A service account scoped for eligibility checks starts reading clinical notes at 2 a.m. The permission was real. You granted it last quarter to ship a payer integration. Nothing broke. That is the move that ends in a disclosure letter, and your stack let it through because it was supposed to.
Digital health runs on PHI in motion. You sign a payer and member records flow to a new pipeline. You onboard a clinic and claims data crosses to a clearinghouse. You stand up a cohort study and a notebook pulls from a PHI table. Each move is one you granted on purpose, because the product does not work otherwise. So the security question is not how to stop PHI from moving. It is how to see it move, in time to act, without adding one more thing that reads it.
The permitted move is the one nobody watches
You do not get breached because someone broke a permission. You get exposed because a permission worked exactly as designed, on a move nobody scored.
Walk through a normal week. An integration engineer grants a vendor service account read access to a PHI table. Correct. A data scientist pulls member records into a notebook for a cohort study. Approved. A contractor exports a slice of claims data to validate a field mapping. Reasonable. Every one is a legitimate identity, through a sanctioned channel, doing a sanctioned job.
Now run the same actors forward. The eligibility service account drifts into clinical notes. The cohort export that should be a few thousand rows becomes a few hundred thousand, at 1 a.m., to a bucket nobody recognizes. The contractor's validation pull repeats nightly for two weeks after the contract ended. No single action trips a rule. Every move is permitted. The pattern is the breach.
This is why a passed HIPAA audit and a defended data estate are different claims. Your Business Associate Agreements, access reviews, and audit logs prove a move was allowed. None of them was built to tell you an allowed move was wrong.
The early-stage stack measures the wrong thing
The tools a digital health team buys first are good. They answer a different question than this one.
CSPM tells you a bucket is public or a database is exposed. Worth having. It describes the door, not who walked through it or what they carried out. Your IdP governs who can touch what. Also worth having. It grants the permission; it goes quiet the moment the permission is used. Your warehouse query logs and app audit trails capture what happened inside one system, after the export already left, and they cannot follow the move across the vendor handoff or the pipeline boundary.
DLP sits at the other end and guesses in advance which moves are dangerous, then writes rules to block them. For a health startup that is the worst fit on the board. The rules go stale the week you ship a new integration. They fire on legitimate clinical work, so the team learns to route around them. And the permitted move, the one that matters, sails through untouched, because by definition it was permitted.
So you own tools that check whether each move was allowed and tools that report what already happened. The pattern across permitted moves, while it forms, falls in the gap between them.
See the move without reading the data
Runtime data movement governance lives in that gap. Hilt deploys one lightweight collector that watches data movement at the kernel, metadata only by default. It reads the shape of a move, not the contents of a record, which is the whole point for a HIPAA team: the layer that governs your PHI never becomes a new place your PHI sits. Content-aware inspection is there when you want it. Most teams get their value without ever turning it on.
The collector runs off the path. It observes movement from beside the flow, never inline, so it does not block, drop, or alter your traffic. It costs roughly 0.1% of one core and 4 to 8 MB of memory per host. When the same engineers own the product and the infrastructure, that number decides whether the thing ships at all.
Every move resolves to a probabilistic, source-dependent identity: which workload or user, which job behind it, which destination, and whether this fits how that identity normally moves. The export that jumps two orders of magnitude, the eligibility account reaching into clinical notes, the contractor pull that outlives its contract, each shows up as a deviation across several layers at once. One signal is noise. The convergence is a case, not an alert.
And it stays put. The collector is single-tenant inside your own cloud: AWS, GCP, Azure, or Ali Cloud. Events never leave your account. The trust story you sell to payers and clinics is that PHI stays where it belongs, so the layer watching the PHI obeys the same rule.
Why this fits a startup and not a hospital
A hospital's PHI flows are slow and mapped. Yours are redrawn every sprint. You add a payer, a model pipeline, a partner API, and where your most sensitive data can travel changes before the last access review dries.
A control built on a static list of allowed paths cannot track that. It decays into friction or into theater. A behavioral baseline tracks it, and sharpens as it watches how your data actually moves. Sign a payer and traffic to their endpoint settles into normal. That same payer's service account reaching into a table it never touched stands out against the baseline it just helped build.
When a move is dangerous, Hilt writes the case and responds with host-level network isolation, quarantine, from the control plane. It contains the host at the network. The data plane keeps shipping.
Keep your stack. Close the gap.
Runtime data movement governance adds to what you run; it replaces none of it. CSPM still finds the exposed bucket. Your IdP still grants access. Your BAAs and logs still satisfy the auditor. Keep all of it.
What none of them was built to do is watch the pattern of permitted PHI movement at runtime, resolved to the identity and the job behind it, while it is still happening. For a health company moving fast, that is the gap that becomes the disclosure letter.
Ask yourself one question: what did this service account's data actually do last night, resolved to the job behind it and scored against how it normally moves? If you cannot answer it, you have the blind spot. Put an engineer from your team on a 30-minute technical call and we will walk through how the collector sees it.