Privacy Please: HIPAA and Artificial Intelligence – Part 2 Artificial Intelligence Law Advisor

With the wide‑spread implementation of electronic health records (EHRs) and the tremendous amount of electronic information being created and collected, the health care industry is a new (or not quite-so-new) frontier for Artificial Intelligence (AI). AI is finding its way onto physicians' desks to provide information about drug interactions, and in to EHRs to pull-up requested patient records, and wearables used by health plans to track health care metrics, promote wellness and address chronic conditions. But, health care is heavily regulated – and Part 1 of this blog we explained how using AI applications and systems like those noted above may trigger a multitude of requirements for AI developers, health care providers, and health plans. An important law that may affect AI in the health care setting is the Health Insurance Portability and Accountability Act and its implementing regulations (HIPAA), the federal law establishing a floor for privacy, security, and breach notification related to most health information. A critical threshold question is at what point does an AI vendor become subject to HIPAA?