Scope of Artificial Intelligence (AI) in Data Privacy and Security Concerns in Healthcare: A Narrative Review

Artificial intelligence (AI), a term coined by John McCarthy in 1956, describes computers' ability to perform human tasks. AI mimics human thinking using programs, needing enough data and computing power to work properly (1). In short, AI means using technology to replicate human-like critical thinking and intelligent behavior (2). Advancements in healthcare through AI technology are progressing rapidly and are set to have a significant impact on the healthcare area. Several new technologies in this area are becoming more feasible, with some close to being implemented in healthcare systems (3).  AI in healthcare is advancing quickly, and there is increasing concern about how to regulate its growth. A lot of AI technologies end up under private ownership and control. The way AI is being implemented may require medical facilities and government agencies to play a bigger role than usual in gathering, using, and protecting patient health data. This brings up implementation, data security, and privacy concerns (3,4). While concerns about privacy, confidentiality, security, and commercial interests in data sharing are repeatedly discussed, when people think that it is useful for society and have trust in the organization (5). Public support for data sharing in AI tools is not guaranteed due to various concerns (6). People’s understanding of AI (6), ethical issues (7), and worries about the reidentification of anonymized health data contribute to this hesitancy (8). Additionally, negative media coverage about large technical companies using health data for AI  and several significant data breaches and cyberattacks have further weakened public trust in this technology (9).  The purpose of this study is to investigate how artificial intelligence (AI) may affect patient data security and privacy in the healthcare industry. It focuses on understanding how potentially sensitive patient data may be exposed by AI technology utilized in healthcare. Finding data exchange and storage issues, as well as difficulties preserving patient privacy, are the major objectives. To make recommendations for improving security and safeguarding patient privacy in AI-driven healthcare settings, the study also looks at existing regulations controlling data privacy and ethical concerns.

METHODOLOGY:

To gather relevant literature on the scope of AI in data privacy and security in healthcare for a narrative review, a structured search was conducted using two databases: PubMed and Google Scholar. The search strategy employed a combination of specific terms to ensure comprehensive coverage of the topic. The following search string was used: (("data basel"[Journal] OR "data"[All Fields]) AND "privacy"[MeSH Terms] OR "privacy"[All Fields]) AND ("computer security"[MeSH Terms] OR ("computer"[All Fields] AND "security"[All Fields]) OR "computer security"[All Fields] OR ("data"[All Fields] AND ("delivery of health care"[MeSH Terms] OR ("delivery"[All Fields] AND "health"[All Fields] AND "care"[All Fields]) OR "healthcare"[All Fields] AND "ai"[All Fields])). The inclusion criteria for the search encompassed studies published in peer-reviewed journals over the past 10 years, from 2014 to 2024, to ensure the relevance and currency of the data. For the final review, we selected studies that were in English, had the full text available, were published within the specified time frame, and were pertinent to the topic.

Article Screening:

The initial search produced 180 articles from all databases. After removing 20 duplicates, we screened the abstracts and titles, eliminating an additional 103 articles. A full-text review of the 66 remaining articles resulted in 23 exclusions that didn't meet the inclusion criteria. This left us with 43 articles for the final review.

Fig 1. Prisma Flow Chart

Review Points

Scope Of Ai in Healthcare:

AI in healthcare enhances diagnostics, personalizes treatment, and predicts outcomes. It improves medical imaging accuracy, identifies disease patterns, and supports precision medicine through comprehensive data analysis. AI-powered virtual assistants facilitate telemedicine, while machine learning models streamline hospital operations and administrative tasks (10). In drug discovery, AI accelerates research by predicting molecular interactions. AI ensures data privacy through encryption, anonymization, and secure access controls. Additionally, AI-driven robots assist in surgeries, enhancing precision and safety. Overall, AI transforms healthcare by improving efficiency, accuracy, and patient care while addressing privacy and security challenges (2,11).

Fig. 1: Scope of AI in Healthcare

Data Privacy Concern in Healthcare:

In the field of data-driven healthcare, ensuring privacy is crucial as machine learning and deep learning systems rely on users’ data to make predictions. Patients rely on healthcare professionals to safeguard their private information, including sensitive details such as age, sex, and health data (12,13). The use of big data in healthcare raises significant privacy issues. One major concern is the ethical issue of using personal data without permission in predictive analytics. Losing control over who can access this data can seriously affect patients’ mental well-being if their private health information is exposed. Also, having private databases with genetic information and medical histories might obstruct data collection and the process of medical tests. Moreover, some companies might claim to protect privacy as a reason to withhold data, making it difficult to share information (14). Wearable devices and the Internet of Medical Things (IoMT) in healthcare have many security and privacy weaknesses, putting sensitive data like passwords at risk. Attacks like denial-of-service and ransomware could even cause life-threatening situations. As a result, users are worried about the technology’s security flows and how their data is being used (15). Health information management (HIM) practices, including automated medical coding, data capture, and governance, are greatly influenced by advanced technologies. These applications also affect patient confidentiality and privacy. A key challenge is finding the right balance between restricting data access and solving potential issues (11). Priyanshu et al. looked into how advanced technologies can follow privacy rules like HIPAA and GDPR. They focused on training systems to produce outputs that meet these rules and checked how much personal information was kept. They tried different methods to stop systems from repeating input data by adding extra sentences. This was done to improve privacy while still following data protection laws. The study found that personal information showed up in 57.4% of cover letter summaries, though this varied among different groups. However, when given clear instructions, the systems greatly reduced the amount of personal information included, showing that privacy compliance is achievable. (16). Many methods have been suggested to preserve privacy in healthcare applications. One such approach is homomorphic encryption (HE), which permits data processing while encrypted, guaranteeing privacy without requiring decryption (17). Secure Enclave is a hardware-based technology that protects the confidentiality and integrity of code and data during use, safeguarding sensitive computations from threats. Secure multi-party computation (SMPC) involves sharing computations among multiple parties to prevent any one party from accessing another’s data. This can be done through methods like garbled circuits and secret sharing, allowing secure collaboration on sensitive data (13). These solutions are vital in healthcare, where strict regulations protect patients’ privacy and data. Implementing these methods allows sensitive information to be processed securely and efficiently, meeting healthcare data protection standards (15,18).

Data Privacy and Security Challenges in Healthcare:

Maintaining privacy is a difficult task in itself. Privacy concerns have grown because AI algorithms are involved (as various privacy attacks can be implemented on AI models). Fig. 2 presents a list of a lot of challenges to effective privacy maintenance.

Fig. 2. Privacy challenges in healthcare

Authentication and access control: The electronic health record maintained inside the hospital information system contains private data, including patients’ medical histories, which is accessible to accredited users. Authentication data must be kept secure. The consequences could be serious if someone else obtains such information because it can be difficult to detect an unproven attack (19).

Data integrity: Delivering trustworthy medical AI solutions depends mainly on data accuracy. Unauthorized access to such sensitive data integrity. These changes are typically caused by data contamination, which yields unreliable results. Thus, safeguarding data against contaminating assaults is essential but extremely difficult (19).

Robustness: Patients have full access to their medical records, but only authorized personnel can access confidential information. Preventing unauthorized modifications that compromise data integrity and privacy is a challenge. Tainted data can mislead models and lead to incorrect care decisions. Systems like electronic health records need robust security mechanisms to prevent such attacks (18).

Legibility: Legibility is the process of informing data owners about the transfer of their data. It should be made clear to data owners where their data is stored and how their privacy is safeguarded. The majority of businesses, including Google, Amazon, and Facebook, use differential privacy for personal information that they keep on file. Assuring people that their data privacy is protected is still difficult (20).

AI ethics: AI decision-making has important consequences for the ethics required for justice, honesty, and clear reasoning. The balance between ethical correctness and accuracy is rarely perfect. Reduced model performance might result from patient confidentiality, which frequently requires the exclusion of sensitive data (7).

Trade-off between privacy and utility: The goal of a healthcare system is to de-identify data before transmission to reduce utility loss and prevent bias. Distinct data qualities can lead to variations in utility loss and fairness trends. Thus, increasing privacy and fairness trends require developing strategies to handle the privacy-utility trade-off (21).

Scalability: While privacy-focused high-processing power algorithms work well on small datasets, they become difficult and resource-intensive when applied to larger ones. Machine learning strives for increased speed, high communication cost, and low processing power as it develops. However, high processing power and communication costs and homomorphic encryption, for example, are barriers to preserving machine learning algorithms. Using distributed processing and providing the algorithm with only the necessary data are keys to the solution (22).

Adaptability: Techniques for privacy protection are typically specific and cannot be applied to all scenarios. Developers must come up with creative ways to protect privacy for every new algorithm that appears. Common techniques with wide applicability include local differential privacy (LDP) and distributed methods (23).

Ethical Issues and AI:

Research on the ethical concerns surrounding the use of AI in healthcare has highlighted several key issues and related subtopics that need attention. These issues, along with challenges arising from the recent initiative of publicly accessible large language models, are examined in this review. The main concerns include privacy, transparency, trust, responsibility, bias, cybersecurity, and data quality(24,25).

Privacy: In data-driven healthcare, privacy is a significant challenge due to the use of machine learning and deep learning systems to predict outcomes from user data (2). Patients trust healthcare providers to protect sensitive information, but big data use introduces many privacy issues, including the unauthorized use of personal data in predictive analytics. Loss of data control can have serious psychological effects if patients’ health information is exposed (15). Private databases containing genetic sequences and medical histories can hamper data collection and medical advancements. The healthcare system also uses privacy concerns as a reason to refuse data, complicating data-sharing effects. To protect privacy in healthcare, methods like homomorphic encryption, secure enclave, and secure multiparty computation allow secure data processing without revealing sensitive information, ensuring compliance with healthcare privacy regulations (13).

Transparency and trust: Transparency and trust are significant ethical concerns in AI systems, especially complex ‘black box’ models that lack clarity in decision-making. Balancing accuracy and explainability is essential (26). Many medical AI models lack transparency, reducing trust. A framework assessing transparency in medical AI found reporting gaps. Explainability involves understanding AI conclusions and training processes, which are crucial for legal aspects like informed consent. Techniques like Local Interpretable Model-Agnostic Explanations (LIME) and Class Activation Mapping improve interpretability in medical imaging, but neglecting explainability can compromise ethics and health outcomes (27).

Cybersecurity: Cybersecurity involves preventing unauthorized access, theft, damage, or attacks on computer systems, networks, and digital information. AI systems' lack of explainability can cause unclear security breaches (28). Open-source intelligence (OSINT) uses publicly available data, affecting areas like national security. Political campaigns, cyber industry, criminal profiling, societal issues, cyber threats, and cybercrimes. The COVID-19 pandemic has introduced new cybersecurity challenges, such as healthcare and cyber resilience. Non-peer-reviewed literature highlights new forms of cyberattacks, like social engineering and side-channel attacks, showcasing the evolving nature of cybersecurity. Stanfill and Marc emphasized data security during collection, transfer, storage, and usage (29). A systematic review explored using semi-supervised learning (SSL) with cybersecurity data repositories to build robust security models, emphasizing the importance of using real-world data (30). Grobler et al. proposed the 3U's of cybersecurity: user, usage, and usability, shifting from a functional approach to a user-centered strategy that considers human factors. As cybersecurity evolves, developing new prevention strategies remains crucial (31).

Responsibility: AI responsibility attribution questions who is liable for AI actions (32). Studies highlight the need for human control and caution against fully automated systems, noting AI's lack of autonomy. Examining human-technical interactions and AI's lifecycle helps determine accountability. Responsibility diffusion arises with multiple agents, as seen in AI-driven medical decisions (33). Transparency and traceability are key to addressing these issues. Debate exists on AI tools like ChatGPT in authorship, balancing contributions against decision-making capacity. Shifting to data stewardship ensures responsible data management, patient privacy, and regulatory compliance, with data stewards facilitating research and upholding privacy standards (34).

Bias: AI algorithms can be biased due to flaws in healthcare data, impacting clinical decisions. Biases in trials, treatment choices, and data collection can lead to inequities, especially affecting marginalized groups (35). Research shows worse outcomes for these populations. To address this, targeted public health efforts, policy changes, and community engagement are needed. AI has the potential to reduce health disparities, but it requires adequate infrastructure for effective implementation (36).

Data quality: Convolutional neural networks (CNNs) are now widely used for image-related tasks and are extending to non-imaging data through modern machine learning techniques. By converting non-imaging data into images, CNNs allow healthcare practitioners to train hybrid deep learning models using diverse patient information, such as genetic, imaging, and clinical data. This integration offers a more comprehensive view of patient data compared to using a single data type (37). Additionally, language models may produce "hallucinations," or incorrect and misleading information that seems accurate. Addressing these inaccuracies is crucial for reliable healthcare data. As automation advances, health information management (HIM) professionals must enhance their data analysis skills to adapt to new AI technologies and roles (38).

AI-based Technological Solutions to Mitigate the Risk of Data Privacy and Security:

Table 1.: Application of AI in Healthcare Regarding Data Privacy and Security.