A billing coordinator on a telehealth platform reads a clinical note. Her role has never touched a clinical note. The query is authorized. The session is encrypted. MFA passed three hours ago. Every control on that platform says yes, because every control was built to ask one question: are you allowed to be here? She is. The credentials are hers. They were stuffed in from a breach dump two weeks ago, and nothing on the stack knows the difference.
Encryption protects PHI from people who have no access. It does nothing about people who do. By the time a record is read, exported, or copied, it is already decrypted in application memory, and the work the encryption was supposed to guard is done. The access was granted. The data moved. The audit log recorded all of it and flagged none of it.
This is not a healthcare problem. It is the blind spot under every company moving valuable data across cloud, SaaS, and user endpoints. The most sensitive thing you hold leaves on access you handed out on purpose. No single move looks wrong because no single move is wrong. The breach is the shape of the moves together, and the shape only exists while the data is moving.
Your controls describe the outcome, not the move
Authentication validates a credential. An API gateway counts requests. A database logs a query. TLS scrambles the wire. Every one of these reads the result after the act.
Copy a thousand patient records to removable media and the application reports "user authenticated, query authorized, export successful." The network reports "encrypted traffic to a company-issued device." The database reports "query returned results, 02:14." Three clean log lines. Zero of them know this account normally reads a few dozen records a shift, that exports of this type run by day from a different role, or that a late-night query and a device mount sixty seconds later are the same story.
That story is the data movement. Your stack threw it away and kept the summary.
Watch the move, learn what normal is
Hilt is runtime Data Movement Governance. One lightweight collector watches data movement at the kernel, metadata only by default, off the path, single-tenant in your own cloud. It costs roughly 0.1% of one core and 4 to 8 MB of memory, and it never sits inline. Content inspection is there when a case warrants it, but the default reads how data moves, not what is inside it, so governing PHI movement does not require reading anyone's PHI.
From the kernel the collector sees the move as it happens, before an application log rounds it off. That is where normal gets defined, per user, per role, per workload.
A cardiologist reads records during appointment slots, through the EHR, and sends the occasional referral export by day to internal endpoints and secure messaging. A database administrator runs maintenance in approved windows, ships backups to dedicated storage, and touches patient tables only during schema migrations. A scheduler reads demographics and calendars, never clinical notes or labs, evenly across business hours. Three roles, three shapes, all learned from the movement itself.
The collector resolves each move to a probabilistic, source-dependent identity and the job behind it. So it surfaces the physician opening an unusual volume of files in minutes. The scheduler suddenly reading clinical tables. The DBA opening a connection to an outside destination at 3 a.m.
One anomaly is noise. Three together is a signal.
Any single deviation has an innocent story. The cardiologist is covering a colleague. The scheduler got temporary rights for a migration. The DBA is fighting a real outage. Fire an alert on each and you bury the SOC.
The signal lives where three axes break at once.
The user axis: this physician has not come close to this volume in any session across months of baseline, and now sits well past their range. The role axis: no physician in this cardiology cohort has ever exported clinical notes to removable media, and this is the first time anyone has. The infrastructure axis: every other role on the workloads serving this region looks normal, physicians elsewhere look normal, and only this account deviates.
When all three move together, the innocent stories run out. Hilt writes the case, identity and role and data and destinations attached, while the movement is still forming. Not in the forensics. Not in the disclosure letter.
The move looks the same from anywhere
Virtual care runs across cloud regions, data centers, hospital workstations, home offices, and user endpoints. Perimeter controls fracture against that spread. A VPN concentrator sees a tunnel. A CASB sees an API call. An EDR agent sees an endpoint event. None of them sees the data move end to end across all of it.
Kernel observability tools, cluster-native agents, and EDR each watch a host or a pod. They were built to watch the machine, not to govern how sensitive data moves and to whom. Hilt sits across all of them as the Data Movement Governance layer. The same collector watches the move on a cloud workload, on a node in an orchestrated cluster, and on a clinician's macOS-compatible user endpoint, then merges the baselines. A physician's pattern shift reads the same from the hospital, the kitchen table, or a hotel. An engineer's deviation reads the same from a console, a cloud shell, or a remote session. Where the move happens stops mattering, because the move resolves to an identity and a job no matter where it ran.
Walk the billing coordinator through
Picture the platform: intake, scheduling, video visits, e-prescribing, lab feeds. WAF rules, database encryption, MFA, session recording, full audit logs. Compliant with HIPAA, HITRUST, SOC 2. By the book.
The billing coordinator with legitimate access to demographics starts reading clinical notes. Wrong data type for her role. Volume climbing past her baseline. A process that has never run under her account. Timing outside every window she has ever worked.
Hilt surfaces the deviation across all three axes as it happens, resolves the move to the user, her cohort, and the workload, weighs it against months of baseline, and writes one case instead of a stack of raw alerts. The case names the identity, the role, the data, the destinations, and why the pattern does not fit.
From the control plane, the platform applies host-level network isolation and quarantines that host while the case is reviewed. The collector never sits inline, never blocks or alters traffic in the path. The quarantine answers a written case, not a packet.
The credentials were stuffed from a breach dump. The attacker held valid logins and real access. Encryption guarded the wire. RBAC waved the queries through. The audit log wrote it all down. Only the behavioral correlation caught the move, and the quarantine held the host, before a large set of records left the building.
A telehealth platform still needs encryption, access control, and its compliance frameworks. What it does not have is any way to see what an authorized account does with authorized access while it is doing it. That is the layer Hilt adds, and the patterns it catches are the ones the rest of the stack is built to allow. If you want to see how this maps onto your own infrastructure, we can walk it through on a 30-minute technical call.