None of the healthcare breaches disclosed this summer were AI attacks. No one has reported a rogue agent inside McKesson, CareCloud or AdaptHealth. The attackers used phone calls, stolen sessions, vendor credentials and forgotten servers.

That is exactly why these breaches matter. The attackers got into the same systems healthcare organizations are now connecting AI agents to: EHR portals, patient management platforms, billing APIs, document stores, and SaaS suites behind a single sign-on. If you replay any of these incidents with an agent in the loop, the type of outcome stays the same. What changes is how fast it happens, how far it reaches, and how hard it is to prove what happened.

Here's what six recent incidents tell us, and what to put in place before your agents go live.

Pattern 1: Trusted access is the attack surface

McKesson disclosed in late August that attackers accessed certain third-party applications and took data tied to customers in two of its business units. The extortion group behind the attack claims roughly 284 million rows of data, and the set it published contains 6.4 million unique email addresses. On September 8, Veradigm disclosed that an attacker had used credentials taken from a vendor's environment to reach a customer-service API and copy patient data. AdaptHealth confirmed that an intrusion, which began with a compromised contractor session in June, reached patient management systems, document storage and EHR portals. It exposed data on 4.1 million people.

The attackers didn't need to break a single control in any of these cases. Each one used access the organization already trusted.

Operationally, an AI agent is a credential with a job. It holds tokens, calls APIs and reads records on someone's behalf. When an attacker steals that credential, they get more than a login. They get an identity that is expected to query at volume, never gets tired, and doesn't look suspicious when it's active at 3 a.m. A search that would take a human intruder weeks of manual querying becomes bulk enumeration in minutes.

Pattern 2: A convincing voice is not proof of identity

Abbott confirmed that the intrusion into legacy Exact Sciences systems started with vishing: someone called the company and talked their way into access. The data the attackers later published included 10.9 million unique email addresses along with health information.

AI voice synthesis makes this kind of call cheaper to run and more convincing. Pair it with an agent that holds legitimate credentials, and the phishing step and the data access step merge into one automated chain. Authentication succeeds, and nobody checks whether the behavior that follows makes sense.

Pattern 3: Scope arrives months after the breach

CareCloud's attackers were inside one of its AWS environments from March 10 to March 16. The confirmed scope, more than 3.75 million individuals, didn't reach HHS until August. Gaps like that are normal in breach investigations, and agents make them worse. When an agent calls APIs through an over-privileged service account, nobody maps the blast radius ahead of time. The agent executes it, and the organization only understands the scope afterward.

Pattern 4: Legacy is still reachable

The Brown Health Medical Group-MA breach hit a historic file server, not the EHR. It affected 311,760 people, and investigators said it was hard to determine exactly which records had been accessed.

Agents ignore your architecture diagrams. If you build an agent to answer questions from "all our documents," it will index the file share nobody has touched in years. If an agent can reach a system, it can read it.

Pattern 5: PHI doesn't expire

A bank can reissue a card number. Nobody can reissue a diagnosis, a prescription or an insurance ID. A customer list from a home medical equipment supplier is effectively a list of conditions. When attackers can access data at machine speed, a one-time theft becomes a dataset they can keep refreshing, and insurance fraud and medical identity theft scale along with it.

What actually changes when AI is in the loop

Three things change: breaches get faster, wider, and harder to prove.

The last one is where healthcare feels it most. HIPAA gives you 60 days from discovery to work out what was accessed and notify the people affected. If you can't tie every access to an identity, an action and a policy decision, your team ends up reconstructing an agent's afternoon from partial logs while the notification deadline gets closer.

Five controls to put in place before agents touch PHI

1. Give every agent a verifiable identity, not just a credential. Bind each session to a known agent identity so that a stolen token can't start a session on its own. Hold vendor and contractor agents to the same standard as your own.
2. Declare scope before you connect. The minimum necessary standard applies to agents too. For each use case, write down the resources, data classes and volumes it needs, and enforce those limits at runtime. That includes file shares, archives and backups, not just the EHR.
3. Baseline behavior, not just logins. Watch the sequence of actions, not only the individual events. Some patterns should always raise a flag: a help desk password reset followed by bulk record pulls, a billing agent querying clinical notes, or retrieval volume climbing past what the use case needs.
4. Make stolen data worthless. Tokenize PHI in the environments where agents work, so that anything exfiltrated is inert. Some records will still be sensitive in 20 years, so plan now for post-quantum encryption such as NIST's FIPS 203 standard.
5. Make it stoppable and provable. Out-of-scope sessions should end the moment they go out of scope, not at the next monthly review. Every access should leave an audit trail that ties it to an identity, an action and a policy decision. When the regulator asks, that trail is your answer.

The bottom line

The breach wasn't the AI. The AI is what makes the next one faster, wider and harder to prove, unless every agent is identified, scoped, monitored and stoppable at runtime.