Can I Use Patient Data to Train AI Legally? What Health Care Companies Need to Know
For health care organizations, using patient data can seem appealing. With the growth of AI, it can be a way to improve operations, support patient care, and develop new technologies.
However, using this data to train AI raises both legal and privacy concerns. Whether or not this information can be used ultimately depends on where an organization sits in the health care ecosystem as well as how the AI system will be used.
The rules can vary depending on the organization. For instance, health care providers might have greater flexibility to use protected health information for certain permitted purposes, while technology vendors can face additional restrictions when using data obtained from provider clients.
This is where an artificial intelligence healthcare lawyer comes into play. An attorney can assess whether a proposed AI training activity complies with HIPAA, contractual requirements, and other applicable privacy laws.
If your organization is considering using patient data to train AI, seeking legal advice from a digital health attorney can be crucial to protecting patient information and reducing legal risks.
Can Healthcare Providers Use Patient Data to Train AI?
HIPAA typically allows covered health care providers to use protected health information (PHI) without the need for individual authorization for treatment, payment, and health care operations.
Determining if AI training fits within these permitted purposes directly relates to why the AI is being trained and how the resulting system will be used. For example, a provider may be able to use patient data to develop or train an AI system that supports its own treatment, payment, or health care operations.
However, providers should still document the purpose of the AI training and confirm that the proposed use falls within an applicable HIPAA permission before moving forward. An artificial intelligence healthcare lawyer can help providers determine if their proposed use complies with HIPAA requirements.
Can a Healthcare Vendor Train AI Using a Provider’s Patient Data?
A vendor acting as a business associate may be permitted to use patient information when the use is performed on behalf of the health care provider. The use must also be permitted under the parties’ Business Associate Agreement (BAA) and comply with applicable HIPAA requirements and other contracts.
Regardless of the intended use, vendors need to distinguish between training an AI product as a service for a specific provider and using that provider’s data to create their own commercial AI products.
These uses can raise different legal and contractual concerns, especially when PHI is involved. An artificial intelligence healthcare lawyer can review the proposed arrangement and assess whether the AI training fits within the vendor’s permitted uses of PHI.
Can Vendors Combine Patient Data From Multiple Health Care Clients to Train AI?
Vendors should be particularly cautious about using identifiable patient data collected across multiple health care provider clients to train a general-purpose or commercially available AI model. A vendor generally cannot repurpose identifiable patient information from multiple clients to train an AI model for its own independent commercial benefit without an appropriate legal basis.
Business Associate Agreements, in addition to underlying service agreements, should also be reviewed carefully to establish exactly how this data can be used. If permitted under the applicable agreements, de-identifying the data might provide a path for vendors that want to create AI products beyond the services they already provide to individual health care clients.
Based on these considerations, it is clear that there are a variety of legal factors involved. Using patient data for AI training can become more complex when multiple health care clients and different agreements are involved.
As a result, vendors should consult with a trusted digital health attorney to fully understand their legal obligations and help protect patient information before using patient data for AI training.
Protect Patient Data When Training AI with Aaron Maguregui
The rules surrounding patient data and AI can change based on the organization, its contracts, and the intended use of the technology. If your organization is considering using patient data for AI, Aaron Maguregui is a trusted legal resource with valuable insight into this area.
Having served as Chair of the Privacy Committee for the American Telemedicine Association (ATA) and currently serving as Chair of the ATA Artificial Intelligence Committee, Aaron understands the evolving legal and privacy issues surrounding AI in health care.
For experienced legal guidance, speak with digital health attorney Aaron Maguregui for help understanding your organization’s obligations before using patient data to train, develop, or commercialize an AI product.
Get in touch with Aaron Maguregui today and schedule a 30 minute intro call to protect your organization and embrace the future with confidence.