Why privacy and artificial intelligence still need some harmonization
Headlines proclaiming the next great application of artificial intelligence appear with a great degree of frequency. As much that is true generally, healthcare seems to receive potentially an even greater amount of such announcements.
Determining the validity behind the assertions about artificial intelligence can be difficult. There will be truthful claims and others that do not live up to the hype. The arguably more interesting question is what artificial intelligence, including both the development and use, is doing to privacy.
Artificial intelligence systems require large volumes of data to be developed, trained and constantly refined. Where do the data come from? If talking about healthcare, the data must be about patients, which means sensitive, regulated information must be ingested, utilized and held. Given the use of healthcare information, HIPAA has the most obvious impact since, because HIPAA governs the use and disclosure of patient information.
If patient information is necessary for artificial intelligence, what challenges to privacy does artificial intelligence present? Some of the leading issues include potentially making de-identification impossible, algorithmic bias and patient safety or treatment errors.
The arguable inability to de-identify data is one of the biggest concerns. The basis of the concern is that artificial intelligence systems will pull data points from so many different sources that even when all identifiers required by the HIPAA de-identification standard are removed, individuals can still be identified. If artificial intelligence makes de-identification impossible, then those systems could remove the ability under HIPAA to obtain and retain the data needed on some level for the development and maintenance of the systems.
A second privacy concern is algorithmic bias. The basis of this concern is that the artificial intelligence system is either including data sources that introduce or push inappropriate decisions or the individuals training the artificial intelligence are biased. Either way, the introduction of bias could intrude upon an individual’s privacy by needing to obtain more information from more sources or driving unnecessary interventions.
Embedding such risks into a system may not be easily rectified either if the basis for the issue cannot be uncovered. Considering from the loss of privacy angle, an argument to remove bias based on poorly sourced data is to draw in more data from an increasingly diverse array of sources. If that occurs, then where would the stopping point be?
An argument could always be made to pull in more and more data, but feeding all of the data into a system could produce unknown, unintended and other unforeseen effects. At the same time, not getting data from a deficient scope of sources may not enable a system to adequately address the needs of a diverse population that could use the systems. As such, the very real potential for bias can encourage design that does not give privacy sufficient due because privacy could hinder the ability to gather enough data to reduce bias.
The last (for now) privacy concern about artificial intelligence is declining trust from patients. If a patient knows that information will be fed into an artificial intelligence system and stored in some unknown number of places, could the patient withhold information? If information is withheld, what will that information be and how critical could it be to determining an appropriate course of treatment or action?
Concerns about maintaining privacy in technology are not unfounded, especially given some debate as to whether privacy (at least traditional concepts of it) still exists.
