{ "report_id": "OEP-20260424-172732", "generated_utc": "2026-04-24T17:27:32.741964+00:00", "customer_name": "Regional Healthcare (ORACLE Endpoint Live Proof)", "period_start_utc": "2026-04-24T17:27:32.675957+00:00", "period_end_utc": "2026-04-24T17:27:32.713680+00:00", "total_events": 22, "blocked": 15, "warned": 2, "allowed": 5, "by_risk_tier": { "critical": 14, "high": 3, "clean": 5 }, "by_ai_domain": { "copilot.microsoft.com": 6, "chat.openai.com": 8, "claude.ai": 3, "gemini.google.com": 2, "perplexity.ai": 2, "chatgpt.com": 1 }, "by_category": { "mrn": 5, "controlled_drug": 7, "diagnosis": 7, "dob": 6, "patient_name": 10, "ssn": 2, "credit_card": 2, "npi": 2, "icd10": 3, "doctor_name": 2, "dea": 1, "routing": 1, "phone": 1, "iban": 1 }, "hipaa_controls_exercised": [ { "control": "\u00a7164.502 + \u00a7164.514", "count": 10 }, { "control": "\u00a7164.502 + DEA CSA reporting", "count": 7 }, { "control": "\u00a7164.502 + \u00a7164.508 (sensitive categories)", "count": 7 }, { "control": "\u00a7164.502", "count": 7 }, { "control": "\u00a7164.514 (Safe Harbor de-identification)", "count": 6 }, { "control": "\u00a7164.502 + \u00a7164.530 (Minimum Necessary)", "count": 5 }, { "control": "\u00a7164.502 (Uses and Disclosures of PHI)", "count": 2 }, { "control": "PCI-DSS 3.2 (out of scope for PHI)", "count": 2 }, { "control": "\u00a7164.502 + DEA 21 CFR 1304 (prescriber records)", "count": 1 } ], "nist_ai_rmf_controls": [ { "control": "NIST AI RMF GOVERN 1.1 + MAP 3.4", "count": 17 }, { "control": "NIST AI RMF MEASURE 2.7 (content classification)", "count": 5 }, { "control": "NIST AI RMF GOVERN 1.1 (AI policy), MANAGE 2.1 (risk response)", "count": 2 }, { "control": "NIST AI RMF MANAGE 2.3 (third-party disclosure)", "count": 2 } ], "top_users_by_block_count": [ { "user_id": "nurse1@healthcare.example", "block_count": 3 }, { "user_id": "nurse2@healthcare.example", "block_count": 2 }, { "user_id": "billing1@healthcare.example", "block_count": 1 }, { "user_id": "md1@healthcare.example", "block_count": 1 }, { "user_id": "intake1@healthcare.example", "block_count": 1 }, { "user_id": "analyst1@healthcare.example", "block_count": 1 }, { "user_id": "nurse3@healthcare.example", "block_count": 1 }, { "user_id": "nurse4@healthcare.example", "block_count": 1 }, { "user_id": "md2@healthcare.example", "block_count": 1 }, { "user_id": "nurse5@healthcare.example", "block_count": 1 } ], "top_domains_by_risk": [ { "domain": "copilot.microsoft.com", "cumulative_risk": 450 }, { "domain": "chat.openai.com", "cumulative_risk": 375 }, { "domain": "claude.ai", "cumulative_risk": 100 }, { "domain": "chatgpt.com", "cumulative_risk": 80 }, { "domain": "gemini.google.com", "cumulative_risk": 50 }, { "domain": "perplexity.ai", "cumulative_risk": 30 } ], "event_samples": [ { "event_id": "PE-3B0077755B3C", "timestamp_utc": "2026-04-24T17:27:32.675957+00:00", "user_id": "nurse1@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0001", "source_app": "msedge.exe", "ai_tool_domain": "copilot.microsoft.com", "text_length": 109, "text_hash": "a7f7c9567ed7a5da", "categories": [ "mrn", "controlled_drug", "diagnosis", "dob", "patient_name" ], "risk_score": 110, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (copilot.microsoft.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Pa*****************on MR*******67 DO***********82 prescribed Ox*****ne 10mg for ca**er pain, needs follow-up.", "approved_by": null }, { "event_id": "PE-7BD8FA9DCDA4", "timestamp_utc": "2026-04-24T17:27:32.678890+00:00", "user_id": "nurse2@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0002", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 85, "text_hash": "fd1b588a2cab0864", "categories": [ "ssn", "controlled_drug", "diagnosis", "patient_name" ], "risk_score": 90, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (chat.openai.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "SSN 52*******89 for pa*****************ms, diagnosed with bi***ar disorder, on Xa*ax.", "approved_by": null }, { "event_id": "PE-C1721D3D536C", "timestamp_utc": "2026-04-24T17:27:32.680980+00:00", "user_id": "billing1@healthcare.example", "user_role": "billing", "hostname": "WS-0003", "source_app": "chrome.exe", "ai_tool_domain": "claude.ai", "text_length": 67, "text_hash": "3926fcec829b640c", "categories": [ "credit_card" ], "risk_score": 40, "risk_tier": "critical", "action_taken": "block", "reason": "Cardholder data detected. Blocked under PCI-DSS 3.2 (no card data outside the CDE).", "policy_id": "ORACLE-PCI-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Card on file 41***************11 exp 12/26 for Acme Clinic invoice.", "approved_by": null }, { "event_id": "PE-0F5A5A61D742", "timestamp_utc": "2026-04-24T17:27:32.682919+00:00", "user_id": "md1@healthcare.example", "user_role": "md", "hostname": "WS-0004", "source_app": "msedge.exe", "ai_tool_domain": "copilot.microsoft.com", "text_length": 81, "text_hash": "4241af21352f5ccb", "categories": [ "npi", "icd10", "patient_name", "doctor_name" ], "risk_score": 60, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (copilot.microsoft.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Dr*************on treating pa****************en, NPI 16******22, diagnosis E1*.9.", "approved_by": null }, { "event_id": "PE-C7C73B9E3FC4", "timestamp_utc": "2026-04-24T17:27:32.684892+00:00", "user_id": "intake1@healthcare.example", "user_role": "intake", "hostname": "WS-0005", "source_app": "chrome.exe", "ai_tool_domain": "gemini.google.com", "text_length": 76, "text_hash": "ac2dda1ba5a00f35", "categories": [ "diagnosis", "dob", "patient_name" ], "risk_score": 50, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (gemini.google.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "New pa***************ia chart #9876543, DO**********12, *** positive on ART.", "approved_by": null }, { "event_id": "PE-FD0971316949", "timestamp_utc": "2026-04-24T17:27:32.686679+00:00", "user_id": "analyst1@healthcare.example", "user_role": "analyst", "hostname": "WS-0006", "source_app": "chrome.exe", "ai_tool_domain": "perplexity.ai", "text_length": 87, "text_hash": "18cbf22029cd4a1b", "categories": [ "icd10", "controlled_drug" ], "risk_score": 30, "risk_tier": "high", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (perplexity.ai). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "summarize this medication interaction report for ICD-10 F3*.1 and Fe****yl patch 50mcg.", "approved_by": null }, { "event_id": "PE-01B2128FA918", "timestamp_utc": "2026-04-24T17:27:32.688498+00:00", "user_id": "nurse3@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0007", "source_app": "msedge.exe", "ai_tool_domain": "copilot.microsoft.com", "text_length": 68, "text_hash": "d50c86f73cc73186", "categories": [ "dea", "controlled_drug", "patient_name" ], "risk_score": 60, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (copilot.microsoft.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Pa****************th DEA AB*****67 prescriber, on Ad****ll 20mg BID.", "approved_by": null }, { "event_id": "PE-B5797B8B9403", "timestamp_utc": "2026-04-24T17:27:32.690633+00:00", "user_id": "nurse4@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0008", "source_app": "chrome.exe", "ai_tool_domain": "chatgpt.com", "text_length": 75, "text_hash": "40edd21e6fb146d7", "categories": [ "mrn", "diagnosis", "patient_name" ], "risk_score": 80, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (chatgpt.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Ch****************34 pa*********************ia and su***********se history.", "approved_by": null }, { "event_id": "PE-B5B44B9F3054", "timestamp_utc": "2026-04-24T17:27:32.692573+00:00", "user_id": "contractor1@healthcare.example", "user_role": "external", "hostname": "WS-0009", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 63, "text_hash": "d2e350c9bfb91b7c", "categories": [ "routing", "phone" ], "risk_score": 25, "risk_tier": "high", "action_taken": "warn", "reason": "Risk score 25 exceeds warn threshold (10). Proceed only if the data is not sensitive.", "policy_id": "ORACLE-SCORE-WARN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "ro*************21 acct 98******10 for ACH return from Memorial.", "approved_by": null }, { "event_id": "PE-D4DE4F9C1324", "timestamp_utc": "2026-04-24T17:27:32.694295+00:00", "user_id": "md2@healthcare.example", "user_role": "md", "hostname": "WS-0010", "source_app": "msedge.exe", "ai_tool_domain": "chat.openai.com", "text_length": 81, "text_hash": "6d11ada37c359072", "categories": [ "mrn", "diagnosis", "dob", "patient_name" ], "risk_score": 100, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (chat.openai.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Pa***************is MR*******78 *** positive pr*****cy 14 weeks, DO***********92.", "approved_by": null }, { "event_id": "PE-E2A2199AD413", "timestamp_utc": "2026-04-24T17:27:32.696090+00:00", "user_id": "nurse1@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0001", "source_app": "msedge.exe", "ai_tool_domain": "copilot.microsoft.com", "text_length": 64, "text_hash": "345e1de50a47696d", "categories": [ "mrn", "controlled_drug", "diagnosis", "patient_name" ], "risk_score": 100, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (copilot.microsoft.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Pa****************er MR*******89 ov****se Fe****yl su***de risk.", "approved_by": null }, { "event_id": "PE-DCC62EAD31FA", "timestamp_utc": "2026-04-24T17:27:32.698141+00:00", "user_id": "nurse2@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0002", "source_app": "chrome.exe", "ai_tool_domain": "claude.ai", "text_length": 56, "text_hash": "173a79d6f949eb6a", "categories": [ "credit_card" ], "risk_score": 40, "risk_tier": "critical", "action_taken": "block", "reason": "Cardholder data detected. Blocked under PCI-DSS 3.2 (no card data outside the CDE).", "policy_id": "ORACLE-PCI-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Credit card 54***************03 for copay Mrs. Thompson.", "approved_by": null }, { "event_id": "PE-087DCC0DD34D", "timestamp_utc": "2026-04-24T17:27:32.700079+00:00", "user_id": "staff1@healthcare.example", "user_role": "staff", "hostname": "WS-0011", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 57, "text_hash": "dfcaf0dc687a6103", "categories": [], "risk_score": 0, "risk_tier": "clean", "action_taken": "allow", "reason": "No sensitive data detected. Allowed.", "policy_id": "ORACLE-CLEAN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "write a polite voicemail template for missed appointments", "approved_by": null }, { "event_id": "PE-997FC4BC6AA3", "timestamp_utc": "2026-04-24T17:27:32.701355+00:00", "user_id": "staff1@healthcare.example", "user_role": "staff", "hostname": "WS-0011", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 55, "text_hash": "642046687a534ac4", "categories": [], "risk_score": 0, "risk_tier": "clean", "action_taken": "allow", "reason": "No sensitive data detected. Allowed.", "policy_id": "ORACLE-CLEAN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "draft an internal email about the new onboarding portal", "approved_by": null }, { "event_id": "PE-5028CE6AD3AD", "timestamp_utc": "2026-04-24T17:27:32.702625+00:00", "user_id": "nurse5@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0012", "source_app": "msedge.exe", "ai_tool_domain": "copilot.microsoft.com", "text_length": 77, "text_hash": "7190c59b82ca4aa4", "categories": [ "diagnosis", "dob", "patient_name" ], "risk_score": 60, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (copilot.microsoft.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Pa****************as al******sm and de******on chart #1234567 DO**********22.", "approved_by": null }, { "event_id": "PE-49027EA7AB1C", "timestamp_utc": "2026-04-24T17:27:32.703826+00:00", "user_id": "analyst2@healthcare.example", "user_role": "analyst", "hostname": "WS-0013", "source_app": "chrome.exe", "ai_tool_domain": "gemini.google.com", "text_length": 48, "text_hash": "5a1424ca08dc37a8", "categories": [], "risk_score": 0, "risk_tier": "clean", "action_taken": "allow", "reason": "No sensitive data detected. Allowed.", "policy_id": "ORACLE-CLEAN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "help me visualize chart trends from last quarter", "approved_by": null }, { "event_id": "PE-CB8D9F10E69F", "timestamp_utc": "2026-04-24T17:27:32.705202+00:00", "user_id": "md3@healthcare.example", "user_role": "md", "hostname": "WS-0014", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 82, "text_hash": "c497ea04f42b0ffa", "categories": [ "npi", "icd10", "controlled_drug", "doctor_name" ], "risk_score": 60, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (chat.openai.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Dr**************ms NPI 16******22 treating Lo*****am dependence, diagnosis F1**20.", "approved_by": null }, { "event_id": "PE-790978E62601", "timestamp_utc": "2026-04-24T17:27:32.706447+00:00", "user_id": "support1@healthcare.example", "user_role": "support", "hostname": "WS-0015", "source_app": "chrome.exe", "ai_tool_domain": "perplexity.ai", "text_length": 55, "text_hash": "f1ede2846ee8af73", "categories": [], "risk_score": 0, "risk_tier": "clean", "action_taken": "allow", "reason": "No sensitive data detected. Allowed.", "policy_id": "ORACLE-CLEAN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "what is the HCPCS level II code for CGM device supplies", "approved_by": null }, { "event_id": "PE-23C50006FC54", "timestamp_utc": "2026-04-24T17:27:32.708662+00:00", "user_id": "contractor2@healthcare.example", "user_role": "external", "hostname": "WS-0016", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 70, "text_hash": "140daceff7a3f16c", "categories": [ "ssn", "mrn", "dob" ], "risk_score": 100, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (chat.openai.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Patient SSN 12*******89 MR*******43 DO***********65 diagnosis COPD+MI.", "approved_by": null }, { "event_id": "PE-5757C5AD3071", "timestamp_utc": "2026-04-24T17:27:32.710565+00:00", "user_id": "nurse1@healthcare.example", "user_role": "care-navigator", "hostname": "WS-0001", "source_app": "msedge.exe", "ai_tool_domain": "copilot.microsoft.com", "text_length": 70, "text_hash": "0f7f3d95be726bd5", "categories": [ "controlled_drug", "dob", "patient_name" ], "risk_score": 60, "risk_tier": "critical", "action_taken": "block", "reason": "PHI detected in paste to consumer AI endpoint (copilot.microsoft.com). Blocked under HIPAA Security Rule 45 CFR 164.308.", "policy_id": "ORACLE-PHI-CONSUMER-BLOCK", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "Pa***************es prescribed Am**en 10mg for sleep, DO***********88.", "approved_by": null }, { "event_id": "PE-CA100B29DA64", "timestamp_utc": "2026-04-24T17:27:32.712170+00:00", "user_id": "billing2@healthcare.example", "user_role": "billing", "hostname": "WS-0017", "source_app": "chrome.exe", "ai_tool_domain": "claude.ai", "text_length": 63, "text_hash": "0df008d9d69b51b8", "categories": [ "iban" ], "risk_score": 20, "risk_tier": "high", "action_taken": "warn", "reason": "Risk score 20 exceeds warn threshold (10). Proceed only if the data is not sensitive.", "policy_id": "ORACLE-SCORE-WARN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "IBAN DE******************00 for international wire to provider.", "approved_by": null }, { "event_id": "PE-A9D7BED9B736", "timestamp_utc": "2026-04-24T17:27:32.713680+00:00", "user_id": "staff2@healthcare.example", "user_role": "staff", "hostname": "WS-0018", "source_app": "chrome.exe", "ai_tool_domain": "chat.openai.com", "text_length": 67, "text_hash": "dfa7b06096f90cc8", "categories": [], "risk_score": 0, "risk_tier": "clean", "action_taken": "allow", "reason": "No sensitive data detected. Allowed.", "policy_id": "ORACLE-CLEAN", "client_type": "browser_extension", "client_version": "1.0.0", "redacted_preview": "summarize the CMS 2026 interoperability final rule in plain English", "approved_by": null } ] }