On the evening of April 29, an employee of Community First Health Plans in San Antonio uploaded a file to ChatGPT. The file held members' names, addresses, birth dates, member identification numbers and prescription drug information. The plan says the employee could reach ChatGPT only by deliberately circumventing its firewall safeguards, and that the upload came from a home computer network.12 The plan learned of it the next day, dated its letters to members June 29, and posted the notice on its member news page on August 7. It has not said how many members were affected.
Notice what the incident lacks: no attacker, no phishing link, no ransomware, no malware. There was a file, a piece of work, and a browser tab that would do it in seconds. The plan's systems flagged the violation at once. It revoked the employee's access, had the data deleted from the employee's account, demanded that OpenAI delete anything related, and ended the employment. Its next steps are log-on time windows, a mandatory VPN, revised policies and retraining.2
My argument is that controls in this position do not lose to an adversary. They lose to the to-do list. Blocking the unsafe path and making the safe path win are different strategies, and only the second removes the reason to go around the first. This is not a defense of the employee, who broke a clear policy and bears the consequences, and it is not a case against firewalls or data loss prevention, which are essential. The claim is narrower: when blocks are the whole strategy rather than the backstop behind a faster sanctioned tool, the workload eventually finds a way around them. I don't know what tools Community First gave its staff, and nothing here depends on guessing.
Workarounds are a symptom
In 1999 Anne Adams and Angela Sasse surveyed 139 computer users and interviewed 30 more at two companies about passwords. People circumvented rules they saw as incompatible with their work, and security departments, which tended to cast users as inherently insecure, rarely explained what the rules protected. Their conclusion was that users have to be treated as partners.3 In hospitals, Ross Koppel and his colleagues found the same thing at larger scale: passwords on sticky notes, foam cups over proximity sensors to defeat screen timeouts, sweaters hung over workstations to keep sessions alive. Workarounds, they wrote, were the norm rather than the exception, because security rules had been designed without the clinical workflow in mind.4
Healthcare has lived through this with each new convenience. In 2015 New York City's public hospital system notified nearly 4,000 patients after an employee emailed a file of their health information to his personal account.5 The same year, a survey at five British hospital sites found that 46 percent of responding doctors had used picture messaging to send patient-related clinical information, and most said they wanted a secure way to do it.6 Each time the ban came first, the usable alternative came later, and the exposure happened in the gap.
Why one paste is different
A texted photograph exposes one image. A forwarded email exposes its attachment. A prompt window accepts whatever fits on the clipboard, so a few thousand rows of names, birth dates and prescriptions can leave in one paste. HIPAA allows a covered entity to give protected health information to a vendor only after it obtains satisfactory written assurances, a business associate agreement, and the Security Rule extends the requirement to electronic records.7 A paste into an unapproved tool skips that step in a second, and the request to delete afterward is a request, not a recall.
Make the safe path the fast one
For us the answer has three parts, and the order matters. We standardized on Microsoft, and we use Copilot and Azure OpenAI under Microsoft's HIPAA business associate agreement, which Microsoft offers by default through its contract terms to covered entities and business associates.89
First, give everyone an approved tool that wins on preference. Microsoft says Copilot surfaces only organizational data a user already has permission to view, and that prompts and responses are not used to train its foundation models.10 Those are vendor terms, and Microsoft itself says its services do not by themselves achieve compliance; configuration, labeling and audit remain ours.8 The operational point is placement. The assistant sits inside the mail, documents and spreadsheets staff already use every hour, behind the same sign-in. When the safe tool is one click away and just as good, the shortcut has nothing left to offer.
The block works. The queue is still 45 minutes long at 4:15.
Same rows, same desk, done by 4:19 inside the agreement.
Second, keep the blocks, as the backstop. Block unapproved AI domains. Write data loss prevention rules that look for member ID formats, birth dates and drug names leaving the tenant. Then read the alerts as demand data. A spike in blocks around one team or one task is a request for a better tool, written in the only language the workflow has.
Third, train with the objects on the desk. An annual slide that says not to enter protected health information into unauthorized systems is correct and useless at 4:30 on a busy Tuesday. Show staff the files they actually handle, the CSV of member IDs, the prior-authorization note with a medication history, the roster with birth dates, and say where each may go. In the assistant inside our tenant, yes, within the user's own permissions. In a browser tab someone opened on their own, never.
Objections, considered
Blaming the workflow excuses misconduct. It doesn't have to. An employee who defeats a firewall breaks policy and faces discipline. But a control that fails whenever a motivated person wants a shortcut is a brittle control. Accountability for the person and better design for the system are separate jobs, and doing one does not discharge the other.
Giving everyone an AI assistant widens internal oversharing. It can. An assistant that respects permissions will faithfully surface every file whose permissions were too broad, so permission hygiene becomes real engineering work before rollout. Still, data that stays inside a tenant with enterprise identity, audit logs, contractual limits on training and a signed agreement is in a different category from member records pushed to a service with none of those.
Strict blocking works in defense and finance. Inside the perimeter, often. Community First's upload came from a home network, and a personal phone or hotspot sits outside any perimeter. Blocks govern the devices you control. The demand comes from the task, and it follows the person home.
Security controls do not just compete against attackers; every day at 4:00 p.m., they compete against the to-do list.
Before the next paste
- Time the safe path against the shortcut. Pick three repetitive text or data tasks your staff do every week, and count the clicks and minutes each takes in your approved tools and in a consumer browser tab.
- Put the covered tool where the work already happens. Deploy the sanctioned assistant inside the apps people use all day, not behind a separate request ticket.
- Treat DLP and domain blocks as the guardrail, not the road. Use them to catch drift and stop unapproved endpoints, and track spikes in blocks as a signal of unmet demand.
- Train with real desk artifacts, not legal definitions. Show staff the spreadsheets, rosters and notes they actually touch, and state plainly where each may and may not go.
Back to that evening in April. Somewhere a person had a column of member names and prescriptions in front of them, and two windows they could put it in. One was faster, and it was the wrong one. The job is to make sure that the window that gets people home on time is also the one that keeps the member's record safe.