•  
  •  
 

Keywords

artificial intelligence; privacy law; health insurance portability and accountability act; fiduciary duty; data privacy; data subjects; consent

Abstract

In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA) to establish standards for transmitting health information. For decades, the HIPAA Privacy Rule has operated as the primary regulation protecting health information in the United States. However, in the decades since HIPAA was enacted, new technologies have demonstrated the shortcomings of the Privacy Rule. In particular, the development of healthcare artificial intelligence (AI) has created new privacy concerns and exacerbated existing ones. This Note examines the current healthcare privacy framework in the United States and considers how healthcare AI complicates it. This Note also explores how AI developers need access to sensitive health information to build healthcare AI. To protect private health information while promoting AI development, this Note proposes a novel solution: impose a fiduciary duty on healthcare AI developers. Fiduciary relationships exist when one party has control over the other’s affairs, like in doctor-patient or lawyer-client relationships. Instead of relying on consent, a fiduciary must act in the other party’s best interest. Furthermore, imposing a fiduciary duty does not require the time or resources needed to create a new regulatory scheme. Ultimately, by requiring healthcare AI developers to act in the best interests of data subjects, fiduciary duties reinforce privacy protections without stifling access to data that is essential for AI development.

Download

Share

COinS