Detecting sensitive content (an SSN, a diagnosis code) that lands inside a free-text field never explicitly tagged as sensitive by schema.
Named-entity/pattern classifier trained to flag sensitive content types inside otherwise-untagged text fields.
Standard PII/PHI detection libraries; LLM as a secondary check on low-confidence spans