Latest / Technically Sound Strategy / Episode 50 - AI and HIPAA Compliance With Steve Goulet

Transcript

Episode 50 - AI and HIPAA Compliance With Steve Goulet · Technically Sound Strategy

0:01
Welcome back to Legal Marketing Radio.
0:03
Today we're talking about AI and HIPAA compliance.
0:07
One of the biggest tension points in regulated industries.
0:09
Right now.
0:11
Joining me is Steve Goulet, a healthcare technology executive.
0:13
With over 20 years of experience leading digital health transformations
0:17
and building AI systems at scale, we're getting into what firms need
0:22
to understand about risk governance and how to actually use AI without
0:26
creating compliance problems.
0:29
Let's dive in.
0:34
Steve, it is great to have you on the show here.
0:36
We've been working together for a little while now, and I've really
0:39
enjoyed getting to have a window into the way that you think and the way
0:44
that you approach AI building tools.
0:47
You've introduced me to some new technologies that I've found really
0:50
exciting that I'm still learning especially around the Lang.
0:54
Bucket and category.
0:57
But I've really enjoyed our conversations.
0:58
The things that you've exposed me to, gets me thinking about how we build new things.
1:02
But I know in your role you have to deal with a lot of compliance.
1:06
And I think for the folks that tend to listen to our podcast,
1:11
it's an area they're dealing with and trying to figure out as well.
1:13
So marrying AI and trying to navigate the complexity of the world of compliance.
1:21
It's something that, obviously there's a lot of challenges there.
1:24
We wanna stay at the front of the pack in terms of technology.
1:27
So if you don't mind just give us a quick, give us some insight into
1:32
a little bit of your background and and how you're approaching,
1:36
how you're approaching that topic.
1:39
Thanks, chip.
1:39
Will do.
1:40
I'm glad to be here.
1:42
And yes, Avi is at the center.
1:46
Of the the meeting between AI and compliance.
1:50
We do a lot of work and I lead the teams.
1:55
That do work with AI and healthcare, mental healthcare related work.
2:01
Some of the guiding principles that we follow are that for one
2:07
thing, AI should never be used to do the work of a clinician that
2:15
involves making a medical decision.
2:20
You may find that various chat clients that you use like chat, GPT
2:25
or Claude, seem to cross that line sometimes, but what's become very
2:31
clear is that the regulatory landscape in healthcare is not on the same page
2:39
and that folks like us that deliver.
2:43
Solutions that are customer facing, patient facing, we need to be very
2:49
careful not to cross that line.
2:51
So very interested in talking through that with you and digging
2:56
deeper into those details.
2:59
Again I lead a product team, a tech team, a analytics team, and
3:06
let's see, who else An IT team.
3:08
And each of those teams we touch ai, we use.
3:12
Operational ai, things like cloud and chat, GBT On the clinical side, we have
3:20
ambient listening, listening scribes that use our are integrated into our EHR.
3:27
And that our listening to patient clinician interactions and then
3:33
taking notes on those interactions.
3:36
We have a support bot, custom AI that we wrote and delivered ourselves
3:44
that handles our public website, our Zendesk support portal, our patient
3:51
portal, etc. And that AI does a ton of heavy lifting in terms of helping our
3:58
patients navigate our systems, so it's supporting their journey basically.
4:05
And then we also do quite a bit of integrations on the operational
4:11
side with other systems.
4:13
We, it took us a while to get there but we have an enterprise agreement
4:18
now with Anthropic, so we're in a good place where we have a, BAA with
4:22
them and we're able to use that.
4:25
BAA to leverage connectivity between Claude and other systems.
4:30
So whole bunch of talk about really looking forward to it.
4:33
Thanks for having me.
4:35
That's cool.
4:35
And that's, it raises a really good point.
4:38
And I think our perspective always comes into the picture because when I think
4:41
of Avi and having known a lot of folks there for some time, I always think
4:45
of AVI as an AI forward organization.
4:48
And a lot of the clients that we work with, especially on the legal
4:50
side their heart and soul is the work that they do, as attorneys and
4:55
as professional service providers.
4:58
And I think you, you thread that needle really well.
5:02
In using a suite of tools to help get that job done and make the people who
5:10
are doing that job more effective without those tools actually doing the job.
5:16
Exactly.
5:17
And
5:18
that's the trick.
5:19
Yep.
5:20
Yeah.
5:21
And that's Interesting.
5:21
It, the way you say it, it almost sounds like you're surrounding the, you're
5:25
surrounding the service providers, you're surrounding the clinicians.
5:29
With all the tools that they need to effectively do their job, but the
5:34
clinician is needed to do the job.
5:37
Exactly.
5:38
You use the key word that I try to emphasize when discussing
5:43
this, it's the word tool.
5:45
And the other phrase that comes to mind a lot is human in the loop, right?
5:50
So we want to use AI as a tool, and we always want to have a human in the loop.
5:57
If that tool is going to encroach.
6:01
On that line between decision making or tool, right?
6:08
So is if the AI is gonna make a clinical decision, that's when
6:13
we know we've gone too far.
6:15
Now, can it make a recommendation?
6:18
Have that recommendation be vetted by a clinician.
6:21
Absolutely.
6:23
That's the key, right?
6:24
You can't cross that line into an independent AI that might be, and
6:31
of course, hallucinations happen, hopefully less and less, although
6:34
there's been some recent research that they probably will never go away.
6:39
But happening less and less, but still.
6:42
Until we can say there's never hallucination, folks like the
6:46
FDA and other regulators are never gonna say, okay, just let
6:50
your ai make clinical decisions.
6:52
It's good.
6:53
It might make a mistake, but that's okay.
6:55
Heck no.
6:56
That's not gonna happen.
6:58
Yeah, that's exactly it.
7:00
That makes sense.
7:01
So how Did you get started down this path?
7:03
, What were your first couple of steps.
7:05
That's a big undertaking, right?
7:07
Absolutely.
7:08
So we earned our stripes early on by creating a AI infrastructure
7:15
internally that we could use to implement safe and compliant AI systems.
7:23
So the first thing we envisioned was if we're going to build AI patient facing ai.
7:30
We need to monitor it very carefully.
7:33
You mentioned the laying stack and for our listeners who haven't heard of
7:38
that, it's also known as Laying Chain.
7:41
And early on we identified a number of tools in that stack that we could
7:46
use for observability and monitoring.
7:50
'cause when you implement AI and you deliver it to anyone in a
7:55
regulatory regulated environment.
7:58
You need to make absolutely sure that it's auditable and observable and can
8:04
be maintained and adjusted according to any sort of findings that result from
8:11
that auditing and observing activity.
8:14
We're using one of the Lang tools.
8:18
It's actually not part of the Lang chain stack.
8:21
It's another one.
8:22
Called Laying Fuse.
8:24
But that thing is very powerful and we can see every single
8:28
conversation, every single response.
8:32
We can trace every step that the AI system takes.
8:36
It's a complicated application.
8:38
We use it.
8:39
I mentioned Human in the Loop a minute ago.
8:42
Our AI support system allows users.
8:47
To ask for help from our support team, the human beings on our support team.
8:53
So if the AI conversation brings our, one of our users in one of those chats
8:59
to a point where they're like, okay, I just, I need to talk to somebody.
9:03
They can ask, talk to a human.
9:05
We make that absolutely clear from the beginning of the chat.
9:09
We also remind them that, we have regulatory rules in place and that.
9:15
You, we, you have to make it absolutely clear that they're
9:17
talking to an AI when they are.
9:20
And then when we hand back and forth between the AI bot and the human
9:26
who can jump in and help with the conversation, we have to make it clear
9:31
who's who they're talking to as well.
9:34
All of those steps.
9:36
Are critical to maintaining a safe and compliant workflow for your ai.
9:42
So we built our base tech stack, AI tech stack around those assumptions, right?
9:50
We need observability and we also did not want to use third party vendors.
9:57
If at all possible.
9:58
Why?
9:59
Because the more data, if you're collecting, say you're collecting
10:04
chat transcripts between patients and your ai, that's PHI and the more
10:11
PHI we collect and spread around the earth through third party vendors and.
10:18
SaaS systems the worst we are in terms of exposure.
10:23
So we don't wanna expose anything to anyone if we don't have to.
10:27
And so early on we're like, okay, how can we do this?
10:31
How can we build this AI infrastructure so that it's just
10:34
our data and no one else can see it?
10:37
And that's what we did.
10:38
That's why we used an open source stack.
10:41
We hosted all on our own infrastructure.
10:46
We use tools.
10:49
Sure, they may have been developed by a third party, but they are now ours.
10:54
We have, we own them.
10:56
We maintain them, we update them, we review the code.
11:00
Everything is centered in our systems and no one outside of AVI can see
11:07
that data or change those systems.
11:11
We are, constraining that so that all of our AI interactions result
11:19
in data that's private to avi.
11:23
So we're very proud of that infrastructure.
11:26
That said, not everything we do, obviously involving AI is built in that
11:32
infrastructure, but that's given us a really strong foundation from which.
11:37
To weigh other options against and to measure other options, right?
11:43
So as we approach, say, a vendor that does ambient scribe listening in our electronic
11:51
medical record for instance, we have clinicians who are speaking with patients.
11:57
We didn't build that tech, so we are in fact using.
12:01
A third party for that tech.
12:03
But as we navigated those waters, we're like, okay, we know.
12:08
We know what you're gonna have to do.
12:10
You're gonna have to trace it.
12:12
You're gonna have to store the data.
12:14
You're gonna have to, enable auditing.
12:17
It's gotta be HIPAA compliant, we need a BAA, etc. All those pieces have to
12:22
be in place and by building our own.
12:25
Version of this.
12:26
First, we really learned a lot about how to extend our compliance and safety
12:34
through to our vendors and require them to follow the same procedures.
12:39
That's really valuable.
12:40
I think that, as we look forward, policy frameworks and systems are
12:46
gonna be, become more, they're gonna become increasingly important.
12:51
And building out that framework and that clear understanding across the
12:56
organization because organizations grow and change and they're still
13:00
made up of people who forget what the SOP said in the first place.
13:05
Having that framework and that clear accountability makes a lot of sense.
13:09
You covered a lot of ground there, but I just wanna, I wanna
13:12
pull back to the audit ability.
13:16
And, it's something that I think we take for granted if we have good IT
13:21
support or if we have a good IT vendor or somebody that we work with or someone
13:26
on our team, for the organizations that we speak to, oftentimes, they, they
13:30
may outsource their it, but they still feel confident that they have logs.
13:35
AI presents a new and unique challenge because those logs
13:38
can become huge very quickly.
13:41
And there is some lack of transparency around what gets saved on the AI side.
13:49
If you were, if you can put yourself in the position of, being in a smaller
13:55
organization, how would you approach that observability and data retention around?
14:04
Around that observability piece.
14:07
Absolutely, yes.
14:08
So of course it depends on the tech stack,
14:11
right?
14:11
You choose to use or, and, or the vendor.
14:15
Yeah.
14:16
Slash SaaS software as a service.
14:19
Product you choose, but you just need to make sure upfront that there's a plan to
14:24
track and observe every single interaction
14:29
With your ai and whether that be an open source platform like Lang
14:34
Fuse that we're using the Lang chain stack has one called Lang Smith.
14:39
That is also extremely effective.
14:42
Each vendor, each SaaS product has to have, if it's gonna, if they're
14:47
gonna sign a, BAA or b SOC two compliant, they have to have that
14:52
observability and audibility built in.
14:55
And so it's just a matter of you requiring, as the owner of the system
15:01
you have to require that be available.
15:05
To your team, and that's, that was key for us.
15:08
Like we were using chat GPT early on.
15:11
Our, you mentioned our leadership is very AI centric and AI forward.
15:17
They're also very AI careful and AI safe.
15:20
So I should clarify that, but.
15:23
Early on we're like, yeah, chat GPT, let's get a corporate team account.
15:27
And that was good for a while until it dawned on me that we did not
15:32
have auditability or observability.
15:35
In that agreement, the team account in chat, GPT does
15:39
not give you that capability.
15:41
Yeah.
15:41
So we explored, okay, we need an enterprise agreement with somebody.
15:46
And chat GPT's enterprise agreement through OpenAI was gonna cost us.
15:51
A huge amount of money.
15:53
Then we looked at Claude and we also like Claude for other reasons, and
15:57
we're like, okay, we can do this.
15:59
Reasonable price.
16:01
Enterprise got audibility.
16:03
It's got all the enterprise controls, of course, the
16:06
observability, everything we needed.
16:08
So then from an operational standpoint, it was a clear no-brainer to convert
16:15
all of our chat GBT accounts over to Claude Enterprise and now we are there.
16:21
We have that observability and I sleep a lot better at night knowing that's true.
16:25
So that's one way you can think about it is operationally.
16:30
But then, if you're building custom ai, that's a whole different can of worms.
16:34
Yeah.
16:35
Yeah.
16:35
You really need to attack it from, you are responsible for everything
16:41
and you absolutely need to.
16:44
Test carefully.
16:46
Another advantage of using a tool like Lang use or Lang Smith is
16:51
that you can create a database of prompts that you can use for testing.
16:58
We have thousands of them.
16:59
Yeah.
17:00
And so we build our system, and then we test it against those prompts.
17:06
And the prompts are like, prompt injection.
17:09
Things, which you can get libraries of those, you can ask your AI to help
17:13
you create prompts to test itself.
17:16
That's a really good way to go.
17:18
But you also need to talk to your business users and hopefully even your actual
17:23
users, which we call patients on our side, and just ask them, what do you,
17:28
what are the questions you're asking?
17:30
Yeah.
17:30
Of an AI that does this.
17:33
And also then you can observe what questions are being asked
17:36
and you can find the ones that might get answered incorrectly.
17:41
Or worst case things that might violate the guardrails you have in place.
17:47
And so that, by the way the guardrail piece is the other
17:52
very important component to this.
17:55
We have implemented guardrails in our custom ai of course, and of
18:01
course, anthropic and other AI vendors include guardrails in their LLMs.
18:08
But those are not enough when you're dealing in regulatory spaces like
18:13
Yeah.
18:14
Healthcare, and so we have special guardrails in place
18:18
to make sure we never collect.
18:20
PHI when, unless we're, using a system that's meant to
18:26
collect PHI, of course, right?
18:27
But those guardrails need to be configured early and tested, and
18:32
then going back to that database of prompts, that's the secret sauce right
18:36
there that becomes your ip, right?
18:39
Because you need to know, okay, what's the universe of questions?
18:44
And you're not gonna catch everything, of course.
18:47
But what's the universe of questions that might get asked
18:50
In this domain?
18:51
And then have hopefully hundreds, thousands of those
18:56
questions in a database.
18:58
And then you can use a tool like Lang Fuse or Lang Smith to run through
19:03
those questions and automate them.
19:06
And then record, of course, the responses.
19:10
Using Lang Fuse or Lang Smith.
19:13
And then once you've got them recorded again, you can use AI to help you
19:17
point your LLM at those responses and say, okay, which of these don't
19:22
look right, which are incorrect?
19:24
Let's log, let's flag those.
19:27
We also use a human for that.
19:29
Of course.
19:30
Yeah.
19:30
Yeah.
19:30
We have a QA testing team.
19:32
And they, so we get the visual human review of those responses too,
19:37
and then you adjust your dataset.
19:40
So that you might find some additional questions user questions that need
19:46
to be added to your list of prompts, and then you run it again, and then
19:49
you make a change to your system.
19:52
You need to run your dataset test again.
19:55
Yeah.
19:55
And it's just, you have to be very thorough.
19:58
You have to think of what's the worst case?
20:01
Yeah,
20:02
that could happen.
20:02
Imagine it, document it.
20:06
Create a data set that can test it and then run it every
20:10
time you update your system.
20:12
Yeah.
20:12
It's
20:12
a lot of work.
20:13
Now, you covered a couple things that I think would be particularly interesting
20:16
to this audience, which in general tends to focus on liability, right?
20:20
There's protecting their own business and their own practice, but then there's
20:24
also the application of liability to whoever the party is that violates right.
20:29
You covered a little bit of prompt engineering and then testing or
20:33
prompt injection and testing.
20:34
So talk to me a little bit about that.
20:36
I think that might be a, kinda a new concept to some of the folks here.
20:40
So what is prompt injection?
20:42
What type of risk does that introduce?
20:46
Again, if you're using one of the Frontier Gen AI lms, and by that
20:52
chat, GPT Gemini, Claude, they've got guardrails built in to prevent.
20:59
Prompt injection from taking its toll, but generally what a prompt
21:05
injection scenario looks is that a hacker thinks of a question that it
21:11
can ask your LLM that will cause it.
21:14
To break out of its rules that you've implemented and then go rogue, right?
21:21
And that's the last thing you wanna have happen, of course.
21:24
So you could do one of two things.
21:26
Trust that Claude or whoever it is have that their guardrails are good
21:32
enough and that you're not gonna get a jailbreak event resulting
21:37
from some sort of prompt injection.
21:41
Or do what we do, test the heck out of it.
21:44
Find a library online.
21:45
There's hundreds of libraries of prompt injection attacks.
21:50
Download that library.
21:52
Create a database.
21:53
Use a system like Lang Fuse or Laying Chain, or I'm sorry, Lang Smith.
21:59
There's too many out there.
22:01
Use one of those systems to automate the testing to make sure that your.
22:08
LLM is not going to respond to those prompt injections because if
22:12
it does, you've got a huge problem.
22:15
And that's where PHI can get leaked.
22:17
That's where other huge safety issues may arise.
22:21
Yeah, it'll be interesting.
22:22
I have to imagine we'll start to see some volume of mass torts come
22:28
down the pipeline as organizations are rolling out large systems.
22:33
I mean there was a funny one that rolled out the other day around Chipotle, right?
22:36
Their support, I dunno if you saw this, but their support bot on their website was
22:42
answering all sorts of questions, right?
22:45
So people were giving it code and saying, help me di help me debug my code.
22:49
And it was doing it right because they just were using, and so
22:52
they were just reusing I think one of the flagship models.
22:56
But then they hadn't tightened it down for their own specific use case, you know?
23:01
So.
23:02
exactly.
23:02
So even though they were using a model that has guardrails built in, wasn't gonna
23:06
let it do anything particularly dangerous.
23:08
Dangerous can also mean spending all your money on tokens, right?
23:12
Absolutely.
23:13
Yep.
23:14
That's a very real problem.
23:16
I'm sure they paid the price.
23:18
I did read about that.
23:19
That was interesting.
23:21
One of the keys to developing a good safe LLM system in addition
23:27
to having guardrails and tracing.
23:30
It's the system prompt, right?
23:32
Yeah.
23:32
So every LLM has a system prompt built in, but if you build custom
23:39
functionality on top of an LLM using a stack like Lang Chain, Lang
23:45
Graph, Lang Smith, Lang Fuse those.
23:48
tech stacks enable you to add your own system prompts.
23:52
So that's what we've done.
23:53
We've got a support bot and it has a probably 10 to 20 page, I
24:02
forget it's growing all the time.
24:04
20 pages worth of directives that we have curated.
24:08
Yeah.
24:08
In length.
24:09
Fuse and the support bot will not respond to anything.
24:15
Before it reviews those directives that are in the system prompt.
24:21
And so that's typically marked down or whatever.
24:24
Yeah,
24:24
just simple text.
24:26
But there's a lot of if then statements, which is a programmer thing, but
24:32
basically if the user asks this question always respond like this.
24:38
Yeah.
24:38
And if the word, whatever, cancer is mentioned, always respond like this.
24:45
So you've got those rules built in and that's part of what this
24:49
database of prompts that you wanna maintain yourself for testing, that's
24:56
part of what that needs to test.
24:58
Yep.
24:59
Because that can get really complicated.
25:01
I just mentioned 10 to 20 pages of system, prompt directives.
25:05
And how do they interact with each other,
25:08
right?
25:08
What if one is related to the other?
25:10
Which one is it gonna pick?
25:12
You don't know that until you test it, right?
25:14
And you don't wanna wait and see what happens when it's out in the wild.
25:19
You need to test it before you release it.
25:21
So you definitely need to follow.
25:23
What we in the, software dev world call development operations, DevOps for short,
25:31
you need to follow those best practices.
25:33
You need to, yeah, develop in one environment, test in another, and
25:38
then deploy after you're thoroughly convince that you're testing has
25:44
proven that your application is safe.
25:47
Yeah.
25:47
That's one of the biggest challenges that, it strikes me is, it used to
25:51
be that you could test software.
25:54
You hand it out to users and let them try to break it, but you still were
25:58
in a rules-based system and now you introduce one, out of many, right?
26:02
You start with one, but then you have all source.
26:04
You have unpredictable outputs.
26:06
Because you can have one prompt, and that one prompt can produce
26:12
an infinite number of responses.
26:14
And that's Such a new challenge on the development side where it historically
26:20
has been one prompt is going to get a response, based on the variables
26:26
that you have entered in the system.
26:27
And we're not living in that world anymore.
26:29
So that's a big change.
26:30
Great point, chip.
26:31
It's a whole new world knowing that the programmatic model is gone, right?
26:39
Yeah.
26:39
There's not a step by step.
26:43
Expectation to this software.
26:46
It is driven by, a neural network that we don't fully understand.
26:54
And because of that, you, it's unpredictable and
26:58
because it's unpredictable, you have to test it way more.
27:03
We
27:03
do, unfortunately, than you would a regular software
27:07
application that's simply.
27:09
Constrained by the limits of the software that wrote was written to make it work.
27:16
That's the observability piece again, right?
27:17
And like with the frontier models, we simply have a limited
27:21
vis visibility and observability by the nature of the product.
27:26
Exactly.
27:26
So I think that will be interesting to see where that evolves.
27:29
I'm sure there will be some ongoing litigation to get
27:32
that figured out as well.
27:34
As these things create problems, getting them litigated and figured out is gonna
27:39
be an interesting part of the solution.
27:42
Absolutely.
27:43
And the way we look at it is we don't wanna be on the cutting
27:46
edge of that li litigation, right?
27:49
As a small company, we have to stay far away from that.
27:52
We don't have hundreds of millions of dollars lined up in
27:56
the bank to defend ourselves.
27:59
Not that we would want to anyways.
28:01
We don't wanna risk patient safety, not only to reduce our financial
28:06
risk, but also just because we wanna do the right thing for our patients.
28:10
Of course.
28:11
And so let chat GPT, launch Chat, GPT, or chat, GPT Health, whatever it's called.
28:18
Let them launch that.
28:19
Let them, struggle to make sure it's effective and let them then.
28:24
Find out if they do the hard way that it may have done some very bad things.
28:31
Of course.
28:32
Will it do some very good things?
28:33
Absolutely.
28:35
And that's why we want to stand by and see how that works out and
28:40
not be involved in the potential risk of a, hurting a patient or B
28:47
Losing a huge lawsuit.
28:50
Or just getting tied up in a lawsuit.
28:52
Yeah.
28:52
We are taking the cautious approach and I strongly advise those of
28:58
our listeners who, or, you know, counsel who are advising small
29:04
businesses, take a similar approach.
29:06
There's no reason to risk the farm on AI that may cross that line.
29:14
Now, anybody who does is likely gonna face consequences.
29:19
Just the state regulations alone are extremely complicated, right?
29:23
So especially yes.
29:25
Especially if
29:25
you're operating more than one state.
29:28
Exactly.
29:28
Yeah.
29:28
Yeah.
29:28
And we are, we're operating 50, so we have to be extremely
29:32
careful and keep a close eye.
29:35
And of course, AI is your front again.
29:37
We have to keep a close eye on all the regulations and make
29:41
sure that we don't misstep.
29:43
Right now we're looking at using a digital human avatar.
29:49
As a new user interface, you would call it.
29:54
In other words, a new way to interact with AI on our public facing websites.
30:00
And then we are also entertaining even the possibility of doing
30:04
that inside of our patient portal.
30:07
But those.
30:08
Capabilities introduce even more regulatory risks.
30:13
So of course we're working closely with our attorneys proactively, not
30:18
when it's too late, but proactively to make sure that whatever state
30:24
we launch, this digital human.
30:27
AI avatar in that is basically looks exactly like a human being talks to
30:33
you on the screen in real time and introduces you to the services we provide.
30:39
We have a very complicated patient journey at avi.
30:43
Yeah.
30:43
And a lot of the folks that.
30:44
Come to avi.com and review what's possible.
30:49
Really need a little extra help.
30:51
And so the idea is we wanna offer this digital human and just let
30:56
you talk to her and ask her, what am I supposed to do next?
31:01
What?
31:01
What if this happens?
31:02
Do you.
31:03
Prescribed medications or not, and all those kind of things that they
31:08
couldn't like necessarily figure out just by looking at the text on our
31:12
website, they could now talk to someone.
31:15
And that's someone Yes.
31:17
Is AI in the back?
31:18
It's connected to an LLM in the background.
31:21
But of course we can't risk violating regulatory rules when we implement that.
31:29
So our proactive strategy is.
31:32
We're gonna go to the state we wanna launch it in, and we're
31:36
gonna say, here's what we wanna do.
31:38
What do you think?
31:39
Here's our policy, here's the plan.
31:42
Here's a sample of what it looks like.
31:45
Please let us know if you have concerns.
31:48
And we're gonna pick the states.
31:49
We do that in wisely.
31:51
Yeah.
31:51
We want to go to states that are of course, more likely to give
31:56
us quick and honest feedback.
31:58
Yeah.
31:58
No, that makes sense.
31:59
I really appreciate it, Steve.
32:00
I appreciate you taking the time and your expertise and experience is invaluable.
32:05
This was a great conversation.
32:07
I'd learn things every time we chat.
32:09
So thank you so much for this.
32:10
This is gives me a lot to think about.
32:13
Gives me a lot to try to prepare for as well.
32:14
So thank you so much.
32:16
This has been great.
32:17
I loved being here.
32:18
Thank you for having me.
32:21
That was Steve Gullet on AI and HIPAA compliance.
32:23
Thanks for joining, Steve.
32:25
You can connect with Steve on LinkedIn or visit adhdonline.com to learn more.
32:31
If you found this helpful, make sure to subscribe and share it
32:34
with someone in your network.
32:36
We'll see you next time on Legal Marketing Radio.