Applications leveraging the power of Artificial Intelligence (AI) are transforming the healthcare industry to enhance patient care, streamline processes, and advance medical research. While it holds significant potential, the technology requires massive amounts of patient data, raising concerns about privacy, security, and other ethical issues.

HITRUST helps ensure the ethical use of AI in healthcare  through its AI Assurance Program. The HITRUST AI Assurance program provides a comprehensive framework for AI risk management that promotes transparency, accountability, and collaboration while protecting patient privacy and fostering responsible AI adoption.

Ethical Challenges of Using AI in Healthcare

AI is transforming the future of healthcare  from discovery to diagnosis to delivery. However, AI ethics is a complex and multidimensional issue with considerations that include

Safety and Liability

AI has the potential to reshape healthcare operations, making them safer and more reliable. However, AI can be prone to errors, and determining liability can be complex due to multiple parties involved in creating these applications.

Patient Privacy

AI systems rely on vast amounts of data, raising concerns about how patient information is collected, stored, and used.

Informed Consent

Healthcare providers should inform patients about the use of AI in their care. Patients should additionally have the right to consent or opt out if they are uncomfortable with AI involvement in their diagnosis or treatment.

Data Ownership

Determining who owns and controls healthcare data used by AI systems can be an ethical issue with competing interests among healthcare providers, application developers, and data aggregators.

Data Bias and Fairness

Data used to train AI algorithms may result in biased healthcare decisions. This can lead to ethical dilemmas where AI systems possibly perpetuate or exacerbate disparities in healthcare outcomes among different demographic groups.

Transparency and Accountability

Healthcare professionals and patients need to understand how AI systems make decisions. Promoting transparency in AI algorithms and ensuring that developers and providers are accountable for their decisions is essential to building trust in AI systems.

How Applications Collect, Store, and Use Patient Data

Patient health data is collected, stored, and used through a combination of manual and digital processes.

Data Collection

• Manual Data Entry: Healthcare professionals record patient information during in-person visits. This can include basic demographic data, medical history, symptoms, and diagnoses.
• Electronic Health Records (EHRs): Many healthcare facilities use EHR systems to record and store patient data electronically. These systems allow for the efficient input and retrieval of patient information.

Data Storage

• EHR Systems: EHRs store patient data, including clinical notes, test results, and medication records.
• Health Information Exchange (HIE): In some cases, patient data may be shared among healthcare organizations using HIE networks, allowing for the exchange of information between different providers.
• Cloud Storage: Some healthcare organizations choose to store patient data in secure cloud servers, often with strong encryption and data security measures.

Data Use

• Patient Care: Healthcare providers review medical history, test results, and medication information to make informed diagnosis and treatment decisions.
• Research and Innovation: Patient data sets can be used in medical research and clinical studies to advance industry knowledge and improve treatments.
• Billing and Insurance: Organizations use patient data for administrative purposes, including generating bills, processing insurance claims, and managing payments.
• Quality Improvement: Healthcare organizations may analyze patient data to assess the quality of care and identify areas for improvement.
• Public Health: Public healthcare organizations use aggregated and anonymized patient data to monitor disease outbreaks, track health trends, and plan public health initiatives.

Healthcare organizations and providers are legally and ethically responsible for protecting patient data and ensuring it is used for authorized and legitimate purposes. Unauthorized access or improper handling of patient data can result in legal consequences, including fines and penalties.

The Role of Third-Party Vendors in AI-Based Healthcare Solutions

Third-party vendors play significant roles in AI-based healthcare solutions by providing specialized technology, expertise, and services that complement and enhance the capabilities of healthcare organizations.

The involvement of third-party vendors can help healthcare providers, institutions, and researchers leverage AI effectively to improve patient care and streamline healthcare processes in the following ways.

AI Development and Integration

Third-party vendors develop AI algorithms, applications, and software tailored for healthcare use cases. They often specialize in areas like medical imaging analysis, natural language processing, predictive analytics, neural networks, and disease diagnosis.

Solutions developed by third-party vendors are typically integrated into existing healthcare systems, such as EHRs, diagnostic tools, and telemedicine platforms.

Data Collection and Aggregation

Third-party vendors provide data collection, aggregation, and normalization tools that can be integrated into wearables, medical devices, and patient records. These tools help healthcare organizations gather and structure diverse data sources for use in AI analysis.

Data Security and Compliance

Third-party vendors typically ensure that their AI solutions comply with healthcare data security regulations, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in the European Union. Compliance with these regulations requires that vendors implement strong security measures to secure data systems when handling patient data during collection, transmission, and storage.

Monitoring and Maintenance

Vendors typically offer continuous monitoring and maintenance services to ensure the reliability and accuracy of AI systems. Regular updates and improvements to algorithms and models are essential to keep the solutions effective and up-to-date.

Research Collaboration

Third-party vendors often collaborate with healthcare entities and academic institutions to conduct research studies and clinical trials. Collaboration with these organizations typically involves providing AI tools, data, and expertise to help advance research efforts.

How Using Third-Party Vendors Impacts Patient Data Privacy

There are numerous pros and cons of using AI in healthcare . Similarly, the involvement of third-party vendors can positively and negatively impact patient data privacy.

Positive impacts include

• Specialized expertise in data security and privacy through robust security measures and best practices to protect patient data and enhance privacy.
• Assistance with compliance issues via expertise in healthcare data privacy regulations such as HIPAA and GDPR.
• Robust encryption methods to secure patient information during data storage, transmission, and processing to protect information from unauthorized access.
• Advanced oversight and auditing capabilities to help healthcare organizations track and control access to patient data, ensuring that it is only accessed by authorized personnel.

Negative impacts include

• Potential risks of sharing patient data with external entities that may increase unauthorized access to sensitive information.
• Possible negligence that can lead to data breaches or security incidents.
• Issues with data transfer and ownership that may become complex when third-party vendors are involved.
• Lack of direct control over the security and privacy practices of third-party vendors.
• Differing ethical standards that may arise when vendors do not share the same concerns regarding data privacy and patient consent.

How to Ensure Patient Privacy When Using AI

Ensuring patient privacy and security when utilizing AI in healthcare settings is critical to leveraging the full potential of the technology while minimizing risks.

Some key ways to enhance patient privacy and security in AI applications in healthcare include

• Rigorous due diligence before entering into partnerships with third-party entities.
• Strong data security contracts with third-party vendors.
• Data minimization that limits the amount of patient data shared with vendors.
• Implementing robust data encryption protocols for data at rest and during transmission.
• Limited access to patient data with strong access controls such as role-based permissions and two-factor authentication.
• De-identification and anonymization of patient data that replaces identifiable information with pseudonyms or codes.
• Maintainance of audit logs that record access to patient data and regular reviews investigating unauthorized or suspicious activity.
• Regular vulnerability testing to identify and address potential weaknesses in IT infrastructure and AI systems.
• Compliance with regulations or applicable local laws and standards.
• Secure data storage in secure on-premise and cloud environments.
• Training and awareness programs for healthcare professionals and staff on data security best practices, the responsible use of AI, and the importance of patient privacy.
• Development of an incident response plan to address potential data breaches or security incidents.

Adopting a proactive, multi-layered approach to minimizing the security risks of using AI in healthcare  is critical to maintaining patient privacy. Protecting patient data is a legal requirement and a fundamental ethical principle to build and maintain trust in the healthcare system.

Recent Changes to the Regulatory Landscape

The White House released the Blueprint for an AI Bill of Rights in October 2022, emphasizing rights-centered principles for addressing AI-related risks. Concurrently, the US Department of Commerce's National Institute of Standards and Technology (NIST) introduced the Artificial Intelligence Risk Management Framework 1.0 (AI RMF) to guide responsible AI development with some insights applicable to healthcare.

The HIPAA mandates data protection in the United States. Malicious actors using AI may expose covered entities and related associates to potential liability under the HIPAA. Applications of AI used by threat actors include the development of malware and deceptive phishing email templates designed to deceive recipients into opening dangerous attachments or clicking malicious links.

HITRUST Helps Ensure Secure, Privacy-Focused AI Implementation

HITRUST recently launched the AI Assurance Program, designed to enhance data security in AI applications used by the healthcare industry. The program incorporates AI risk management into the HITRUST CSF (Common Security Framework), integrating sources such as the NIST AI Risk Management Framework and ISO AI Risk Management Guidelines.

The HITRUST AI Assurance program helps organizations stay current with evolving AI technology and associated risks while fostering responsible AI adoption and promoting industry-wide transparency and collaboration.

Click here to learn more about the HITRUST Strategy for Providing Reliable AI Security Assurances.