The Dilemma of the CISO
If you close your eyes to facts, you will learn through accidents
[Old African Proverb]
Maria Rodriguez stared at the meeting invitation from Jessica Chen.
“Maria - need to discuss data access approaches for AI/ML development. David Park shared some interesting ideas. Want your perspective.”
Interesting ideas. Maria knew what that meant.
David wanted production data for his models. And Jessica, who’d been CDAO for three months, was about to ask Maria to say yes.
Maria opened her security dashboard. 847 data access requests this year. 312 rejected. 418 approved with heavy anonymization. 117 still pending review.
Every single one a potential breach vector.
The Breaches
Maria pulled up her monthly security briefing document. The one she presented to the board. The one that kept her up at night.
February 2024: Change Healthcare (UnitedHealth Group)
The largest healthcare data breach in U.S. history. 192.7 million patient records compromised - approximately 1 in 3 Americans. BlackCat/ALPHV ransomware group gained access through compromised credentials on a Citrix remote access service that lacked multi-factor authentication.
Healthcare operations disrupted nationwide for weeks. Prescription processing halted. Claims systems down. Estimated costs: $2.87 billion in 2024 alone, expected to rise. HHS Office for Civil Rights investigation ongoing. Multiple class action lawsuits. Senators proposed removing caps on HIPAA fines specifically because of this breach.
Maria had highlighted one detail: Basic security failure. No multi-factor authentication. That’s all it took.
The Pattern Accelerates
Two more massive breaches followed in 2024.
Ascension Health System (May 2024): 5.6 million records exposed when an employee downloaded a malicious file. Black Basta ransomware locked 142 hospitals across multiple states. Electronic health records inaccessible for weeks. Doctors forced to paper-based systems in emergency rooms.
Conduent Business Services (October 2024 - January 2025): Business associate breach affecting up to 25 million individuals across major health insurers including Humana and Premera Blue Cross. SafePay ransomware group. Three months of unauthorized access before detection. Texas Attorney General investigating 4 million affected Texans.
Three different attack vectors. One common thread: Over 200 million patient records exposed in a single year.
Maria pulled up another document: IBM’s 2025 Cost of a Data Breach Report. Thirteen percent of organizations globally had reported breaches of AI models or applications. Among those breached, 97% lacked proper AI access controls.
Healthcare was among the highest-risk sectors - 26% of companies reported over 30% of their AI-processed data contained sensitive information.
And what kept Maria up at night: If production data moved into AI development environments without proper controls, would they detect a breach before it became a headline? Conduent went undetected for three months. How long would theirs go unnoticed?
David’s team was frustrated. Fifty-plus data access requests per month. Weeks of waiting. Data with critical fields removed that made models fail.
And somewhere, probably, someone was getting creative with workarounds.
She hadn’t found evidence yet. But she needed to have this conversation with Jessica before the pressure to “move faster” created their own breach headline.
The Meeting
Jessica didn’t waste time. “David explained their challenges. They can’t build effective models with anonymized subsets. I understand your concerns about breach risk. I’m trying to find an approach where both of you can say yes.”
Maria turned her laptop toward Jessica. The breach summary filled the screen.
Jessica looked at the numbers quietly. Over 200 million patient records. Three massive breaches. One year.
“Every single one,” Maria said, “involved basic security failures or business associate compromises. Change Healthcare: no multi-factor authentication. Ascension: employee phishing. Conduent: business associate breach, undetected for three months.”
“I’m not saying David is careless. I’m saying the moment we make production data available for AI/ML development, we create new attack surfaces. And if we get it wrong, it’s not just a fine. It’s CNN showing our patients’ health records. It’s 8 million people whose trust we betrayed.”
Jessica leaned forward. “David made a distinction I want you to consider. He said deletion destroys the data patterns his models need. Synthetic data doesn’t work - their accuracy drops from 87% to 61% in production. What he’s asking for is transformation - keeping behavioral patterns while removing identifiability. Not deleting fields, transforming them.”
“He acknowledged he can’t answer how to measure re-identification risk. He said that’s your domain.”
Maria was quiet for a moment. “So what would it take for you to feel comfortable?”
The Technical Reality
“If what David’s describing is true - transformation that preserves patterns while removing identifiability - then the question becomes: how do we know it worked?”
Maria pulled up a slide. “Latanya Sweeney’s study from Harvard showed 87% of Americans can be uniquely identified using just zip code, birth date, and gender. She re-identified the Massachusetts governor’s medical records using public voter data.”
“Frameworks like k-anonymity and differential privacy can help. But they work well in research settings with clear boundaries. When we talk about 50 million claims, 12 million prescriptions, 8 million members at production scale, the stakes are materially higher. If the controls don’t hold up, it’s not a theoretical discussion anymore. It becomes an executive accountability issue.”
Jessica was taking notes. “So you need to measure the risk.”
“Exactly. We need to measure re-identification risk quantitatively before data scientists ever touch it.”
The Personal Question
Maria closed her laptop. “There’s something else. I’m an AIVentra member. Have been for six years. My prescriptions, my claims, my medical history - all in that production database.”
“When I enrolled, I consented to standard uses - claims processing, care coordination, quality improvement. Did I consent to my health data being used to train AI/ML models? Did any of our 8 million members?”
“And it’s also a question for your board presentation. When Change Healthcare announced their breach, patients felt betrayed not just because data was exposed, but because many didn’t know their data was being used by a third-party company. The breach revealed a data flow they never authorized.”
“As a CISO, I protect data from unauthorized access. But as a patient, I’m asking: should we also protect patients from unauthorized uses?”
The Blocking Illusion
Jessica met Maria’s eyes. “Can I be direct with you?”
“Go ahead.”
“Do you believe our current approach is actually protecting patients? Or are we creating an illusion of protection while the real risk grows?”
Maria felt the challenge in that question.
“David’s team submits 50+ requests per month. Most get delayed or rejected. They’re frustrated. They know competitors are moving faster.” Jessica paused. “At some point, doesn’t someone get creative? Copy data to a personal environment? Use a third-party tool that bypasses our controls?”
“I haven’t found evidence of that,” Maria said.
“Yet. You haven’t found evidence yet.” Jessica’s voice was quiet but firm. “That’s what happened in some of these breaches. People created workarounds when institutional processes moved too slowly.”
Maria thought about Conduent. Three months undetected. How many breaches started with well-intentioned workarounds?
“And here’s the other question,” Jessica continued. “Our competitors are moving 10x faster on AI. Are they breaking HIPAA rules? Or did they solve this problem and we’re the ones falling behind?”
Maria had wondered the same thing. She’d asked peers at conferences. The answers were vague. “We have processes.” “We work closely with our teams.” Nobody admitted what they were actually doing.
“There’s a third option,” Maria said. “They’re gambling. Copying production data and hoping they don’t get breached. Some will get away with it. Some will be next year’s headline.”
“So what’s the actual safe approach?”
Maria pulled her laptop back open. Something had shifted in her thinking.
“The actual safe approach isn’t blocking. It’s measuring.”
The Technical Path
“David’s right that transformation is different from deletion,” Maria said. “If we delete fields, we destroy utility. If we leave fields intact, we risk re-identification. Transformation is the middle path but only if we can measure whether it’s working.”
She pulled up a framework diagram. “Three components:”
“First: Transformation with measurable parameters. We document exactly what we’re doing - which fields, which techniques, which statistical properties we’re preserving. Reproducible. Auditable.”
“Second: Re-identification risk measurement. Before transformed data reaches data science teams, we test it. Can we link records back to patients using public datasets? Can we distinguish individuals using preserved patterns? We quantify the risk, not just hope it’s safe.”
“Third: Audit and monitoring. Every access logged. Every model documented. Every environment monitored. If someone tries to exfiltrate data or merge it in ways that enable re-identification, we know immediately.”
Maria paused, realizing something. “And here’s the defensive advantage: if these three components are in place, and someone does breach the AI development environment - which we have to assume will eventually happen - they get transformed data, not production PII.”
She almost smiled. “We’re essentially creating a defensive layer where the data in the most vulnerable environment is already protected. On its face, it looks like production data. Statistically, it behaves like production data. But the actual PII is gone. If hackers exfiltrate it, they’ve stolen data that can’t be traced back to real patients.”
Jessica wondered, “Would this work technically?”
Maria paused. “I don’t know yet. But conceptually, this is the direction. Transformation plus measurement plus audit. Manage the risk rather than pretend we can avoid it.”
“But with three conditions.”
“One: Lisa confirms we can build the infrastructure for transformation and audit at production scale. Two: James validates that transformed data actually works for model training. Three: Legal reviews our patient consent and communication strategy.”
Jessica stood up. “I’ll talk to Lisa about infrastructure, James about validation, Legal about classification. If it’s technically feasible, will you present the security framework to the board?”
“Thank you, Maria.”
“Don’t thank me yet. Thank me if we pull this off without becoming next year’s breach headline.”
The Evening
That night, Maria thought about her mother. Stage 3 breast cancer survivor. Six years in remission.
If AI models trained on data like theirs could predict which patients needed closer monitoring, could catch recurrence earlier, could save lives…
Would Maria consent to her data being used for that?
Yes. If the transformation was done right. If the risk was measured. If the data was protected. If she was asked, not assumed.
That was the difference between compliance and trust.
Maria added a note for Jessica: “Recommendation: Patient consent communication strategy. Ask patients if they want to contribute to AI that could help others. Give them choice.”
Some would say no. That was their right.
But she suspected many would say yes. If asked. If trusted. If shown the care that went into protecting their data while using it to help.
There had to be a middle path.
And maybe, just maybe, they were about to find it.