20  Privacy, HIPAA, and Patient Data Security

TipLearning Objectives

Privacy and data security are paramount in medical AI. Medical data is among the most sensitive personal information, and AI systems process vast quantities of it. This chapter examines privacy regulations, data protection strategies, and emerging challenges in the AI era. You will learn to:

  • Understand HIPAA requirements and how they apply to AI systems
  • Recognize privacy risks unique to medical AI (re-identification, inference attacks, model memorization)
  • Apply best practices for data governance and security
  • Navigate consent and data use challenges with AI
  • Assess vendor compliance and security practices
  • Protect patients from privacy breaches and misuse of medical data

Essential for all physicians, healthcare administrators, informaticists, and AI developers.

Medical AI Creates New Privacy Challenges:

Medical AI requires large datasets for training, raising privacy concerns: - Data scale: AI systems may train on millions of patient records - Data aggregation: Combining data from multiple sources increases re-identification risk - Data persistence: AI models may “memorize” training data, enabling reconstruction of patient information - Third-party access: Cloud-based AI means patient data leaves institutional control

HIPAA Compliance is Necessary But Insufficient:

HIPAA establishes baseline requirements: - ✅ Business Associate Agreements (BAAs) required for AI vendors handling PHI - ✅ De-identification standards apply (Safe Harbor or Expert Determination) - ✅ Minimum necessary principle: limit data access to what’s needed - ✅ Patient rights to access, amend, and restrict use of their data

But HIPAA has limitations: - ❌ Written before modern AI—doesn’t address many AI-specific risks - ❌ De-identification isn’t foolproof (re-identification possible with external data) - ❌ Doesn’t apply once data leaves covered entities (research, commercial use) - ❌ Enforcement gaps—violations often go undetected (Price and Cohen 2019)

Key Privacy Risks in Medical AI:

  1. Re-identification Attacks:
    • “De-identified” datasets can often be re-identified by linking to external data
    • Geographic, demographic, and clinical data combinations are often unique
    • Risk increases as more “anonymized” datasets become available (sweeney2015identifying?)
  2. Model Inversion Attacks:
    • Adversaries can reconstruct training data from AI model parameters
    • Particularly concerning for rare diseases or unique patient characteristics
    • Deep learning models especially vulnerable
  3. Membership Inference Attacks:
    • Determine whether specific individual’s data was used in model training
    • Can reveal sensitive information (e.g., person was in HIV study dataset)
    • Documented in medical AI models (shokri2017membership?)
  4. Data Breaches:
    • Healthcare experiences more data breaches than any other sector
    • AI vendors may have inadequate security practices
    • Cloud infrastructure creates additional attack surface
  5. Secondary Use Without Consent:
    • Data collected for clinical care repurposed for AI development
    • Commercial AI companies monetizing patient data
    • Lack of transparency about data use

Best Practices for Privacy Protection:

✅ Before Deploying AI: - Conduct privacy impact assessment - Verify vendor HIPAA compliance (BAA, security certifications) - Review data governance and use agreements - Ensure patients informed about AI data use

✅ During Use: - Minimize data collection (only necessary elements) - Implement access controls and audit logging - Encrypt data in transit and at rest - Monitor for unauthorized access or breaches

✅ Emerging Privacy-Preserving Techniques: - Federated learning: Train AI without centralizing patient data - Differential privacy: Add mathematical noise to protect individuals while preserving population-level patterns - Synthetic data: Generate artificial datasets that preserve statistical properties without containing real patient data - Homomorphic encryption: Perform computations on encrypted data

Clinical Bottom Line:

Privacy isn’t just regulatory compliance—it’s a core professional obligation. Patients trust physicians with their most sensitive information. Medical AI must honor that trust by implementing robust privacy protections, transparency about data use, and giving patients meaningful control over their data (Price and Cohen 2019; vayena2018machine?).

Physicians must be privacy advocates: scrutinize AI vendors, demand transparency, refuse systems with inadequate protections, and ensure patients understand how their data is used.

20.1 Introduction

Every medical encounter generates data: diagnoses, medications, lab results, imaging, clinical notes. This data is extraordinarily sensitive—it reveals our vulnerabilities, our genetics, our behaviors, our fears.

Traditionally, medical data stayed within relatively closed systems: hospitals, clinics, physician practices. Patients trusted that their information would remain confidential, protected by professional ethics, institutional policies, and legal regulations like HIPAA.

Medical AI disrupts this model. AI systems require vast amounts of data—not hundreds or thousands of records, but millions. Training datasets often aggregate data across multiple institutions, even internationally. Models may be trained by commercial vendors with access to patient records. Cloud computing means data leaves institutional servers. And once AI models are trained, they may “remember” sensitive information from training data in ways that enable adversaries to reconstruct patient records.

These are not theoretical risks. Re-identification of “anonymized” medical data has been repeatedly demonstrated (sweeney2015identifying?). Healthcare data breaches affect millions of patients annually. AI companies have been caught using patient data without adequate consent or transparency. And privacy-invasive practices disproportionately harm vulnerable populations who have less power to protect their information (Price and Cohen 2019).

This chapter examines privacy challenges in medical AI, regulatory frameworks (HIPAA and beyond), privacy risks unique to AI, and practical strategies for protecting patient data.

20.2 HIPAA: The Regulatory Foundation

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes baseline privacy and security requirements for Protected Health Information (PHI).

20.2.1 What HIPAA Requires

1. Privacy Rule: - Governs use and disclosure of PHI - Requires patient authorization for most uses beyond treatment, payment, and healthcare operations - Gives patients rights to access, amend, and receive accounting of disclosures

2. Security Rule: - Requires administrative, physical, and technical safeguards for electronic PHI (ePHI) - Risk assessments mandatory - Encryption strongly recommended (though not explicitly required) - Access controls, audit logs, and integrity protections required

3. Breach Notification Rule: - Covered entities must notify patients of breaches of unsecured PHI - HHS and media notification required for large breaches (>500 individuals) - Business associates also have notification obligations

4. Business Associate Agreements (BAAs): - Required when covered entities share PHI with third parties (vendors, contractors, AI companies) - BAAs specify permitted uses, safeguard requirements, breach notification, and liability - AI vendors handling PHI must sign BAAs and comply with HIPAA

20.2.2 HIPAA and De-Identification

HIPAA allows use of de-identified data without patient authorization. Two de-identification methods:

1. Safe Harbor Method: Remove 18 categories of identifiers: - Names, geographic subdivisions smaller than state (except first 3 digits of ZIP if >20,000 people) - Dates (except year; ages >89 aggregated) - Phone numbers, fax numbers, email addresses, SSNs, medical record numbers - Account numbers, certificate/license numbers, vehicle identifiers - Device identifiers, web URLs, IP addresses, biometric identifiers - Full-face photos, other unique identifying characteristics

2. Expert Determination: - Qualified statistician determines re-identification risk is very small - More flexible than Safe Harbor (can retain some identifiers if low risk) - Requires expertise and documentation

CRITICAL LIMITATION: De-identification under HIPAA does not guarantee privacy. Research repeatedly shows “anonymized” medical data can be re-identified (sweeney2015identifying?).

20.2.3 HIPAA’s Limitations for AI

HIPAA was written before modern AI existed. Key gaps:

1. Doesn’t Address AI-Specific Risks: - Model memorization of training data - Inference attacks (extracting information from model outputs) - Re-identification through AI-enabled linking

2. Limited Scope: - Only applies to covered entities and business associates - Once data leaves this ecosystem (research, commercial use), HIPAA doesn’t apply - Patient-generated data (apps, wearables) often not covered

3. Weak Enforcement: - Violations often go undetected - Fines often small relative to company revenues - No private right of action (patients can’t sue for HIPAA violations)

4. De-identification Loopholes: - De-identified data can be used without restriction - But de-identification increasingly ineffective in big data era

Bottom Line: HIPAA compliance is necessary but not sufficient for protecting patient privacy in medical AI (Price and Cohen 2019).

20.3 Privacy Risks Unique to Medical AI

Medical AI creates privacy risks that don’t exist (or are much smaller) in traditional healthcare IT.

20.3.1 1. Re-Identification Attacks

The Problem: “Anonymous” medical datasets can often be re-identified by linking to other datasets or public information.

Classic Example: Latanya Sweeney’s Research (sweeney2015identifying?): - Massachusetts released “anonymized” hospital discharge data (removed names, addresses) - Sweeney re-identified Governor William Weld’s records by linking to voter registration database - Used ZIP code + birth date + sex (only 6 people shared these characteristics in his ZIP)

Why It Matters for AI: - AI training datasets often contain rich clinical detail (diagnoses, procedures, medications, lab values) - Even without direct identifiers, these clinical patterns can be unique - As more datasets become available, re-identification risk increases (more linkage opportunities)

Research Findings: - 87% of U.S. population can be uniquely identified using ZIP code, birth date, and sex - Medical records with detailed clinical information often uniquely identify patients even in large datasets - Commercial data brokers aggregate information that facilitates re-identification

Mitigation: - Differential privacy (add mathematical noise to data) - Limit granularity (age ranges instead of exact birth dates, regional instead of ZIP codes) - Restrict access to de-identified datasets (not publicly released) - Monitor for linkage attempts

20.3.2 2. Model Inversion and Membership Inference Attacks

Model Inversion: - Adversary reconstructs training data from AI model parameters - Example: Given AI model predicting disease from genomic data, infer genome sequences of training set patients - Deep learning models particularly vulnerable (complex models memorize training examples)

Membership Inference: - Adversary determines whether specific individual was in training dataset - Example: Query AI model repeatedly to determine if particular patient’s record was used in training - Can reveal sensitive information (person had HIV, mental health condition, etc.)

Documented Attacks (shokri2017membership?): - Researchers successfully performed membership inference on medical AI models - Success rates >70% for determining whether individual in training set - Risk increases with model overfitting (common when training data is limited)

Why This Matters: - AI models themselves become privacy risks (even if training data is secured) - Releasing model parameters (e.g., for transparency or reproducibility) can leak patient information - Cloud-based AI creates additional exposure (vendor has model parameters)

Mitigation: - Differential privacy during training (add noise to gradients) - Limit model complexity (prevents overfitting/memorization) - Restrict access to model parameters - Audit models for memorization before deployment

20.3.3 3. Data Breaches

Healthcare is Top Target: - Healthcare experiences more data breaches than any other sector - Average cost of healthcare data breach: $10.93 million (highest of any industry) - Medical records sell for 10-50x more than credit cards on dark web (more information, longer useful life)

AI-Specific Breach Risks: - Cloud infrastructure: Patient data stored by third-party AI vendors - Data aggregation: Centralized datasets create high-value targets - Supply chain vulnerabilities: Multiple parties (AI vendor, cloud provider, subcontractors) create attack surface - Insider threats: Employees with access to large datasets may misuse or sell data

Major Healthcare Breaches: - Anthem (2015): 78.8 million records - Premera Blue Cross (2015): 11 million records - UCLA Health (2015): 4.5 million records - Hundreds of smaller breaches annually

Consequences: - Identity theft, fraud, medical identity theft - Embarrassment, stigma (sensitive diagnoses exposed) - Discrimination (insurance, employment) - Loss of trust in healthcare system

Mitigation: - Encryption (data at rest and in transit) - Access controls (least privilege, multi-factor authentication) - Security audits and penetration testing - Incident response plans - Vendor risk assessment (verify AI vendors have robust security)

20.3.5 5. Algorithmic Inference of Sensitive Information

The Problem: AI can infer sensitive information patients haven’t disclosed.

Examples: - AI predicts sexual orientation, political views, personality traits from social media and digital traces - Medical AI could infer genetic risks, psychiatric diagnoses, substance use from indirect signals - Insurance companies could use AI to infer health risks from consumer data (shopping patterns, web searches, social media)

Why This Matters: - Patients may not realize sensitive information can be inferred - Can’t consent to disclosure of information they didn’t know they were revealing - Creates new forms of discrimination (denied insurance, employment based on inferred risks)

Example: Pregnancy Prediction: - Target’s AI predicted pregnancy from shopping patterns, sent maternity ads to teenage girl - Father complained to Target, later discovered daughter was pregnant - AI revealed sensitive information before patient had disclosed it

Medical Applications: - AI could infer HIV status from prescription patterns, doctor visits, lab tests - Could infer mental health conditions from activity patterns, communication metadata - Could infer genetic disease risk from relatives’ medical data

Ethical Concern: Right to “informational privacy”—not just protecting data you’ve shared, but also inferences drawn from that data.

Mitigation: - Transparency about what AI can infer - Patient control over data and its uses - Prohibitions on certain inferences (e.g., ban on using consumer data to infer health risks for insurance) - Regulations limiting use of inferred data for discrimination

20.4 Data Governance for Medical AI

Robust data governance is essential for protecting privacy while enabling beneficial AI.

20.4.1 Core Principles

1. Data Minimization: - Collect only data necessary for specific AI purpose - Don’t create large, multi-purpose datasets “just in case” - Delete data when no longer needed

2. Purpose Limitation: - Specify purpose for data collection - Don’t repurpose data without additional consent - Restrict AI vendors from using data for other purposes (e.g., training models for other clients)

3. Transparency: - Inform patients about data use for AI - Make data practices discoverable (privacy policies in plain language) - Document data flows (where data goes, who has access)

4. Individual Control: - Give patients rights to access, correct, delete their data - Provide opt-out mechanisms - Allow patients to request restrictions on data use

5. Accountability: - Assign responsibility for data protection - Audit data practices regularly - Enforce consequences for violations

20.4.2 Practical Data Governance Framework

ImportantEssential Components of AI Data Governance

1. Data Inventory: - Catalog all patient data used for AI (sources, types, sensitivity levels) - Map data flows (where data moves from initial collection to AI use) - Identify all parties with access (internal teams, vendors, cloud providers)

2. Privacy Impact Assessment: - For each AI project, assess privacy risks - Consider: What data is collected? Who has access? What are re-identification risks? What harms could result from breach or misuse? - Identify mitigation strategies - Document assessment and decisions

3. Access Controls: - Least privilege (users only access data necessary for their role) - Role-based access control (RBAC) - Multi-factor authentication for sensitive data access - Audit logging (who accessed what data, when) - Regular access reviews (remove unnecessary permissions)

4. Data Use Agreements: - Formalize permitted uses, restrictions, and safeguards - For external parties (vendors), require BAAs and security certifications - Prohibit unauthorized secondary use, data sales, or sharing - Include breach notification requirements

5. Patient Consent Management: - Transparent consent for AI data use (separate from general treatment consent) - Granular control (allow opt-out of specific AI uses while permitting others) - Easy-to-understand language (avoid legalese) - Document consent and respect patient choices

6. Security Safeguards: - Encryption (data at rest and in transit) - Secure data storage (access-controlled, physically secured servers) - Network security (firewalls, intrusion detection) - Regular security testing (penetration tests, vulnerability scans) - Incident response plan (what to do if breach occurs)

7. Vendor Management: - Due diligence before selecting AI vendor (security practices, HIPAA compliance, reputation) - Contractual protections (BAAs, data use restrictions, audit rights) - Ongoing monitoring (annual security assessments, breach notifications) - Exit strategy (data return or destruction when contract ends)

8. Training and Culture: - Educate staff about privacy obligations - Create culture of privacy-consciousness (not just compliance checkbox) - Empower employees to raise concerns about privacy risks

9. Ongoing Monitoring: - Regular audits of data access and use - Monitor for anomalous access patterns (insider threats) - Track AI model performance drift (could indicate data issues) - Review privacy practices annually, update as needed

10. Accountability and Enforcement: - Assign ownership (Chief Privacy Officer, Data Governance Committee) - Consequences for violations (personnel action, contractual penalties for vendors) - Continuous improvement (learn from incidents, update practices)

20.5 Evaluating AI Vendor Privacy and Security

Healthcare organizations must carefully assess AI vendors before granting access to patient data.

20.5.1 Key Questions for AI Vendors

WarningDue Diligence Checklist for AI Vendors

HIPAA and Regulatory Compliance: - ❓ Will vendor sign a Business Associate Agreement (BAA)? - ❓ Is vendor HIPAA-compliant (policies, training, safeguards)? - ❓ What certifications does vendor hold (HITRUST, SOC 2, ISO 27001)? - ❓ Has vendor had any past privacy/security breaches or regulatory violations?

Data Use and Ownership: - ❓ What data does vendor need access to? Why is each element necessary? - ❓ Will data be used only for our institution, or to train models for other clients? - ❓ Who owns the AI model? Can vendor use our data to improve model for others? - ❓ Can vendor sell or share our data with third parties? - ❓ What happens to our data when contract ends (return, deletion)?

Data Storage and Security: - ❓ Where is data stored (vendor servers, cloud provider, which jurisdiction)? - ❓ Is data encrypted at rest and in transit? What encryption standards? - ❓ What access controls are in place? Who at vendor company can access our data? - ❓ Are vendor employees background-checked? - ❓ How often does vendor conduct security testing?

Breach and Incident Response: - ❓ What is vendor’s incident response plan? - ❓ How quickly will vendor notify us of a breach? - ❓ Does vendor have cyber insurance? - ❓ What is vendor’s history of breaches?

Transparency and Auditing: - ❓ Can we audit vendor’s security practices? - ❓ Will vendor provide access logs showing who accessed our data? - ❓ How does vendor demonstrate ongoing compliance?

International Data Transfers: - ❓ Will our data be transferred outside the U.S.? - ❓ What privacy protections apply in other jurisdictions? - ❓ Does vendor comply with GDPR if applicable?

Red Flags: - ❌ Vendor unwilling to sign BAA - ❌ Vague or evasive answers about data use - ❌ Claims data is “completely anonymized” (no such thing) - ❌ Lack of security certifications - ❌ History of breaches or regulatory violations - ❌ Offshore data storage without adequate protections - ❌ No clear data deletion policy

Negotiating Vendor Contracts: - Don’t accept vendor’s standard contract without changes - Insist on data use restrictions, audit rights, prompt breach notification - Require indemnification if vendor’s breach harms your patients - Include termination rights if vendor violates terms - Get everything in writing (don’t rely on verbal assurances)

20.6 Privacy-Preserving AI Techniques

Emerging technologies can enable medical AI while better protecting privacy.

20.6.1 1. Federated Learning

How It Works: - AI model trained across multiple institutions without centralizing data - Each institution trains model on local data, shares only model parameters (not patient data) - Central server aggregates model updates to improve global model - Cycle repeats until model converges

Privacy Benefits: - Patient data never leaves originating institution - Reduces risk of large-scale breaches (no centralized database) - Enables multi-institutional collaboration without data sharing

Limitations: - Model parameters can still leak some information (though much less than raw data) - Requires technical infrastructure for federated training - Coordination challenges across institutions - Still vulnerable to some inference attacks

Medical Applications: - Multi-hospital AI model development (e.g., radiology AI trained across 10 hospitals without sharing images) - Rare disease research (aggregate learning across institutions with small patient numbers)

Example: Google’s Federated Learning for Medical Imaging: - Trained AI models across hospitals in India for diabetic retinopathy screening - Patient data remained at local clinics - Achieved performance comparable to centralized training

20.6.2 2. Differential Privacy

How It Works: - Mathematical technique that adds carefully calibrated noise to data or model outputs - Guarantees that including or excluding any single individual’s data changes results minimally - Provides formal privacy guarantee: can’t infer whether specific person’s data was used

Privacy Benefits: - Rigorous mathematical privacy guarantee (unlike heuristic de-identification) - Protects against re-identification and inference attacks - Can be applied to training data or model outputs

Limitations: - Reduces accuracy (noise degrades model performance) - Trade-off between privacy and utility - Requires careful tuning of privacy parameters - Not intuitive for non-experts

Medical Applications: - Releasing aggregate health statistics without identifying individuals - Training AI models with privacy guarantees - Sharing genomic data for research

Example: Apple’s Differential Privacy: - Uses differential privacy to collect user health data (steps, activity) for population-level insights - Individual-level data protected by mathematical noise

20.6.3 3. Synthetic Data

How It Works: - Generate artificial dataset that preserves statistical properties of real data without containing actual patient records - Train generative AI model (e.g., GAN) on real data - Use model to generate synthetic patients (new combinations of characteristics)

Privacy Benefits: - Synthetic data doesn’t directly correspond to real patients - Can be shared more freely for research and development - Reduces re-identification risk (no real individuals to identify)

Limitations: - Still possible to extract some real patient information from synthetic data (especially if generation model overfits) - Synthetic data may not perfectly replicate all patterns in real data - Quality depends on generation method and real data quality

Medical Applications: - Training AI when real data is scarce or restricted - Sharing data for research, competitions, or education - Testing AI systems before deployment on real patients

Example: Synthea (Synthetic Patient Generator): - Open-source tool generating realistic synthetic patient records - Used for EHR testing, research, and AI development - Not based on real patients (rule-based generation)

20.6.4 4. Homomorphic Encryption

How It Works: - Allows computations on encrypted data without decrypting it - Data remains encrypted throughout AI training and inference - Only data owner can decrypt results

Privacy Benefits: - Ultimate privacy: cloud provider or AI vendor never sees unencrypted data - Protects against breaches (even if attacker steals encrypted data, it’s unreadable) - Enables secure cloud computing

Limitations: - Extremely computationally expensive (orders of magnitude slower than unencrypted computation) - Currently impractical for most real-world medical AI applications - Requires specialized cryptographic expertise

Medical Applications: - Secure cloud-based AI inference (patient data encrypted, cloud performs prediction on encrypted data, result returned encrypted) - Multi-party computation (multiple institutions jointly analyze data without any party seeing others’ data)

Future Potential: - As technology improves, may enable truly private medical AI - Active research area—expect performance improvements

20.7 Patient Perspectives on Privacy

Privacy isn’t just regulatory compliance—it’s what patients expect and deserve.

20.7.1 What Patients Care About

Survey Research Findings: - Majority support medical AI research, including use of their data - But want transparency (know when and how data is used) - Want control (ability to opt out) - Want benefit (AI should help patients, not just profit companies) - Fear discrimination (insurance, employment) based on medical data (vayena2018machine?)

Trust Factors: - Patients trust physicians and hospitals more than tech companies - Nonprofit research trusted more than commercial AI development - Clear public benefit (improve diagnoses, find treatments) increases willingness to share data - Profit-driven uses (marketing, insurance risk assessment) reduce willingness

Vulnerable Populations: - Communities with history of medical exploitation (e.g., Tuskegee) understandably more skeptical - Marginalized groups face greater risks from data misuse (discrimination already prevalent) - Important to engage these communities, earn trust through transparency and protections

20.7.2 Building and Maintaining Trust

1. Transparency: - Tell patients when their data is used for AI - Explain purpose, risks, and benefits - Make privacy policies accessible and understandable

2. Consent: - Meaningful, informed consent (not buried in fine print) - Granular control (opt out of specific uses) - Easy process for giving or withdrawing consent

3. Accountability: - Clear responsibility when things go wrong - Mechanisms to report concerns - Enforcement of privacy violations

4. Equity: - Ensure AI benefits reach all communities, not just privileged ones - Address algorithmic bias that harms marginalized groups - Prevent use of AI for discrimination

5. Patient Advocacy: - Physicians as advocates for patient privacy - Push back against exploitative data practices - Prioritize patient welfare over institutional or commercial interests

20.8 Regulatory Landscape Beyond HIPAA

HIPAA is just one piece of privacy regulation affecting medical AI.

20.8.1 GDPR (General Data Protection Regulation)

  • European Union regulation (2018)
  • Applies to medical data of EU residents
  • Stronger protections than HIPAA:
    • Explicit consent required for data processing (can’t rely on de-identification loopholes)
    • Right to data portability
    • Right to be forgotten (erasure)
    • Right to explanation of automated decisions
    • Heavy fines (up to 4% of global revenue)

Implications for Medical AI: - If serving EU patients, must comply with GDPR - Higher bar for consent and transparency - May need to explain AI decisions (challenging for black-box models)

20.8.2 State Laws (California Consumer Privacy Act, etc.)

  • Growing number of U.S. states passing privacy laws
  • CCPA (California) gives consumers rights to know what data is collected, delete data, opt out of sale
  • Medical data often exempt from state laws (deference to HIPAA), but gaps exist

20.8.3 Proposed Federal Privacy Legislation

  • Multiple bills in Congress proposing comprehensive U.S. privacy law
  • Could significantly strengthen protections beyond HIPAA
  • Uncertain timeline for passage

20.9 Conclusion

Privacy in medical AI requires constant vigilance. Patients trust physicians with their most sensitive information—diagnoses, genetics, mental health, sexual health. AI systems that train on millions of patient records and may “remember” sensitive details create unprecedented privacy risks (Price and Cohen 2019).

HIPAA provides a regulatory floor, not a ceiling. Physicians and healthcare organizations must go beyond compliance: implement robust data governance, carefully vet AI vendors, use privacy-preserving techniques when possible, and most importantly, advocate for patients.

Key Principles:

  1. Privacy is a patient right, not just a regulatory requirement
  2. Transparency builds trust—be honest about data use
  3. Minimize data collection and retention
  4. Secure data rigorously (encryption, access controls, monitoring)
  5. Give patients meaningful control over their data
  6. Demand accountability from AI vendors
  7. Use privacy-preserving techniques when possible
  8. Prioritize patient welfare over institutional or commercial interests

The promise of medical AI—better diagnoses, personalized treatment, equitable access—can only be realized if patients trust that their data will be protected. Violate that trust, and patients will (rightly) refuse to participate. Protect privacy, and patients will support AI that benefits everyone.

20.10 References