Information governance as an AI prerequisite

Why healthcare estates overshare

Clinical work is collaborative and urgent, and the sharing model rewards speed. A consultant needs a protocol at eleven at night, so somebody shares it with everyone in the organization because that link works immediately and a permissions request does not.

Repeat that across a decade and a merged estate that has absorbed two acquisitions, and the effective permissions bear no relationship to anyone's intent.

Microsoft's own tooling reflects how common this is. SharePoint Advanced Management now reports specifically on files shared with Everyone Except External Users — the exact pattern that causes most of it — and delivers the report as a downloadable export rather than a dashboard because the row counts defeat on-screen review.

What the assessment should establish

Not a list of sites. A list of content reachable by more people than the owner believes, weighted by how sensitive it is.

The distinction matters because volume is a poor proxy for risk. A site with ten thousand overshared documents that are all published policies is a lower priority than one with forty documents containing patient-identifiable material.

• Broad-access sharing links on libraries containing patient-identifiable data
• Permission inheritance broken years ago and never reviewed since
• Sites with no active owner, where nobody can approve a change
• Content with no sensitivity label, in libraries where labelling was assumed automatic
• Guest and external access that outlived the project justifying it

The sequence, and why reversing it fails

Discovery first, remediation second, deployment third. Organizations that reverse the first two spend the pilot period arguing about individual documents instead of learning whether the technology helps.

There is a second reason the order matters. A pilot group given access during remediation will find the unremediated content, and the finding will reach leadership as an incident rather than as a planned discovery. The same fact, arriving in a different frame, produces a paused programme instead of a funded one.

Microsoft's data security posture management for AI now surfaces which AI applications are being used and what data they reach, which makes the assessment considerably cheaper to run than it was two years ago. That is an argument for running it, not for skipping it.