AI Chatbots, Health Privacy, and Challenges to HIPAA Compliance.

This Viewpoint examines the privacy concerns raised by medical uses of large language models, such as chatbots.

Ethical Considerations When Using a Mobile Eye Tracker in a Patient-Facing Area: Lessons from an Intensive Care Unit Observational Protocol.

This article describes the process of designing, approving, and conducting an investigator-initiated protocol to use an eye-tracking device in a health care setting. Participants wore the device, which resembles eyeglasses, in a front-facing manner in an intensive care unit for the study of personnel gaze patterns, producing a visual record of workflow. While the data of interest for our study was not specifically the health information protected by the privacy rule of the Health Insurance Portability and Accountability Act (HIPAA), a wide variety of such data was captured by the eye-tracking device, and the prospective consent of all people who might have been incidentally videotaped was not feasible. The protocol therefore required attention to unique ethical considerations-including consent, privacy and confidentiality, HIPAA compliance, institutional liability, and the use of secondary data. The richness of eye-tracker data suggests various beneficial applications in health care occupational research and quality improvement. Therefore, sharing our study's successful design and execution, including proactive researcher-institutional review board communication, can inform and encourage similarly valuable, ethical, and innovative audiovisual research techniques.

Opportunities for and Tensions Surrounding the Use of Technology-Enabled Mental Health Services in Community Mental Health Care.

Technology-enabled mental health services have the potential to expand the reach of care and reduce clinician demand. While the efficacy of technology-enabled mental health services is well established, there have been few successful implementations of such services into community care settings. Using mixed methods, 89 clinicians and supervisors at a mental health service organization shared attitudes toward and interest in using a variety of technologies in their work. Participants discussed several challenges and opportunities for technology-enabled mental health services. Whilst clinicians saw potential for technology to engage individuals both in and outside the clinical environment, the range of therapeutic techniques used by clinicians presented a challenge in implementing a tool to meet their needs. Client technology access was a concern, and although text messaging would facilitate communication, current HIPAA and payment structures restrict this ability. With these considerations, we offer recommendations for implementing technological services in community mental health organizations.

Review of HIPAA, Part 2: Limitations, Rights, Violations, and Role for the Imaging Technologist.

This article is the second part of a continuing education series reviewing the Health Insurance Portability and Accountability Act (HIPAA) of 1996. The term HIPAA should be familiar to those who work in the medical profession, but this article includes details on its rules, patients' rights, violations, breaches, and penalties. To help administer these safeguards, HIPAA requires that every organization designate a HIPAA privacy and security officer. HIPAA violations can have serious repercussions when rules are not followed; these violations can be either negligent or willful. If breaches of unsecured protected health information occur, HIPAA requires covered entities to notify affected individuals, the Secretary of Health and Human Services, and in some cases the media. Violations in which the covered entity did not know of the violation are now punishable under the first tier of penalties. Unintended violations carry a minimum penalty of $100 per violation and a maximum of $50,000 per violation. All patients have a right to privacy and a right to confidential use of their medical records. The role of medical professionals includes understanding how and when to apply these HIPAA rules verbally and electronically.

Communicating With Leadership: Behavioral Health and HIPAA in the Field.

It can be challenging for a general medical officer to determine a patient's fitness for duty in the field. Communicating with commanding officers can be difficult given a general medical officer's loyalties as both a physician and medical officer. We present a case of a junior officer that highlights these issues.

Texting Among Academic Psychiatrists: What Does HIPAA Allow?

The texting of protected health information (PHI) has raised concerns about breach of privacy as it relates to the Health Insurance Portability and Accountability Act (HIPAA). Within psychiatry, limited guidelines exist on HIPAA-permissible texting. Given the legal implications of a breach, we sought to better understand texting patterns among psychiatrists by surveying members of the Association for Academic Psychiatry, 53 of whom responded. Only 63% of respondents felt confident in their knowledge of HIPAA. While 64% reported that texting PHI is prohibited, most (53%) still used texting to communicate PHI. Currently, HIPAA is technology neutral and texting PHI is not explicitly prohibited, provided safeguards are taken and physicians securely communicate PHI.

Implementing a universal informed consent process for the All of Us Research Program.

The United States' All of Us Research Program is a longitudinal research initiative with ambitious national recruitment goals, including of populations traditionally underrepresented in biomedical research, many of whom have high geographic mobility. The program has a distributed infrastructure, with key programmatic resources spread across the US. Given its planned duration and geographic reach both in terms of recruitment and programmatic resources, a diversity of state and territory laws might apply to the program over time as well as to the determination of participants' rights. Here we present a listing and discussion of state and territory guidance and regulation of specific relevance to the program, and our approach to their incorporation within the program's informed consent processes.

The Dark Data Quandary.

The digital universe remains a black box. Despite attaining high-technology capabilities like artificial intelligence and cognitive computing, "Big Data" analytics have failed to keep pace with surging data production. At the same time, the falling costs of cloud storage and distributed systems have made mass data storage cheaper and more accessible. These effects have produced a chasm between data that is stored and data that can be readily analyzed and understood. Enticed by the promise of extracting future value from rising data stockpiles, organizations now retain massive quantities of data that they cannot presently know or effectively manage. This rising sea of "dark data" now represents the vast majority of the digital universe. Dark data presents a quandary for organizations and the judicial system. For organizations, the inability to know the contents of retained dark data produces invisible risk under a spreading patchwork of digital privacy and data governance laws, most notably in the medical and consumer protection areas. For courts increasingly confronted with Big Data-derived evidence, dark data may shield critical information from judicial view while embedding subjective influences within seemingly objective methods. To avoid obscuring organizational risk and producing erroneous outcomes in the courtroom, decision-makers must achieve a new awareness of dark data's presence and its ability to undermine Big Data's vaunted advantages.