--- title: Your Staff Is Already Using AI. Now What? description: Your staff is already using AI. Five Nines Technology Group shows healthcare and banking leaders how to turn shadow AI into sanctioned AI. Start here. image: https://blog.fivenines.com/hubfs/Blog%20banner%20A%20Ban%20Isnt%20a%20Policy@1x%20(1).png --- [Skip to the main content.](https://blog.fivenines.com/your-staff-is-already-using-ai.-now-what#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # Your Staff Is Already Using AI. Now What? [Five Nines Team](https://blog.fivenines.com/author/five-nines) : Oct 19, 2026, 6:00:00 AM 6 min read [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Compliance](https://blog.fivenines.com/topic/compliance) [Finance](https://blog.fivenines.com/topic/finance) ![Your Staff Is Already Using AI. Now What?](https://blog.fivenines.com/hubfs/Blog%20banner%20A%20Ban%20Isnt%20a%20Policy@1x%20(1).png) *Key Value Points* - **Shadow AI is a direction problem.** People reach for unapproved tools when nobody has named approved ones. - **A ban moves the risk out of sight.** Blanket prohibitions push AI use onto personal phones and personal accounts, where nobody can see it. - **The exposure is already regulated.** Patient information falls under HIPAA and customer financial information falls under GLBA, no matter which chatbot it lands in. - **Direction is a short list of decisions.** Approved tools, banned tools, data rules, and training cover most of the risk. If your staff is already using AI, the right move is direction, not a ban. Decide which tools are approved, which are off limits, and what information can never go into any of them. Then train people on all three. Most organizations skip those decisions, and the AI use happens anyway. At the front desk, a scheduler pastes a patient's portal message into a free chatbot to draft a kinder reply. In the billing office, someone uploads a denial report and asks for a summary. Across town at a community bank, a loan officer asks a chatbot to tighten up a credit memo before lunch. None of them think they're breaking a rule. Most of them are trying to get through a full day with a short staff. ***Your staff didn't go around your AI policy. There wasn't one to go around.*** The numbers say this is already normal. In a December 2025 survey of 518 healthcare professionals, conducted by CITE Research for [Wolters Kluwer Health](https://www.wolterskluwer.com/en/news/wolters-kluwer-survey-finds-broad-presence-of-unsanctioned-ai-tools-in-hospitals-and-health-systems), 40% had encountered unauthorized AI tools at work and nearly 20% admitted using them. One in 10 had used one for a direct patient care task.   ## How Many Employees Are Using AI Without Approval? > **Short answer:** The [Work Trend Index](https://blogs.microsoft.com/blog/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/) from Microsoft and LinkedIn put the gap plainly. Three out of four knowledge workers use AI, most of them on tools their employer never provided, and only 39% of AI users have received any AI training from their company. Healthcare is not running behind that curve. The Wolters Kluwer Health survey found more than half of healthcare professionals use AI tools often or rely on them for their work. Half of respondents said they reached for unauthorized tools because they needed faster workflows. That last finding matters most. People aren't using AI to cause trouble. They're using it because the work is heavy and nobody handed them a better option.   ## Why Is Shadow AI Risky for Healthcare and Financial Organizations? > **Short answer:** Shadow AI sends regulated data to vendors your organization never vetted. A free chatbot account runs on terms nobody at your organization reviewed, with no business associate agreement in place for patient information. Five Nines sees the risk in three places: where the data goes, whether the output is right, and whether anyone can prove what happened. The first risk is the data itself. When a staff member pastes a patient message, a claim, or a loan file into a personal AI account, that information now lives with a vendor your organization has no agreement with. For patient information, HIPAA generally expects a business associate agreement with any vendor that handles it on your behalf.  The second risk is accuracy. Patient safety ranked as the top AI concern for both providers (25%) and administrators (26%) in the Wolters Kluwer Health survey, and providers ranked inaccurate outputs second. A confident wrong answer in a discharge note or a member letter is still wrong. The third risk is proof. If an auditor, an insurer, or an OCR investigator asks what happened to a record, "someone may have used a chatbot" is not an answer anyone wants to give. > ### The Hidden Risk > > The data leak in shadow AI rarely looks like a breach. It looks like a helpful employee finishing a task early. There is no AI-specific mandate forcing your hand today for most clinics and community banks. You don't need one. HIPAA and GLBA already govern the information your staff is typing.   ## Should You Ban AI Tools at Work? > **Short answer:** A blanket ban rarely stops AI use. It moves the use onto personal phones and personal accounts, where IT has no visibility at all. Five Nines recommends banning specific tools and specific data, then approving a short list of tools people can use with confidence. Most leaders think a ban is the safe choice. It is not. It is the invisible choice. The pressure that drove people to AI in the first place doesn't go away when a memo goes out. The scheduler still has a full inbox of portal messages to answer. The work just moves to a device you don't manage, under an account you can't see. The better move is narrower and more useful: name the tools that are off limits, name the data that never goes into any AI tool, and name the tools people can use. A clear yes does more to shrink shadow AI than a vague no. > ### What Leadership Misses > > The employee using AI without permission is often your most motivated person. Treat them as your pilot group, not your problem.   ## What Should an AI Acceptable Use Policy Cover? > **Short answer:** An AI acceptable use policy should name approved tools, banned tools, data that can never be entered, when a human must review output, and how staff request a new tool. Five Nines keeps the first version short enough to read in one sitting, because a policy nobody reads protects nobody. The first version doesn't need to be long. It needs to answer the questions your staff is already asking themselves. 1. **Approved tools.** Which AI tools staff can use, under which accounts, for which kinds of work. 2. **Banned tools.** Which tools are off limits, and why, in one sentence each. 3. **Data that never goes in.** Patient information, account numbers, Social Security numbers, passwords, and anything marked confidential. 4. **Human review.** Which outputs need a person to check them before they reach a patient, a member, or a regulator. 5. **Disclosure.** When staff should say AI helped draft something. 6. **New tool requests.** Who to ask, and how fast they'll hear back. 7. **Review cadence.** When the policy and the tool list get updated, because the tools change every quarter. Policy alone is half the work. Training is the other half, because people follow rules they understand and route around rules they don't.   ## Where Is Your Organization on the Shadow-to-Sanctioned Model? > **Short answer:** The Five Nines Shadow-to-Sanctioned Model sorts organizations into four stages of AI use: Unseen, Banned, Directed, and Governed. Most mid-sized clinics and community banks sit in the first two. Moving to Directed takes a policy, a tool list, and training, not a new software platform. **The Five Nines Shadow-to-Sanctioned Model** | Stage | What it looks like on the floor | The risk | What moves you up | | --- | --- | --- | --- | | 1. Unseen | No policy. Staff use whatever AI they find. Leadership assumes nobody does. | Regulated data in unknown tools, with no record of it | Ask staff what they use, without penalty | | 2. Banned | A memo says "no AI." Use continues on personal phones. | Same exposure, now hidden | Replace the blanket ban with named tools and data rules | | 3. Directed | Approved and banned tool lists exist. Staff signed an acceptable use policy and got trained. | Policy drifts as tools change | Put training and policy updates on a schedule | | 4. Governed | New hires get trained. Refreshers run on a schedule. The tool list changes when vendors or risks change. | Lowest, and visible when it rises | Keep reviewing as new tools arrive |   ![Graphic 1 Shadow-to-Sanctioned Model@1x (1)](https://blog.fivenines.com/hs-fs/hubfs/Graphic%201%20Shadow-to-Sanctioned%20Model@1x%20(1).png?width=1200&height=1300&name=Graphic%201%20Shadow-to-Sanctioned%20Model@1x%20(1).png) The jump that matters most is Stage 2 to Stage 3. That's where AI use stops hiding and starts being managed.   ## What Does This Look Like in a Community Bank or Credit Union? > **Short answer:** In a community bank or credit union, shadow AI shows up in credit memos, member letters, and spreadsheet summaries. The data at risk is nonpublic personal information covered by GLBA. Five Nines applies the same four stages, with the data rules written around account numbers, credit files, and member records. The front desk becomes the teller line, and the patient message becomes a member complaint. The pattern is identical. A lender pastes a borrower's financials into a free tool to draft a summary, and that file now sits outside the bank's vendor management program. Banks already run third-party risk reviews for every core processor and every software vendor. A free AI account a staff member opened on a Tuesday afternoon never went through that review. ## What Does Five Nines Look for When AI Use Comes Up? > **Short answer:** When AI use comes up with a partner, Five Nines looks first at where AI already lives in the environment, not just at the chatbots staff open in a browser. AI features now ship inside email, meeting, and document tools organizations already pay for, and those often get switched on before anyone writes a rule. - **AI already built into tools you own.** Email, meeting, and document platforms now include AI features that can be enabled without a separate purchase. - **Meeting note-takers joining calls.** Transcription bots attached to a staff member's calendar can record conversations that include patient or member details. - **Browser extensions with AI features.** Writing and summarizing add-ons can read what's on the screen. - **Personal accounts on work devices.** Free AI accounts tied to personal email, outside any company sign-in. - **A policy that exists only in a handbook.** A sentence about AI that nobody has been trained on, and nobody has signed.   ## What Questions Should You Ask Before Approving an AI Tool? > **Short answer:** Before approving an AI tool, ask where your data goes, whether the vendor keeps or trains on it, whether it will sign a business associate agreement, and who can see the activity. Five Nines recommends getting written answers to each before a tool reaches the approved list. 1. Where does the data we enter go, and where is it stored? 2. Does the vendor keep our inputs, or use them to train its models? Can we turn that off? 3. Will the vendor sign a business associate agreement for patient information? 4. Can staff sign in with company accounts, so we can remove access when someone leaves? 5. Can we see who used the tool, and for what? 6. What happens to our data if we stop paying for the tool?   ## Do You Know Which AI Tools Your Team Used This Week? If you can't answer that question, you're in good company, and you're carrying risk you can't see. A Five Nines AI use conversation identifies:  - Which AI tools your staff is already using, and on which accounts - Where patient or customer information is most likely to end up in an AI tool - Which AI features are already switched on inside tools you pay for - What your current policy covers, and what it leaves out - Which tools belong on your approved list and which belong on your banned list You leave with a clear picture of where your organization sits on the Shadow-to-Sanctioned Model, and the next decisions that move it up a stage.   *Your staff already made their choice about AI. The only open question is whether you make yours.*   ![Graphic 2 Shadow vs Approved Path@1x (1)](https://blog.fivenines.com/hs-fs/hubfs/Graphic%202%20Shadow%20vs%20Approved%20Path@1x%20(1).png?width=1200&height=1180&name=Graphic%202%20Shadow%20vs%20Approved%20Path@1x%20(1).png)   ## Frequently Asked Questions What is shadow AI? Shadow AI is any AI tool employees use for work without their organization's approval or knowledge. Common examples are free chatbot accounts, AI browser extensions, and meeting transcription bots. In healthcare and banking, the main concern is regulated data reaching vendors the organization never vetted. Is it a HIPAA violation for staff to put patient information into ChatGPT? It can be. Entering protected health information into an AI tool whose vendor has no business associate agreement with your organization may be an impermissible disclosure under HIPAA. Whether a specific incident is a violation depends on the facts, so bring in your privacy officer or counsel. Should we just ban AI at work? A blanket ban usually pushes AI use onto personal devices where nobody can see it. Five Nines Technology Group recommends banning specific tools and specific types of data, approving a short list of tools, and training staff on both. That shrinks the risk instead of hiding it. Does a small clinic or community bank need an AI policy? Yes, if staff handle patient or customer information and have internet access. Size doesn't reduce exposure. A short acceptable use policy, an approved and banned tool list, and one training session cover most of the risk for a smaller organization. Can Five Nines help us put AI guardrails in place? Five Nines helps organizations train leadership and staff on AI use, adopt an acceptable use policy, and publish approved and banned tool lists that get updated as tools and risks change. Five Nines does not provide legal advice or review vendor contracts, so your counsel stays involved. ## Related Blog Posts ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKARH0pPr5dpnvtM34cqwk3so4P22ReGZwGW6mOkGVk0sTtVMGVhbEPgc6JWbBgaclM6itNAmKbOncrq3m6tiOc%2BlC9tDmNxsKnjWXO7NurbPBYxFtaMF5nLR9%2Btx6Yqzk2eMri7BnrobsFVuHZqje5ZTRNwrNFn9LCl0TSVrP1roNaeVegSXUybaLQ3beDYOmTQw%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Shadow AI is any AI tool employees use for work without their organization's approval or knowledge. Common examples are free chatbot accounts, AI browser extensions, and meeting transcription bots. In healthcare and banking, the main concern is regulated data reaching vendors the organization never vetted." }, "name" : "What is shadow AI?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It can be. Entering protected health information into an AI tool whose vendor has no business associate agreement with your organization may be an impermissible disclosure under HIPAA. Whether a specific incident is a violation depends on the facts, so bring in your privacy officer or counsel." }, "name" : "Is it a HIPAA violation for staff to put patient information into ChatGPT?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A blanket ban usually pushes AI use onto personal devices where nobody can see it. Five Nines Technology Group recommends banning specific tools and specific types of data, approving a short list of tools, and training staff on both. That shrinks the risk instead of hiding it." }, "name" : "Should we just ban AI at work?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, if staff handle patient or customer information and have internet access. Size doesn't reduce exposure. A short acceptable use policy, an approved and banned tool list, and one training session cover most of the risk for a smaller organization." }, "name" : "Does a small clinic or community bank need an AI policy?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Five Nines helps organizations train leadership and staff on AI use, adopt an acceptable use policy, and publish approved and banned tool lists that get updated as tools and risks change. Five Nines does not provide legal advice or review vendor contracts, so your counsel stays involved." }, "name" : "Can Five Nines help us put AI guardrails in place?" } ] } ```