As healthcare providers and their vendors progress in the development and implementation of agentic artificial intelligence (AI) and other AI technologies, they must thoroughly comprehend the data privacy risks in relation to HIPAA and other legal frameworks. Attorney Jordan Cohen of the law firm Akerman LLP emphasized the importance of this understanding. He highlighted that if AI applications deviate from permissible uses, they could potentially lead to reportable breaches, especially involving protected health information (PHI), as discussed in his interview with Information Security Media Group.
Cohen pointed out that many of the precautions that organizations and firms regulated by HIPAA should take when implementing agentic AI are not unique to AI itself. He stressed the necessity of maintaining a comprehensive data flow inventory. This inventory involves carefully mapping out how data is ingested, processed, stored, and transmitted, including interactions with vendors and their handling of this data. Such practices have been long-standing, but their importance has been magnified in the era of agentic AI and similar technologies.
During an audio interview with Information Security Media Group, Cohen delved into several key areas. He discussed the prevalent applications of agentic AI in healthcare, both for clinical and administrative purposes, and the types of data, including PHI and electronic health records, often utilized. He also addressed the legal and regulatory challenges in deploying AI across various agencies, highlighting potential updates to HIPAA’s Security Rule and state privacy laws.
Furthermore, Cohen underscored other critical AI considerations, such as implementing technical safeguards, ensuring incident response monitoring, and fostering transparency and patient consent. He noted the potential for AI to enhance data privacy and security within healthcare and other sectors, presenting new opportunities for improvement and innovation.
As a partner at Akerman LLP and leader of the firm’s digital health practice, Cohen provides legal counsel to clients involved in healthcare transactions and platforms. His expertise spans federal and state privacy and data security compliance, including adherence to HIPAA’s Privacy, Security, and Breach Notification rules, as well as state breach notification laws. Additionally, Cohen offers guidance on various healthcare regulatory matters, including compliance with fraud and abuse laws like the Anti-Kickback Statute and the Stark Law.
