What are Common HIPAA Security Violations?
September 7, 2026
Most HIPAA problems do not come from a single dramatic breach. They come from small
MDL Technology provides managed AI services for Kansas City businesses that want AI treated like the rest of their technology environment. We handle users, licenses, security, governance, integrations, and ongoing support, so your company gets real AI expertise without building an internal AI team.
Most companies buy an AI license and assume the work is done. The work is just starting. Here is what we take off your plate.
AI access should follow the same joiner, mover, and leaver process as every other system you run. We set who gets which tier, apply role-based access, and enforce multi-factor authentication on AI tools.
When someone leaves, their access is revoked on day one, including any agents they built. It runs through our existing onboarding and offboarding process.
Microsoft 365 Copilot is an add-on, not a standalone product. Whichever tier you land on, it sits on top of a Microsoft 365 license you are already paying for. Current per-seat pricing and the SKU comparison live on our Microsoft 365 Copilot consulting page.
We track who actually uses their license, reclaim dormant seats, and flag users whose needs are covered by the free Copilot Chat tier already in their plan. What unused seats cost over a year is usually more than leadership expects. We also watch consumption-based agent charges before they show up at renewal.
Copilot does not create new access. It makes the access you already granted searchable in plain English. In a Gartner survey reported by Computerworld, 40 percent of organizations delayed their rollout by three months or more over oversharing, and 64 percent said governance and security risks ate significant time and resources.
Our work here includes:
It is an extension of the cybersecurity and compliance work we already do for you.
We build and maintain your AI system inventory, approved tool list, and written acceptable use policy, aligned to the NIST AI Risk Management Framework or ISO 42001 where your industry calls for it.
This is what closes the shadow AI gap, and the gap is widening fast; unapproved AI use roughly tripled across a single year of Verizon’s reporting. Our policy and documentation team handles the written side; our engineers handle the controls behind it.
Copilot Studio lets a non-engineer build a working agent in an afternoon, usually without IT or security in the loop. Every agent is a non-human identity with its own credentials, and connectors often carry broader permissions than any single user has.
Since March 18, 2026, Copilot Studio creates an identity for every new agent automatically, and as of July 2026, you can no longer opt out. Older agents still run on app registrations, and Microsoft offers no automated migration path, so each one has to be rebuilt by hand and the old identity decommissioned.
We keep a register of what exists, who owns it, what it touches, and when it gets retired.
AI questions arrive at our help desk like any other ticket, handled by the same local team.
We also track vendor changes, since AI platforms ship updates monthly, and run a scheduled review of usage, spend, permissions, and policy.
These are the five failures we see most often in environments that adopted AI without a plan for managing it.
Shadow AI becomes the default. When approved tools are slow or restricted, people use personal accounts, and IBM’s breach research attaches a significant cost premium to exactly that pattern. The current figures are on the cost of getting AI adoption wrong, and the policy response is on our AI governance and acceptable-use page.
Old permission mistakes become visible. Salary files, HR notes, and client documents that sat undisturbed for years become one prompt away from any licensed employee.
Spend drifts upward with nothing to show for it. Seats stay assigned to people who stopped using them, and nobody audits the invoice.
Compliance gaps open quietly. An undocumented AI tool inside an assessment boundary is a finding, even if no sensitive data ever touched it.
Agents outlive their owners. Service accounts, tokens, and OAuth grants created during a pilot keep running long after the pilot ends and the person who built them has moved on.
There is no shortage of firms offering AI advice right now. Here is what makes us a different kind of managed AI company.
We document every AI tool already in use across your business, including the ones nobody told IT about. This usually surfaces more than leadership expects.
Before any rollout, we audit permissions, sharing links, orphaned sites, and data classification. Fixing this after AI is live is significantly harder than fixing it before.
We deploy to a small pilot group first, typically IT and security staff, who are best positioned to catch unexpected data surfacing before it reaches the wider business. We test, document the gaps, then expand.
Policy, approved tool list, agent register, and role-based user training. This is also where we handle security awareness training covering safe AI use.
Monitoring, license optimization, permission checks, vendor change tracking, and a scheduled business review covering usage, spend, and risk. This is the part that makes it managed rather than deployed.
If you handle regulated data, generic AI advice is not just unhelpful. It is a liability.
Defense contractors and manufacturers. Under DFARS 252.204-7012, any cloud service touching CUI must meet FedRAMP Moderate at minimum. Commercial ChatGPT, Claude, Gemini, and GitHub Copilot do not carry that authorization. Assessors also expect technical controls such as DNS filtering and DLP, not just a written policy telling people not to use AI. Every AI tool inside your boundary belongs in your System Security Plan, and if you use none, document that too, because assessors will ask.
Healthcare and medical practices. Consumer AI tools have no HIPAA business associate agreement. Any PHI reaching them is an unauthorized disclosure, regardless of intent.
Accounting and financial firms. Client confidentiality obligations do not pause because a tool is convenient. We help you separate what AI can process from what it cannot.
Public sector and legal. Missouri has not passed a comprehensive AI statute, but the Attorney General can act under the Missouri Merchandising Practices Act, and AI-related data exposure is treated like any other breach under state law. Kansas has not enacted AI-specific legislation either. In practice, that means federal frameworks and your contract requirements are what actually govern your AI use.
Our compliance management and audit support team documents all of it so your AI program holds up under review.
We serve businesses across Kansas and Missouri, with on-site support throughout the metro:
See our full service area for every city we cover.
Managed AI services are an ongoing plan where a provider handles the users, licenses, security, governance, and integrations behind your AI tools. It is the managed IT model applied to AI. The provider runs it as a continuing service instead of a one-time deployment project.
Pricing depends on your user count, which AI platforms you run, and your compliance requirements. Most providers price per user or as a flat monthly add-on to an existing managed IT agreement. MDL builds a custom proposal after reviewing your environment, so the number reflects your actual setup.
Often yes, because Copilot inherits every permission decision your organization has ever made. The security and licensing work sits in your Microsoft tenant, not in the Copilot product itself. Our Microsoft 365 Copilot page covers deployment specifically.
Not in its commercial form. Tools processing CUI must meet FedRAMP requirements, and standard commercial AI services do not carry that authorization. Approved paths generally mean a private deployment inside your boundary or Microsoft 365 Copilot in a GCC High tenant.
Microsoft offers a business associate agreement covering Microsoft 365, but compliance depends entirely on how your tenant is configured and which data Copilot can reach. Consumer AI tools have no BAA at all, which makes any PHI entered into them an unauthorized disclosure.
Blocking alone tends to fail, because people find workarounds when the approved option is inconvenient. We combine technical controls like DNS filtering and DLP with a genuinely usable approved tool, then train the team on what belongs where.
Copilot only surfaces what a user already has permission to open, so it does not grant new access. The risk is that years of overly broad sharing become easy to find. That is why we audit and remediate permissions before rollout rather than after.
Discovery and an environment readiness review typically take a few weeks depending on tenant size and how much permission cleanup is needed. Rollout and governance build follow from there. Ongoing management continues for as long as you use AI.
Yes. MDL serves businesses across Kansas and Missouri, with remote support statewide and on-site visits throughout the metro.
AI belongs in the same category as your network, your servers, and your Microsoft environment. It needs an owner, a review schedule, and someone accountable when it changes.
Since 2003, MDL Technology has kept Kansas City businesses secure and running from our office in North Kansas City. We would like to do the same for your AI.
Request your free proposal today and see why Kansas City businesses trust MDL Technology for managed AI services.
Most HIPAA problems do not come from a single dramatic breach. They come from small
Every organization that handles patient data is expected to protect it, and the rules for
Most email attacks succeed because a business chooses protection that does not match its actual