Health Professions Orientations

"Developers and vendors of large language models (“LLMs”) — such as ChatGPT, Google Bard, and Microsoft’s Bing at the forefront—can be subject to Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) when they process protected health information (“PHI”) on behalf of the HIPAA covered entities. In doing so, they become business associates or subcontractors of a business associate under HIPAA."

"By law, patients have immediate access to discharge notes in their medical records. Technical language and abbreviations make notes difficult to read and understand for a typical patient. Large language models (LLMs [eg, GPT-4]) have the potential to transform these notes into patient-friendly language and format."

"A federal appeals court recently rejected a lawsuit that claimed that a hospital violated patients’ privacy by sharing electronic health record (EHR) data with Google for medical artificial intelligence (AI) development.1 This lawsuit provides crucial insight into legal issues hospitals may face if they share EHR data with for-profit companies, even if these data do not explicitly identify individual patients."

"HIPAA Covered Entities beware! Your vendors are probably implementing artificial intelligence (“AI”) technology within their service offerings. Today, an all-too-common scenario involves an email message or telephone call from your trusted third-party vendor indicating that they are going to integrate AI technology into their service offerings that will involve the use of your patients’ Protected Health Information (PHI). They claim that by using AI technology, they can provide their deliverables in less time, generate useful insights more rapidly, interpret medical imaging, improve the delivery of diagnosis and treatment, or perform accurate predictive analytics.

However, lurking surreptitiously behind the potential benefits of using PHI in AI technology lies a murky mix of risks that could negatively impact you, your vendors, and even your patients, especially when HIPAA compliance and patient PHI are involved. So how should a Covered Entity respond to its Business Associates’ use of patient PHI in AI technology?"