A nurse needs a prior authorization approved so a procedure stays on schedule. The payer’s portal wants account credentials she set up last year and forgot. The “approved” upload is an IT ticket. Data loss prevention quarantines the send; now the case is stuck in a security queue.
So she uses Outlook to email the details… Of course she does.
Not because she forgot the policy, but because every control in her path manages risk instead of removing it. And behind the paperwork, a patient is counting days to a procedure.
This is not an email story
The same scene runs in SharePoint, OneDrive and the SFTP drop zone a bank has used since the Clinton administration, anywhere an industry layers around a core weakness instead of fixing it. Every layer adds a console. Every console adds friction. Friction pushes people to the workaround. The workaround becomes the breach. And the breach becomes the business case for the next layer.
Thirty years of sediment
SFTP is pushing thirty, still moving a staggering share of the world’s regulated files, its weakness never a secret. A static credential: guessable, phishable, reusable. Verizon’s 2026 report finally saw exploits overtake stolen credentials, but the exploit is only the foothold. Attackers harvest the standing secrets inside: SSH keys, service passwords, API tokens. Then they walk in the front door.
Across the full attack chain, credential abuse still figures in 39% of breaches and CrowdStrike’s 2025 Global Threat Report found 79% of detections malware-free; intrusions increasingly rely on valid credentials and hands-on-keyboard activity, not malware. The way in changed. What decides the blast radius didn’t.
The response? Layers: allowlists, firewalls, lockout counters. Never MFA, hardware-bound keys, or credentials that expire. And 64% of secrets leaked in 2022 were still valid in 2026. The stolen key doesn’t die on its own.
The inbox became the filing cabinet
Email is the same disease in a different organ. Healthcare still runs on it (170 email breaches in 2025, per HHS data) because it’s already open, already has the address and already works when the prior auth must move now.
The core weakness: regulated data takes up residence in systems built to read it. A mail server must read mail; search, preview, backup, e-discovery depend on it. TLS and a locked disk make a filing cabinet with a nice latch. And the layers (transport encryption, blocking DLP, portals nobody wants, alert floods) never answer what matters: can the other side still get the packet, and can the PHI stop living in a mail store?
The newest layer bills by the token
Then the industry discovered generative AI and decided detection was a prompt.
A decent detection stack already knows the easy 80 percent deterministically: member IDs, MRNs, diagnosis-shaped text. A model earns its keep only on the mushy 20 percent, where the score is ambiguous. What’s sold instead: send everything to the model, metered, in a pipeline you don’t control. You moved PHI into a model to decide whether it was PHI, and called it innovation.
SFTP’s weak passwords got a firewall instead of MFA; now the firewall can get an LLM. Nobody ever fixed the password. A model on an unfixed architecture just watches the leak with better vocabulary, and bills you for watching.
The fix that was available the whole time
The answer was never another layer or more friction. Let the message flow and remove the protected content. Encrypt it at the application layer and leave a link, one that opens for the person it was meant for, then expires. No new account, no portal password, nothing left behind to steal a year from now.
The safe path must finish the job. The nurse isn’t sending a file, she’s completing a process: reviewer, approval, signature, record. A link that stops at the hand-off covers one step; people do the rest in email, and the PHI follows. One path, one pane; the whole job faster inside than out.
The liability moves. The business does not.
Cryptography’s founding move was to assume the attacker already had the key, and build so it didn’t matter. Thirty years of layering assumed they never would. Only one of those has aged well.
Give the nurse a path faster than Outlook that finishes the job, and she’ll take it every time. The message arrives. Nothing takes up residence anywhere, waiting to become next year’s breach notification. The procedure stays on schedule.
