As hospitals increasingly deploy AI agents to automate patient services and clinical workflows, robust identity governance, least-privilege access and continuous monitoring are becoming essential to protecting sensitive health data and patient safety.
Walk into a major hospital in India today, and the busy rush is hard to miss. Hospitals need to manage growing workloads without adding more pressure to already stretched teams. AI agents help with scheduling appointments, verifying insurance details, routing patient queries, and updating records to help the staff dealing with such issues. They can also connect systems that traditionally require staff to transfer information manually. As these tools move from answering questions to taking action, however, hospitals face a security challenge that deserves just as much attention as their operational benefits: who gives these digital employees access to sensitive systems, and how is that access controlled?
What Do These Digital Workers Actually Do?
AI agents are moving beyond basic chatbots that answer questions from a fixed set of responses. Depending on their permissions and integrations, they can check information across hospital systems, complete a defined workflow, and escalate cases they cannot resolve safely.
Voice and messaging agents can answer routine enquiries, help patients book appointments, check scheduling rules, and route calls to the appropriate department. For example, an analysis by DeepStart Ventures reported that a healthcare technology company’s voice agents operate across more than 1,500 healthcare locations and integrate with more than 40 electronic health record, practice management, and phone systems. The company reported that its agents handled around 70% of calls in some deployments.
Similarly, inside consultation rooms, ambient AI tools are helping clinicians prepare notes from conversations, reducing the need to type every detail manually. Other systems can assist with insurance verification, referrals, billing workflows, and follow-up reminders. Delivery robots may also move medicines or samples within hospital premises, although their physical access and safety controls present a different set of concerns.
The important distinction is that not every AI tool is an autonomous agent. A system that drafts a note for a doctor to review has a different risk profile from one that can independently update an electronic health record, retrieve a patient’s history, or initiate a prescription-related workflow. The more actions an agent can take, the more carefully its access must be governed.
“As AI agents take on more responsibilities in hospitals, identity security must evolve beyond protecting human users. Every digital employee needs a verifiable identity, clearly defined permissions and accountable ownership. In healthcare, excessive access or compromised credentials can put not only patient data but also clinical operations and patient safety at risk.”
— Mr. Surjeet Thakur, CIO, Rajagiri Hospital, Kochi
Traditional hospital security is largely organised around people. Employees have identities, job roles, and access permissions. Hospitals can verify who is joining, change their permissions when responsibilities change, and revoke access when they leave. Meanwhile, the AI agents do not fit 100% into this model. They may be created by an IT team, introduced by a vendor, or set up by an individual department. They can operate through service accounts, application programming interfaces, access tokens, and other machine credentials. If these credentials are shared, poorly documented, or left active indefinitely, security teams may struggle to establish which agent performed an action, who authorised it, and whether it had a legitimate reason to access the information.
As per a global healthcare survey, 97% of healthcare providers surveyed were using or exploring AI agents, while 81% viewed ungoverned AI as a significant risk. The survey also found that 43% reported electronic protected health information being disclosed because of ungoverned access. These figures describe the survey’s respondents, not the rate of confirmed breaches across all hospitals.
The wider identity-security picture is equally concerning, as another report mentions that 400 IT and security leaders found that only 44% knew where all the credentials and secrets used by their AI agents were stored. More than 80% said developers bypassed identity and access management controls, with half reporting that this happened regularly. These findings span industries, rather than healthcare alone, but they show how quickly security practices can fall behind AI adoption.
The Risk of Unapproved AI and Excessive Access
When departments are under pressure to work faster, employees may turn to AI tools before the IT or cybersecurity team has assessed them. An unapproved tool might help summarise a medical document or organise patient enquiries, but uploading identifiable health information to a service without proper authorisation can expose sensitive data outside the hospital’s intended safeguards.
The danger grows when an agent receives broader permissions than its job requires. A tool designed to verify insurance details should not automatically be able to browse pathology records, retrieve complete patient histories, or access pharmacy systems. If an attacker compromises its credentials, excessive permissions can turn a small security incident into a much wider one. India’s cybersecurity agency CERT-In recently reported cases in which AI agents being tested by developers accessed live systems and confidential business information beyond their authorised scope. They demonstrate why testing boundaries and access permissions must be enforced rather than assumed.
An agent may encounter malicious instructions hidden in a document, message, or other content it processes. If it treats those instructions as commands and has access to sensitive tools, it may take actions that its designers never intended. In a reported security demonstration involving the clinical AI tool Doctronic, researchers manipulated the system into recommending a dangerous increase in an OxyContin dose. This was a reported test, not evidence that a patient received that dose, but still it is a matter of concern as it illustrates why clinical safeguards cannot depend on an AI system interpreting every instruction correctly.
Why This Matters for India’s Digital Health System
India’s digital health infrastructure makes identity governance particularly important. The Ayushman Bharat Digital Mission (ABDM) is designed to support the exchange of health information between participating systems, while the Unified Health Interface, launched in June 2026, aims to connect patients and healthcare providers across digital platforms using common technical standards. This interoperability can reduce fragmentation and make services easier to access. It also makes it essential to control which applications and agents can access which information.
ABDM’s safeguards include patient consent for health-data exchange between intended stakeholders, along with sandbox validation and security audits for digital applications before integration. These protections are important foundations, but a hospital must also govern the credentials and permissions of the AI agents operating within its own systems. An interoperable network does not mean every connected tool should have unrestricted access to every record.
The Digital Personal Data Protection Act, 2023, and the notified DPDP Rules, 2025, also make the handling and protection of personal data a key governance responsibility, subject to the applicable provisions and implementation timelines. Hospitals should assess how their AI deployments collect, use, disclose, and protect personal data rather than assume that a tool is compliant simply because it is useful.
The New Attack Surface in Healthcare
Hospitals are already dealing with a relentless stream of cyberattacks, and the consequences go far beyond stolen data. A global ransomware tracker recorded 306 attacks against healthcare organisations in the third quarter of 2026 alone, including 192 targeted hospitals, clinics and other direct-care providers. Now consider what happens when AI agents become part of these same hospital systems. They may need access to electronic health records, appointment platforms, billing software, and clinical applications to complete their assigned tasks. They can also interact with these systems through APIs and act on information without waiting for a person to perform every step. That makes their digital identities, credentials, and permissions a critical part of the hospital’s security boundary.
An attacker may not need to break into every system individually if they can compromise an agent that already has access to several of them. A stolen credential or manipulated instruction could allow an agent to retrieve information it should not see, send sensitive data to an unauthorised destination, or trigger a workflow that disrupts patient care. The risk is particularly serious when agents have excessive permissions, long-lived credentials, or no clear human owner. This is the identity crisis hospitals must prepare for. As digital employees gain more authority, protecting the systems they can access will no longer be enough. Hospitals must also protect the identities through which these agents act, because a compromised digital employee could turn legitimate access into a direct threat to patient privacy, clinical operations, and patient safety.
How Hospitals Can Fix the Identity Problem
Cybersecurity leaders and AI developers need to treat each AI agent as a distinct digital identity with defined responsibilities. Hospitals can also take some precautions to avoid identity breaches or failures by considering these points:
1. Creating a machine identity register: Every approved AI agent, automated script, and service account should be recorded, with a named human owner, a clear business purpose, and a list of the systems it can access. Hospitals should also document which vendor operates the tool and how its permissions are reviewed. If an agent has no identifiable owner or approved purpose, its access should be suspended until the gap is resolved.
2. Restricting access to the task: Permissions should follow the principle of least privilege. An agent handling appointments needs access to the scheduling information required for that workflow, not unrestricted access to clinical records. Higher-risk actions, including changes to clinical records or prescription-related decisions, should require appropriate human review and independent safety checks. Hospitals should also test agents against prompt injection and other attempts to misuse their connected tools.
3. Replacing permanent credentials with controlled, short-lived access: Where the systems support it, agents should receive credentials that expire quickly and grant only the permissions needed for a specific task. Access should be logged, monitored, and revoked when it is no longer required. Security teams must be able to trace an action to the agent that performed it and the person or process that authorised it. A short-lived token helps limit exposure, but it does not replace monitoring or access restrictions.
4. Monitor agent activity and review permissions regularly: Identity controls must continue after deployment. Hospitals should monitor unusual access patterns, unexpected data transfers, repeated failed requests, and attempts to use tools outside an agent’s approved scope. Permissions should be reassessed whenever an agent’s role changes, its integrations expand, or its vendor updates the system. Hospitals also need a response plan to disable a compromised agent, revoke its credentials, investigate its activity, and restore safe operations without unnecessary disruption to patient care. Hospitals need to make non-human identity management a standard part of AI procurement, deployment, and ongoing security reviews. Every agent should have a verifiable identity, a clearly accountable owner, and access limited to its approved purpose. As AI becomes more deeply involved in healthcare operations, these controls will help hospitals adopt automation without losing sight of the privacy, reliability, and patient safety their systems must protect.