As healthcare providers and their vendors develop and implement agentic artificial intelligence and other AI tools, they need to throughly understand data privacy risks under HIPAA and other laws, said attorney Jordan Cohen of law firm Akerman LLP.
“If you fall outside of a permissible use, then technically, if protected health information is involved, that can be considered a reportable breach,” he said in an interview with Information Security Media Group.
Many of the steps that covered organizations and other HIPAA-regulated firms should consider in their agentic AI implementations “are actually not AI specific,” he added.
“A data flow inventory is going to be really important. So, diagramming and accounting for how you’re ingesting data, processing it, storing it, how it’s leaving your systems, how vendors are touching it and what they’re doing to that data is going to be critical,” he said.
“These are practices that we’ve been discussing for years,” but in the age of agentic AI and other AI deployments, they are even more important, he said.
In this audio interview with Information Security Media Group (click audio link below photo), Cohen also discussed:
- The most common uses of agentic AI for clinical and administrative purposes in healthcare, and the types of PHI, electronic health record and other data frequently being used;
- Legal and regulatory issues to consider in the deployment of AI across multiple agencies, including the U.S. Food and Drug Administration, the Federal Trade Commission, potential updates to the HIPAA Security Rule and state privacy laws;
- Other critical AI issues to consider include technical safeguards, incident response monitoring, transparency and consent of patients;
- Opportunities for AI to improve data privacy and security in healthcare and other sectors.
Cohen, a partner at Akerman LLP and team leader of the firm’s digital health practice, advises clients on transactions involving healthcare providers and other healthcare-related platforms. That includes providing legal counsel related to federal and state privacy and data security matters, including compliance with HIPAA’s Privacy, Security and Breach Notification rules, as well as compliance with state breach notification laws. He also provides guidance on a broad range of healthcare regulatory matters, including compliance with fraud and abuse laws including the Anti-Kickback Statute and the Stark Law.