Health care organizations are deploying AI into mission-critical operations without fully understanding the long-term legal, operational, and security implications.
For organizational leaders, understanding both the risks being created and the governance strategies needed to respond is essential to compliance planning.
Alaap Shah, Member of the Firm, examines the challenges of enterprise AI adoption.
Key Takeaways
- Vendor Lock-In Through Integration: Organizations embedding AI into operations risk creating irreversible dependencies—especially when AI solutions become so integral that disabling them would disrupt core operations. Vendor contracts with clear trigger points for exit and exit strategies negotiated upfront can help preserve flexibility.
- Data Privacy in Generative AI: Patient and customer data fed into AI systems can become part of training datasets and potentially leak into outputs for other customers. Before implementation, determine how vendors train models and use your data.
- AI-Versus-AI Cybersecurity: Bad actors are using AI to orchestrate sophisticated attacks. Security companies are increasingly deploying AI-powered solutions to counteract threats, creating an escalating arms race.
- Adaptive Governance Frameworks: Organizations that regularly revisit policies, monitor regulatory developments, and adjust frameworks remain compliant as regulations shift. Static policies become outdated quickly in this space.
AI compliance requirements vary significantly by state. Our State AI Law Tracker provides real-time visibility into state-level AI legislation and regulatory developments. Check it out: https://www.ebglaw.com/insights/publications/state-ai-law-tracker
Learn more about Epstein Becker Green's artificial intelligence practice: https://www.ebglaw.com/industries/technology/artificial-intelligence
Transcript
[00:00:00] Alaap Shah: Don't forget that AI is already being used in your enterprise. It's already there. We see that in the health care ecosystem with electronic health record systems where people just have tremendous difficulty walking away once those systems are in place. The same could be true for AI, depending on how you engage with those vendors. I certainly think that people should be thinking about trigger points for walking away from a deal, whether it's because the competitive landscape of AI solutions has changed or because the pricing associated with those becomes untenable. And I think the other point of it is also to have some cognizance of how these tools are going to be integrated into your organization. Because even if you have the perfect contract, if it turns out that huge chunks of your organization are using these solutions in an agentic way, that if turned off would completely disrupt your operations, that is tantamount to a lock-in situation. If we’re dealing with protected health information or patient data, AI is somewhat different. In the sense that when you put data into an AI algorithm, sometimes that data becomes part and parcel of the models themselves.
[00:01:08] Alaap Shah: And we have situations that security researchers and others have already identified where data going in from one customer of that AI vendor gets pulled into the AI training, retraining model, and then ends up becoming part and parcel of the outputs that are generated for another customer. So we have potential data leakage concerns. So we have to be really mindful about that risk as a pretty unique risk of AI models, especially in the generative AI context. We not only have hackers supercharged with AI solutions to use agentic AI in a way to orchestrate entire attack sequences, we also have AI being used in malicious ways to create new malware that can infiltrate systems and wreak havoc. We can't really combat the sophistication of a malicious attacker using AI without using AI on the good side of things as well. Security companies are leveraging AI solutions in a managed service offering to be able to counteract that. So in a brave new world, we have sort of AI versus AI paradigms in the cybersecurity space, and I think that will continue to be how we operate at scale.
[00:02:20] Alaap Shah: I am completely uncomfortable as a practitioner in this space. I love it. I know not everyone feels that way. But I think being a little bit uncomfortable gives you that motivation to stay on top of things and then make choices thoughtfully over time to improve over time. I liken it to cybersecurity, for example. I've been doing cybersecurity work for decades. I've been completely uncomfortable in that space as the cybersecurity threat landscape evolves every day and becomes more challenging for enterprises, and we see these massive breaches happening. So the reality is that an organization taking on this kind of risk, and now AI being the new bucket of risk, needs to be focused on that continuous improvement cycle over time. That means revisit your policies and procedures, revisit your governance program over time, make sure you're keeping track of how the regulatory landscape unfolds, making sure you're understanding where risk is manifesting over time that's germane to your business, and then kicking the tires on what you've put in place and perhaps improving over time or adjusting. There's nothing more important in the AI space currently than to be nimble, not only in adoption of AI technology and pivoting where you need to in terms of how you use it, but about how you govern that as well, because everything's changing frequently.
About Thought Leaders in Health Law
The Thought Leaders in Health Law® video series tracks the latest trends in multiple areas of the health care and life sciences industries, featuring attorneys and advisors from Epstein Becker Green and EBG Advisors. Part of the Epstein Becker Green Insights Network.
