When healthcare practice management vendor Unlimited Technology Systems (UTS) disclosed a breach affecting more than 3.8 million patients this summer, most of those patients had never even heard of the company. They knew their oncologist or specialty clinic, but they had never chosen UTS or signed up to engage with the company. That’s because UTS sat behind the billing desk, processing revenue cycle data for thousands of providers, until an attacker spent five days inside its data center and walked out with Social Security numbers, insurance records and diagnosis details.
Unfortunately, this type of healthcare risk is becoming more common, particularly as AI agents become yet another threat vector. The vulnerability arises indirectly through someone you granted access to.
Notice that the UTS breach was discovered in October 2025, but patients weren’t notified until July 2026. For roughly nine months, patients whose Social Security numbers and diagnoses had been taken were not told and couldn’t do anything to protect themselves with things like fraud alerts or credit freezes. Six of the ten largest healthcare breaches reported in 2026 originated this way at business associates instead of the providers whose patients were impacted. The perimeter most organizations are still focused on defending is no longer where the damage is occurring.
The real vulnerability is what happens next
Security teams spend an enormous amount of energy on the moment access is granted, from the vendor security review to the certification check. Then they treat that decision as permanent and stop paying attention. Most “access” problems are a result of leftover access where a vendor, integration or service account was given the access it needed, yet it was never taken back.
The IBM 2026 Cost of a Data Breach Study found that the average global cost of a data breach has climbed 12% to nearly $5 million, and healthcare is still the most expensive sector at $6.64 million per incident. The breaches that come through the supply chain tend to be the ones that stay hidden the longest. Supply chain compromises took an average of 258 days to identify and contain in 2026, compared with 247 across all attack types. Why? Because they don’t show up in malware scans or inbound traffic. That leaves over eight months in which an attacker can operate with permissions an organization issued and forgot.
Now consider what happens when the identity holding those permissions isn’t a person.
AI agents require tighter oversight than employees
There’s no question that AI agents inside healthcare vendor ecosystems make things way more efficient. They reconcile claims, spot anomalies, move data between systems and act on behalf of users at a speed no human team can match. But every one of those agents is a non-human identity with credentials, permissions and reach into environments where patient health information lives.
While humans with excessive access are a latent risk, an autonomous agent is an active one, operating around the clock with no way for a control to catch it. McKinsey found that only about 30% of organizations have reached a meaningful level of maturity in strategy, governance or agentic AI controls and that security and risk concerns are now the biggest barrier to scaling agentic AI.
These identities are being deployed into regulated environments faster than they are being tracked and supervised. When an agent trained on or connected to regulated data does something unanticipated, who owns the risk? The identity that moved that data isn’t a person you can hold responsible.
Non-human identities need the same lifecycle discipline we give employees: provisioning, rotation, revocation and monitoring. In fact, they need more because they don’t announce their presence or pause long enough to get caught.
Auditing an AI vendor after it touches patient data is already too late
In regulated industries, the instinct is to shore up security by ordering an audit of existing AI vendors. But an audit only tells you what already happened. If an AI vendor has handled patient health information it wasn’t supposed to, there’s now a compliance problem on top of a security problem.
Regulators used to accept documentation as evidence of compliance, but they now want proof in real time that controls actually worked. Reconstructing the incident after the fact or passing last year’s audit doesn’t tell you if an agent is secretly accessing data today with permissions no one validated. Evidence that you’re being diligent has to exist before something goes wrong.
That means security has to be in place before a new AI tool goes live. In an agentic environment, this means continuous monitoring, policy-as-code and controls that generate their own audit trail are the only way to stay ahead of identities that move faster than an annual review cycle.
Containment is what saves you
Assume there will be failure somewhere, at some point, and plan for it. Something in your chain will eventually break, whether it’s a vendor, credential or misconfigured integration API. High prevention scores won’t save you, as they focus more on telling you how well you keep attackers out.
The largest healthcare breaches happen once an attacker is already inside with valid credentials, so the goal is limiting the blast radius before anything goes wrong.
The following are practical containment tips to start with:
- Give every user or AI agent only the minimum amount of access necessary and ensure access is time-bound.
- Assign a specific owner to every integration and API to ensure monitoring.
- Segment networks so that one vendor connection can’t become one big space connected to everything.
- Keep immutable logs so you can answer questions accurately.
- Build the ability to revoke a credential or sever an integration the moment it turns hostile.
Remember: interoperability does not require permanent, open access.
The UTS breach will not be the last of its kind. The next one will probably involve an autonomous identity moving data through a vendor environment no one was watching closely enough.
It’s time for aggressive, real-time containment and zero-trust oversight of every identity in your vendor chain before patient data is compromised, not after it makes the news. This is especially true for the rising number of non-human identities entering the healthcare vendor ecosystem. With the right access controls in place, even if a bad actor slips in, the damage will be automatically contained.
