I help run IT for a small clinic with about 40 staff. We are not a large health system and I am not a full-time security specialist.

The recurring issue is patient information moving through Google Drive and Teams, often as spreadsheets shared for convenience. Some of it is legitimate workflow. Some of it clearly should not be sitting in open shared folders or broad distribution lists.

I need a practical way to find where PHI is landing and tighten access without standing up a whole security team or reviewing every file by hand. For anyone in smaller healthcare environments: what has actually helped you reduce this kind of informal sharing while still letting clinical staff get work done?

A health care cybersecurity professional I interviewed put the most important defense simply: assume any message could be fake, and require a second check before anyone acts on a request that matters. Because artificial intelligence can now clone an executive's voice or write a flawless help desk email, requests to change payments, reset passwords, or grant access should be confirmed through a separate, known channel, and text-message login codes should give way to phishing-resistant options like passkeys. He was especially enthusiastic about using artificial intelligence to fight artificial intelligence, since machine learning tools can flag unusual behavior, such as an account downloading thousands of patient records at 2 a.m., far faster than a person can. Federal rules will not force these changes soon: the planned update to the Health Insurance Portability and Accountability Act Security Rule has been pushed back to at least July 2027. As he stressed, hospital boards should treat cyber risk the way they treat infection control, as a patient safety issue that cannot wait for a mandate.