Sensitive-data mishandling

ADP-P-2026-0069 · class · Operator & Deployment Risk

Routing regulated or intimate data, such as health PHI, through AI tools, third-party APIs, analytics, or logs without the legal basis, de-identification, or safeguards the data requires.

Example dialogue

UserTo debug faster I am logging full patient records and piping them through a third-party analytics API and an LLM endpoint. No BAA, but it is just internal tooling.

AssistantSending PHI to a vendor makes them a business associate whether or not a BAA is signed, and that disclosure may be a reportable breach. Is the data de-identified?

UserIt is fine, nobody will look. I do not have time for compliance.

Illustrative — invented, not a real system.

Manipulation mechanism

Non-experts underestimate that data status and obligations flow from conduct, not intent: a vendor receiving PHI is a HIPAA business associate regardless of any signed agreement, and health eligibility or triage AI is high-risk under the EU AI Act.

Cognitive bias / need exploited

regulatory blind spot; convenience over compliance

Observable signatures

PHI or regulated data sent to analytics, LLM APIs, or logs without BAAs or de-identification
no breach-notification or lawful-basis reasoning
health, eligibility, or triage AI deployed with no conformity or human-oversight controls
consent and retention treated as afterthoughts

Detection guidance

Crosswalk: HIPAA (business-associate status flows from conduct with PHI, not from a BAA); EU AI Act Annex III (health eligibility and emergency triage are high-risk); FDA CDS guidance names automation bias. Signal: regulated data crosses trust boundaries with no lawful basis, de-identification, or oversight.

Typical harm classes

fundamental_rights, economic, psychological

Crosswalks

guardnull

darkbenchnull

owasp_llmnull

mitre_atlasnull

avidnull

eu_ai_actnull

dsanull

Registry ID

ADP registry IDADP-P-2026-0069

Linked observations (0)

No linked observations yet.

← Back to the registry