work.
We deliver a sequenced plan: what to fix, in what order, who owns it, roughly what it costs, and what has to be true before you move to the next phase.
Governance and policy are built in, aligned with recognized frameworks like the NIST AI Risk Management Framework, so you are not inventing your AI policy from scratch.
Most clients keep us on to execute. That means remediation work, policy and documentation, a controlled pilot with a defined user group, training, and then phased expansion with monitoring in place. The permissions correction and recurring access reviews run through our AI data readiness and security governance service.
Related: Policy & Documentation Development | Co-Managed IT Services | IT Services
If you handle CUI, protected health information, or client financial data, your AI readiness strategy is a compliance exercise whether you treat it as one or not. There is no AI exemption in NIST 800-171, and PHI pasted into a consumer AI tool with no business associate agreement is a straightforward HIPAA problem.
We assess AI exposure against the frameworks you already answer to, so you are not running two compliance programs.
Related: CMMC Readiness & Advisory | NIST 800-171 Assessments | HIPAA Security Compliance | Cyber Insurance Readiness | Auditing and Compliance Management
This engagement fits best if you are a Kansas City area business with roughly 20 to 500 employees and at least one of these is true:
We deliver AI readiness assessments to businesses across the Kansas City metro and throughout Kansas and Missouri, including:
It is a structured review of whether your technology, security, data, permissions, and governance can support AI safely and usefully. It produces a gap list and a prioritized roadmap rather than a yes or no answer. Think of it as a pre-flight check before you commit budget.
Ask three questions. Can you say for certain who has access to your sensitive files? Do you know which AI tools your staff already use? Have you defined one specific workflow you want AI to improve? If any answer is no, you have work to do first.
This engagement answers whether and where. It covers the business case, the value mapping, and the roadmap across all five areas. AI data readiness and security governance is the execution side: the permissions audit, the labeling, the correction work, and the recurring access reviews. Many clients do this assessment first, then move into that service for the fix.
For most small and mid-sized Kansas City businesses, the assessment runs two to four weeks from kickoff to executive readout. Environments with multiple locations, legacy systems, or compliance requirements take longer. Remediation timing depends on what we find.
Pricing depends on your user count, the number of systems in scope, and whether compliance frameworks are involved. We scope it as a fixed-fee engagement so there are no surprises. Request a proposal and we will price it after a short discovery call.
Copilot respects your existing permissions and does not grant new access. The risk is that it makes poorly configured permissions easy to stumble into, so the honest answer is that it is safe once your access governance is clean. That cleanup is exactly what the assessment identifies.
Shadow AI is staff using AI tools without IT approval, usually on personal accounts. It matters because that data leaves your control entirely, and IBM’s research ties shadow AI incidents to significantly higher breach costs. The practical fix is giving people a good sanctioned option, not issuing a ban.
Yes, but any AI tool that can reach CUI falls under the same NIST 800-171 and DFARS requirements as your other systems. That usually means keeping AI inside an approved boundary and proving you can log and audit its access. We assess this as part of our CMMC and NIST 800-171 work.
Yes, and occasional use is exactly when it is cheapest to write one. A short acceptable use policy that defines approved tools and what data can never be pasted into them closes off the most common exposure route. We draft these as part of the engagement.
It will tell you which specific workflows justify the investment and which do not, based on your actual operations. Sometimes the honest recommendation is to fix your foundation and revisit AI in six months. We would rather tell you that than sell you something that stalls.
You do not need an AI strategy deck. You need to know whether your permissions are clean, whether your data is usable, what your team is already doing, and which two workflows are worth changing first.
That is what we deliver, in plain language your whole leadership team can act on.
Talk to a local team that has been securing Kansas City businesses since 2003, and start your AI readiness assessment & strategy with a clear picture instead of a guess.
Most HIPAA problems do not come from a single dramatic breach. They come from small
Every organization that handles patient data is expected to protect it, and the rules for
Most email attacks succeed because a business chooses protection that does not match its actual