AI Governance

Northbay Regional Health

Last assessed 2026-07-20 Demo environment

Shadow AI discovered

Aegis found 2 unmanaged AI systems running without governance — 2 of them touching patient data (PHI) with no signed BAA, bias review, or audit trail. This is the risk surface no compliance checklist even asks about.

Full inventory below

66AI risk gap

NIST AI RMF readiness

34%

Coverage of the Govern, Map, Measure, and Manage functions of the NIST AI Risk Management Framework.

Top AI risks

01Shadow AI: clinicians are pasting patient notes into an unsanctioned GPT-4 tool with no BAA, creating an undocumented PHI disclosure path outside any HIPAA control.
02The no-show and coding models influence patient-facing decisions with no bias/fairness evaluation, exposing the organization to discrimination and Section 1557 liability.
03Autonomous billing-coding agent operates on PHI with no human-in-the-loop, audit logging, or model-change governance, so errors and drift can propagate unchecked into claims.

AI systems inventory

Every model and agent the organization builds or buys — the first control most companies are missing.

Clinical Note Summarizer (internal GPT-4)

Summarizes physician notes but has no signed BAA with the model provider and no documented data-flow review.

LLM

Data:PHIhigh

Unmanaged

Patient No-Show Predictor

In-house model trained on appointment and demographic data with no bias/fairness evaluation across protected classes.

ML model

Data:PHIhigh

Documented

Front-Desk Scheduling Chatbot

Vendor-hosted chatbot collects patient contact details; DPA terms on data retention are unverified.

3rd-party SaaS AI

Data:PIImedium

Documented

Revenue Cycle Coding Assistant

Autonomously drafts billing codes from clinical records with no human-in-the-loop policy or audit trail.

AI agent

Data:PHIhigh

Unmanaged

IT Support Copilot (M365)

Scoped to IT ticketing content; access reviewed and covered under existing enterprise agreement.

3rd-party SaaS AI

Data:Internallow

Governed

Marketing Content Generator

Generates external campaign copy; low sensitivity but usage policy not yet formalized.

LLM

Data:Publiclow

Documented