5 ms·

You're sending patient information to a third party without any contractual agreement?

aabajian 4y ago
No patient info is sent. In my colleague's example, you can try out a similar query, "Write an appeal letter to a medical insurance company for a patient who needs a biopsy for a bone lesion given prior unclear diagnosis."
cardosof 4y ago
Probably patients consent to using software to process their data and chatgpt is considered just another software in the stack. Edit: parent poster said no info is sent.
- bfeynman 4y ago
  that's not how it works, PHI and HIPAA usually supersede a lot of these. That's why you hospitals don't just have everyone opt-out data protections if they want services.
- CabSauce 4y ago
  That would require a Business Associate contract between the provider and Open AI.
- lp0_on_fire 4y ago
  They probably consent to software that's been validated and managed by their medical provider. I can tell you for sure that I personally wouldn't consent to a a random script thrown together by an MD with leetcode experience that sends your medical data up to an experimental service.
nl 4y ago
Without a name or other PII this seems like a misplaced concern.
- xordon 4y ago
  That is an obviously incorrect assumption, it is possible to de-anonomize most data sets about and there is reason to believe this one is no different. Health data by it's nature is very personal and specific.
  - nl 4y ago
    De-anonomizing is usually done by combining datasets. That seems unlikely here.
  - xmprt 4y ago
    Doctors publish case studies all the time which contain anonymized data. Presumably those go through reviews to make sure that nothing is being leaked but health data by it's nature is specific but not very personal (at least not identifiable). Also, depending on what you're using ChatGPT for, this is no worse than Googling something which doctors do a lot as well.
    - andrepd 4y ago
      >consent
      - xmprt 4y ago
        Informed consent isn't a legal requirement. It's down to ethics and occasionally the journal's publishing requirements. So it we bring the analogy back to ChatGPT, using it for queries isn't breaking HIPAA or any laws.
  - catchnear4321 4y ago
    This is the prompt that was listed. “Write an appeal letter to a medical insurance company for a patient who needs a biopsy for a bone lesion given prior unclear diagnosis.” Add an arbitrary ip address and timestamp and you are very far away from anything personally identifying. (Where does your computer suggest you are right now?)
- 4y ago
neilv 4y ago
I'd give the colleague a heads-up right away that there's a potential for "hippo violation" there. (Image: a hippo, stomping all over you.) Then we'd make sure that our org/administration understood the risk, through whatever channels are appropriate.
alfalfasprout 4y ago
tbh the ChatGPT saga has exposed just how willing people are to send their own/company's/client's/patient's data to a third party without a second thought.

No patient info is sent. In my colleague's example, you can try out a similar query, "Write an appeal letter to a medical insurance company for a patient who needs a biopsy for a bone lesion given prior unclear diagnosis."

cardosof 4y ago

Probably patients consent to using software to process their data and chatgpt is considered just another software in the stack. Edit: parent poster said no info is sent.

bfeynman 4y ago
that's not how it works, PHI and HIPAA usually supersede a lot of these. That's why you hospitals don't just have everyone opt-out data protections if they want services.
CabSauce 4y ago
That would require a Business Associate contract between the provider and Open AI.
lp0_on_fire 4y ago
They probably consent to software that's been validated and managed by their medical provider. I can tell you for sure that I personally wouldn't consent to a a random script thrown together by an MD with leetcode experience that sends your medical data up to an experimental service.

nl 4y ago

Without a name or other PII this seems like a misplaced concern.

xordon 4y ago
That is an obviously incorrect assumption, it is possible to de-anonomize most data sets about and there is reason to believe this one is no different. Health data by it's nature is very personal and specific.
- nl 4y ago
  De-anonomizing is usually done by combining datasets. That seems unlikely here.
- xmprt 4y ago
  Doctors publish case studies all the time which contain anonymized data. Presumably those go through reviews to make sure that nothing is being leaked but health data by it's nature is specific but not very personal (at least not identifiable). Also, depending on what you're using ChatGPT for, this is no worse than Googling something which doctors do a lot as well.
  - andrepd 4y ago
    >consent
    - xmprt 4y ago
      Informed consent isn't a legal requirement. It's down to ethics and occasionally the journal's publishing requirements. So it we bring the analogy back to ChatGPT, using it for queries isn't breaking HIPAA or any laws.
- catchnear4321 4y ago
  This is the prompt that was listed. “Write an appeal letter to a medical insurance company for a patient who needs a biopsy for a bone lesion given prior unclear diagnosis.” Add an arbitrary ip address and timestamp and you are very far away from anything personally identifying. (Where does your computer suggest you are right now?)
4y ago

neilv 4y ago

I'd give the colleague a heads-up right away that there's a potential for "hippo violation" there. (Image: a hippo, stomping all over you.) Then we'd make sure that our org/administration understood the risk, through whatever channels are appropriate.

alfalfasprout 4y ago

tbh the ChatGPT saga has exposed just how willing people are to send their own/company's/client's/patient's data to a third party without a second thought.