Regulatory framework around data privacy and security
When it comes to the regulatory framework around data privacy and security in the health sector, both the European Union’s General Data Protection Regulation (GDPR) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) apply to healthcare providers using AI for diagnostics and treatments involving personal data collection, use, or disclosure. Both laws mandate that organizations, including healthcare providers, must have legal authorization, often through informed consent, to handle personal information.
However, the GDPR explicitly addresses automated decision-making and its effects on individuals through Article 22, which grants individuals the right not to be subject to decisions based solely on automated processing if such decisions significantly impact them.
“Exceptions to this right include individual consent, contractual necessity, or specific laws, provided there are safeguards for the individual’s rights and interests,” Kerr, a healthcare and information governance, data privacy, and cybersecurity lawyer based in Vancouver, British Columbia, adds. “Additionally, Article 22 restricts automated decisions based on sensitive data, such as health information, unless authorized under specific GDPR provisions.”
Though PIPEDA lacks a similar provision on automated decision-making, Quebec’s Law 25 requires transparency and allows individuals to correct inaccurate personal information used in automated decisions. Organizations should also pay close attention to provincial and territorial health information management rules and corresponding health privacy legislation as they apply to the use of AI.
Mitigating risks associated with AI use in healthcare
There are many legal risks to consider when using AI in healthcare, including the potential for breach of human rights law, breach of privacy, intellectual property infringement, and misappropriation of personality, among others. The primary consideration, however, should be the clinical risk to the patient.