HIM leaders face gaps in how protected health information (PHI) is tracked, particularly when new capabilities are introduced outside formal procurement or privacy review processes.