eHealth and AI: How to control our sensitive personal data?

Author: Rob van den Hoven van Genderen (Professor in Artificial Intelligence and Robot Law)

Research group: Law, Technology and Design Thinking

In a growing, worldwide increase of aging population and a fundamental lack of suitable medical personal, eHealth  AI technology, can be a considerable help to support the flaws in care and medical support. eHealth is considered to be the next step in medical industry and medical communication on every level, from lifestyle advice to surgery and communication of medical data between professionals as well as between patients or governmental health authorities. But what happens with those sensitive data?

In this next step of the health industry the use of AI will speed up the pace of all those applications. Massive amounts of data can be analyzed for diagnosis of diseases and ways to cure them, but AI also can be used to profile certain groups within the population to qualify them for cheaper or more expensive health insurance or – on the negative side- even could result in expelling people from necessary care. Also, it could be possible that choices and decisions for treatment between patients will be based on the outcome of AI analysis where the necessary human factor will not be present, resulting in doubtful ethical results. The combination of AI in robotics for medical assistance and treatment, although considered useful, can create doubts about the de-humanization and the required attention for meaningful human control. AI will certainly increase the efficiency in healthcare but is that the most important aspect of healthcare? Will the proposed AI Regulation be a stimulus or an objection to use AI for medical applications?

The medical profession is bound by the Hippocratic oath to follow the ethical as well as practical rules to do no harm. It even gives rules to protect the privacy of patients:

“Whatever I see or hear in the lives of my patients, whether in connection with my professional practice or not, which ought not to be spoken of outside, I will keep secret, as considering all such things to be private.”

These basic values should also be part of practicing medical professions in a wide sense using new technologies as artificial intelligence (AI) and robotics. Pandora’s Box is opened to an unlimited and intrusive number of applications concerning eHealth. AI will be available on different levels, for professionals and supporting patients who need care by telemetry, telemedicine, connected to caretakers and virtual or human doctors and specialists. It can be used to follow elderly people to mitigate risks or analyze movements of people in case of contagious diseases (Covid!). AI generated Apps can recognize tumors, nano- robots can remove them. AI will propose medical care actions. 

As eHealth covers a wide spectrum of smart applications. the EU recognizes that AI will have an immense influence on eHealth in all its aspects. Social care, medical services, medtech industry.[1]

Next to the positive effects: direct actions and control for the people who need them there can be detrimental effects on loss of independency, physical integrity and privacy.

These data are specified in the General Data Protection Regulation (GDPR) as sensitive data and data-subjects need to give severe and explicit permission for those data to be processed, based on requirements of transparency, explainability and informed consent. Is that even possible using AI?

In the EU white paper on AI[2] these worries were also ventilated on the present AI developments, requiring an independent supervisory system and liability rules for developing and using AI taking into account the risks and dangers concerning misuse and vulnerability of personal data and possible bias and discrimination.

These fears also came up with the use of ehealth data processed by the use of the ‘green-covid-19 certificate’ (European Covid passport) on international and national base.

The proposed AI Regulation, a solution?

It will be very hard to supervise all use of eHealth data in conformity with the requirements of the GDPR but also the proposed European AI-regulation will make it very difficult to exchange AI generated ehealth data by governmental agencies  as well as other actors in the medical sector, in particular insurance, as risk-based impact use of AI is forbidden in article 5 of the AI Regulation.[3]

Creating practices and regulations to share more ehealth data with the use of AI can be the solution. Processing and sharing of ehealth data should be made possible taking into account the information sovereignty of the sensitive data subject. This also would be in line with another draft Regulation on Data sharing (Data Governance Act), in which it a.o. is stated to stimulate data sharing a low intensity regulatory intervention would require that individual public sector bodies allowing re-use of data to be technically equipped to ensure that data protection, privacy and confidentiality are fully preserved.[4] Let us see how that will work out.

Notes:

[1] Digital health and care refers to tools and services that use information and communication technologies (ICTs) to improve prevention, diagnosis, treatment, monitoring and management of health and lifestyle. Digital health and care have the potential to innovate and improve access to care, quality of care, and to increase the overall efficiency of the health sector.

[2] White Paper on Artificial Intelligence -A European approach to excellence and trust(COM(2020) 65 final, available at: https://ec.europa.eu/info/sites/info/files/commission-white-paper-artificial-intelligence-feb2020_en.pdf

[3] Artificial Intelligence Act Com/2021/206 Final, available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0206

[4] COM(2020) 767 final 2020/0340(COD), available at: https://eur-lex.europa.eu/procedure/EN/2020_340

STAR, Smart Tissue Autonomous Robot Children's National Health System, copyright NOS, available at: https://nos.nl/artikel/2103207-onder-het-mes-bij-dokter-robot