HIMSSCast

The episode delivers solid, concrete insights about shadow AI risks in healthcare and non-human identity management that a healthcare leader would find useful, including the triple threat framework (compliance, security, patient safety) and the discovery-govern-protect model. However, much of the content is built around Sailpoint's product positioning rather than independent analysis, and several points are stated but not deeply explored (e.g., the actual mechanics of how AI agents create secondary risks).

“Putting patient data into public AI tools is a direct HIPAA violation. Once the data is fed into a consumer LLM like ChatGPT and others, it can be used to train future public models, making the patient privacy impossible to bring back or get control of.”

“AI agents are similar to traditional human identity as they are granted access to data and systems to complete a task... What makes them different is that AI agents also have inbound access.”

The framing of shadow AI as 'shadow IT on steroids' and the distinction between outbound and inbound access for AI agents shows some freshness, but the core thesis - that unmanaged tools and identities create compliance risk - is familiar ground. The tiered risk framework and discovery-govern-protect model are sensible but not particularly novel or counterintuitive.

“Shadow AI is just like a modern hyper accelerated version of shadow it.”

“You cannot treat a patient facing triage bot the same way you treat an internal cafeteria scheduling assistant.”

Jamin Patel is identified as an 'identity strategist at Sailpoint,' which suggests product expertise rather than independent practitioner or operator experience. While the guest demonstrates knowledge of identity and access management frameworks, there is no evidence of hands-on operational leadership at a healthcare organization or direct experience managing the problems being discussed at scale outside a vendor context.

“I'm Marianne Bohr. With HIMS today I'm joined by Jamin Patel, identity strategist at Sailpoint”

“I always say this, if you cannot see it, you cannot govern it.”

The episode cites several statistics (81% of employees using unapproved tools, 75% sharing sensitive data, 57% hiding it, 80% of agents taking unintended actions) but provides minimal concrete examples of real incidents, company names, or quantified outcomes. The Hugging Face breach is mentioned briefly but not detailed. Most recommendations remain at the framework level without specific implementation metrics or case studies.

“As you mentioned, 81% of employees say they use unapproved AI tools.”

“If a developer spins up a shadow agent in AWS or connects a third party AI tool to Microsoft 365 standard tools won't even register it.”

The host asks relevant, structured questions that move the conversation forward logically, but rarely pushes back, challenges claims, or probes deeper into contradictions or limitations. Questions are largely open-ended invitations for the guest to explain Sailpoint's approach. There is no genuine disagreement, skepticism, or follow-up that tests the guest's assertions.

“Can you tell us what is shadow AI and why are the numbers like 81% of employees using unapproved tools?”

“Can you walk us through Sailpoint's discover and govern strategy?”