AI in Healthcare: Protecting Patient Data Without Falling Behind

Um, but that's another really cool report that's coming out with skills and how things have kind of changed in, in the supply chain with AI.

Um, but you know, you spent, as you said, over two decades in not just security but in just the computer int- computing industry.

And again, as a CISO at a healthcare company, you've likely seen healthcare data from almost every angle and, you know, you have to govern HIPAA stuff.

You have to deal with PII, um, and then you have to run all those incidents around them, like when a breach hits or even when builders are creating things with AI, uh, especially in your organization.

So with all of that kind of diversity that you've got and all the new kind of things we're seeing in AI from note takers and agentic systems to, like, LLMs that are, like, really being trained on your patient's data, how do you feel the balance between protecting patients, uh, in AI, uh, has changed versus, like, the benefits of enabling AI for their data?

I think every organization and every cybersecurity team out there right now is trying to find that middle ground, which is You know, you don't wanna be too far behind because then you're at a disadvantage.

Your adversaries have better tools.

And but on the other hand, you don't wanna just turn a blind eye and then have something, you know, cause a huge impact within your organization.

'Cause that's really what's changed is, is just the speed and the blast radius with AI.

I mean, we had that before.

Like, really what, what we're scared of hasn't changed that much, but now it's just the speed and the blast radius that is hard to keep up with.

And I don't, I don't think that's unique to healthcare.

I think that's really across the board.

Um, you know, if you listen to people who really understand the problem, I think everyone sounds a little nervous about it.

Yeah.

I think when we think about healthcare, right, it's just like one of those really sensitive categories, and it's easy to assume that there's a lot of sensitive data there.

So like, for example, I'm a big gamer, right? I don't think that, like, these game companies have all this, like, really interesting data on me.

But, you know, sometimes they take in the location of your device, which is very accurate, right? So, like, I don't really ever think about it from a perspective of, like, every time I start up a game, like, "Oh, they know exactly where I am." But, like, when I go to a doctor's office, I for sure know that they have, like, all of this information on me, like from my blood tests to, uh, like my preexisting conditions, to concerns that are typically covered by doctors and are, like, are very private, uh, and sensitive notes, right? And these note fields in these apps, they're usually just general text fields.

You know, there, there's nothing special, so it's, like, not protected in any way other than, like, encryption at rest.

So I'm wondering, like, when we start to look at solutions that are specifically using AI over all of this very sensitive data, people know it's sensitive, right? And we think about, like, the ways that it can be used to make a consumer's life better.

What does that risk analysis kinda look like when you do that specifically, like, uh, I guess, for your industry?

Yeah.

It's a great question, Mo.

And, you know, keep in mind, like, an organization like where I'm at right now, like, we never get any of the notes.

We would never get that level of detail.