The basics of data privacy and security in AI tools

Existing regulatory policies

In post-acute care, data is mainly regulated by HIPAA, which uses thorough and time-tested rules about what constitutes private health information, who has access to data, and when data can be shared. These regulations apply whether data is stored on-premises or in the cloud.

HIPAA defines more than a dozen different aspects of data that are considered identifiable—that is, information that can be tied back to a specific person. Those pieces of data need to use a level of higher encryption to help ensure privacy. But HIPAA also has identified specific aspects of data, through their Safe Harbor rules that can be removed so data is safe to use for purposes such as medical research.

This de-identified data is what should be used to train artificial intelligence models and algorithms. Once the body of data is large enough, the model trains on it, learning different patterns it can identify to successfully complete a task. A good example that we’ve talked about before is predicting resident falls. When there’s a lot of data about patients and their outcomes, and there’s a fall in the history, you can feed the information into an AI model and it will identify patterns of events that occurred leading up to a fall.

By sifting through millions of records to find the combinations of different factors that can lead to a fall, AI builds what we commonly refer to as a “model.” And once it learns the pattern, it no longer stores the data it sifted through. This is important because there’s a common misconception that AI tools hold on to everyone’s data, putting it at risk for being compromised.

But that’s not how AI works. Once it learns from a de-identified set of information, it does not retain the information. Once the tool has been tested on its new learning, a clinical team can feed it new information about a specific patient. Then, using the pattern, the model will calculate a score for that patient. The score is what provides value and insights to the end user.

In addition, most concerns about AI data being auditable are unfounded. AI tools are typically separate from your main EHR software, which means any AI-generated scores or recommendations are not considered clinical documentation without validation from a caregiver.