Latest / Statutes & Stethoscopes | Trial Lessons for Medical Injury Lawyers / Sidebar - Is Your AI HIPAA-Safe?

Transcript

Sidebar - Is Your AI HIPAA-Safe? · Statutes & Stethoscopes | Trial Lessons for Medical Injury Lawyers

• 0:03
  SPEAKER_00: This is that.
• 0:06
  SPEAKER_00: I'm Tracy Liberatory.
• 0:08
  SPEAKER_00: Every episode I take one place where medicine and the courtroom collide and break down what actually works.
• 0:14
  SPEAKER_00: You're a clinician who wants this work, or an attorney who needs an expert who can hold up.
• 0:19
  SPEAKER_00: You're in the right place.
• 0:20
  SPEAKER_00: Let's get into it.
• 0:25
  SPEAKER_00: Before we start, this one needs a date stamp.
• 0:28
  SPEAKER_00: I'm recording this on October of 2026.
• 0:31
  SPEAKER_00: AI tools change their plans and their privacy terms every few months, so check what I say here against the vendor's current terms before you rely on it.
• 0:39
  SPEAKER_00: In my master class the other night, I gave the group a tip.
• 0:43
  SPEAKER_00: Keep a file on your own past opinion so you never have to contradict yourself and use AI to search it.
• 0:49
  SPEAKER_00: Load your old reports in and ask it how you landed on an issue the last time.
• 0:53
  SPEAKER_00: I still think that's a great idea, but I left out one very important step and I want to fix that today.
• 0:58
  SPEAKER_00: Your reports are full of patient information: names, date of birth, admission dates, diagnosis, medications, the facility, the room number.
• 1:06
  SPEAKER_00: If you paste that into a free AI tool, you may have just handed protected health information to a company that has made no promises about what it does with it.
• 1:16
  SPEAKER_00: That's what today is about.
• 1:18
  SPEAKER_00: What HIPAA actually covers, what a business associate agreement is, which AI tools will sign one, and how to build that opinion file without putting a single patient at risk.
• 1:29
  SPEAKER_00: Let's start with HIPAA itself.
• 1:31
  SPEAKER_00: HIPAA applies to covered entities, meaning health care providers, health plans, and clearing houses, and to their business associates.
• 1:40
  SPEAKER_00: A business associate is anyone who handles protected health information on a covered entity's behalf.
• 1:46
  SPEAKER_00: So here's the question I get: if I'm an independent expert hired by a law firm, am I even covered by HIPAA?
• 1:52
  SPEAKER_00: Sometimes not directly, but that's the wrong question to stop at for three reasons.
• 1:58
  SPEAKER_00: First, the law firm may be a business associate.
• 2:01
  SPEAKER_00: When a firm defends a hospital or a nursing home, it often signs a business associate agreement with that client.
• 2:07
  SPEAKER_00: And the federal guidelines from HHS say that firm has to make sure the people it hires to help with the case, and that includes experts, agree to the same privacy restrictions.
• 2:18
  SPEAKER_00: So you can be bonded and bound by those rules through the attorney, even if you never signed anything with the hospital.
• 2:25
  SPEAKER_00: Second, protective orders.
• 2:27
  SPEAKER_00: In a lot of cases, the medical records come in under a court order.
• 2:31
  SPEAKER_00: A qualified protective order under IPA limits the use of those records to the lawsuit and requires them to be returned or destroyed when the case is over.
• 2:39
  SPEAKER_00: Putting them into an AI tool that keeps the data is not using them for the lawsuit, and you can't return or destroy what a vendor is holding.
• 2:47
  SPEAKER_00: Third, your license and your reputation.
• 2:49
  SPEAKER_00: You're a nurse or a physician or some sort of clinical provider.
• 2:53
  SPEAKER_00: Patient confidentiality was your duty long before you ever wrote a report.
• 2:58
  SPEAKER_00: An attorney is not going to hire the expert who leaked a patient's chart, no matter what the technical answer under a HIPAA turns out to be.
• 3:05
  SPEAKER_00: You don't want to be that provider.
• 3:07
  SPEAKER_00: So treat every set of records you receive as protected.
• 3:11
  SPEAKER_00: Period.
• 3:12
  SPEAKER_00: Now, the agreement.
• 3:13
  SPEAKER_00: A business associate agreement or BAA is a contract where the vendor agrees to protect the health information, use it only for the services you're paying for, and report a breach if one happens.
• 3:27
  SPEAKER_00: Without a BAA, an AI company has made you no such promise.
• 3:32
  SPEAKER_00: And here's what surprises people: the version of the AI tool you're probably using does not come with one.
• 3:38
  SPEAKER_00: As of this recording, OpenAI offers a BAA only on certain business products, like ChatGPT for healthcare, Enterprise with a regulated workspace, and the API with special retention settings.
• 3:53
  SPEAKER_00: Anthropic offers one for Claude only on its enterprise plan.
• 3:57
  SPEAKER_00: Their free pro, max, and team plans can't turn it on.
• 4:02
  SPEAKER_00: Google covers Gemini inside Google Workspace when the organization signs Google's BAA.
• 4:08
  SPEAKER_00: Notice the pattern.
• 4:10
  SPEAKER_00: The free and personal plans are not covered.
• 4:14
  SPEAKER_00: If you did not sign a BAA, you don't have one.
• 4:18
  SPEAKER_00: Even with a BAA, not every feature is covered.
• 4:23
  SPEAKER_00: Each vendor publishes a list of which features can touch health information and which can't.
• 4:29
  SPEAKER_00: Whoever sets up the account has to turn off the ones that aren't covered.
• 4:32
  SPEAKER_00: Now, let's talk about the other way to do this, which is to take the patient out of the document before the AI ever sees it.
• 4:40
  SPEAKER_00: HIPAA calls this de-identification.
• 4:43
  SPEAKER_00: The most common method is called safe harbor, and it lists 18 identifiers that have to come out.
• 4:49
  SPEAKER_00: Names are just the start.
• 4:51
  SPEAKER_00: It also includes every date tied to the patient except the year.
• 4:56
  SPEAKER_00: So birth date, admission date, discharge date, and date of death, street address, city, country, and most of the zip code.
• 5:04
  SPEAKER_00: Phone numbers, email, medical record numbers, insurance numbers, account numbers, photos of the face, any age over 89, and any other number or detail that could point back to that one person.
• 5:17
  SPEAKER_00: Think about what that means for an expert report.
• 5:20
  SPEAKER_00: Your report is built on a timeline.
• 5:23
  SPEAKER_00: Dates and times are the backbone of it.
• 5:26
  SPEAKER_00: So redacting the name and leaving the rest does not de-identify the report.
• 5:30
  SPEAKER_00: Here's what I recommend instead for the opinion file.
• 5:33
  SPEAKER_00: Don't load whole reports.
• 5:35
  SPEAKER_00: Pull out just the opinion, the clinical issue, the standard you applied, and what you concluded.
• 5:41
  SPEAKER_00: For example, stage two pressure injury, long-term care resident turning and repositioning.
• 5:46
  SPEAKER_00: My opinion is every two hours with these sources.
• 5:49
  SPEAKER_00: No patient, no facility, no dates, no case name.
• 5:52
  SPEAKER_00: That's what you actually need to stay consistent.
• 5:54
  SPEAKER_00: And it's what opposing counsel will compare you against anyway.
• 5:57
  SPEAKER_00: Then take the facility and the case caption out too.
• 6:01
  SPEAKER_00: A facility name isn't always health information, but it can point straight to the patient and it's not yours to share.
• 6:07
  SPEAKER_00: So before you put any case material into any AI tool, run through this.
• 6:13
  SPEAKER_00: One, ask the retaining attorney.
• 6:15
  SPEAKER_00: Some firms don't allow it at all, and some have their own approved tools.
• 6:20
  SPEAKER_00: Get the answer in writing.
• 6:22
  SPEAKER_00: Two, check for a protective order and follow it.
• 6:26
  SPEAKER_00: Three, if the tool will see real records, it has to be a business version with a signed BAA set up so only the covered features are on.
• 6:36
  SPEAKER_00: And I can tell you that some of the tools that you will use, especially the data and record storage ones in particular, are two and three times as much just to have this service, and then other features within their products are not available to you.
• 6:51
  SPEAKER_00: Number four, if you're on a free or personal plan, nothing identifiable goes in, strip it down to the opinion.
• 6:58
  SPEAKER_00: Five, remember that anything you type may be asked about later.
• 7:03
  SPEAKER_00: Courts are starting to ask experts what they put into AI and what it gave back.
• 7:08
  SPEAKER_00: So keep your prompts as clean as your reports.
• 7:11
  SPEAKER_00: The opinion file is still one of the best habits you can build, so keep your opinions and leave the patients out of it.
• 7:18
  SPEAKER_00: One more time on the date.
• 7:26
  SPEAKER_00: So they may be different by the time you hear this.
• 7:29
  SPEAKER_00: This is educational information, not legal advice.
• 7:32
  SPEAKER_00: HIPAA questions and protective orders vary by case, so check the vendor's current terms and check with the retaining attorney before you put anything from a case into an AI tool.
• 7:43
  SPEAKER_00: This episode of Statutes and Stephenscopes.
• 7:46
  SPEAKER_00: If it was useful, follow the show so the next one finds you.
• 7:49
  SPEAKER_00: And if you're a clinician who wants to do this work properly, start with the Expert Report Starter Code at National Expertacademy.com.
• 7:57
  SPEAKER_00: I'm Tracy Librettor.
• 7:58
  SPEAKER_00: I'll see you on the next episode.