Is anyone using agents in regulated industries? How do you make sure sensitive data doesn't go back to the AI provider?

I'm seeing ai agents being used in places like hospitals and while I actually think that's a good thing, ai can help medical professionals diagnose issues at a fast pace, removing some bottlenecks and speeding things up