My doctor could vet it for accuracy, I suppose, but why? He's already putting his notes in my records anyway.
This is different, in that this service requires that a third party pay attention to the content of your discussion in order to work. That's significantly more intrusive.
Their website's privacy policy doesn't say anything about their product. It's also incorrect (they seem to have switched tracking providers without updating their privacy policy). I would quote the sections that are incorrect, but their terms and conditions forbid copying any content from their site. Their T&C also forbids me from linking to their page or terms.
I very much doubt that using this product as advertised is even legal under the GDPR. The company is French and health data, even pseudonymized, is strictly regulated. The "demo" doesn't feature any explicit consent at the very least.
It looks like they're making all privacy risks and concerns the doctors' problems. After all, they're the ones violating the law when they use this product.
I honestly have no idea how these products are even developed. Does nobody think about any laws at all? This is something I really hate about the current state of "hustle" development.
Our product is GDPR compliant.
What I don't understand from those, and statements made by your team in this thread, is how some claims can be compatible.
- That the product is GDPR compliant.
- That you don't store the PII or health data.
- Yet all data is stored at Google servers.
- Also, you reserve the right to re-use said data. (Which, since this is for R&D purposes, should probably qualify you for the need to ask the CNIL for an authorization as "health data repository"? [0])
- That none of the data is sent outside the EU or to additional 3rd parties.
- Yet it uses a fine-tuned "GPT-3" (a term that to the best of my knowledge exclusively refers to Microsoft/OpenAI's US-based API service, not to on-prem GPT-like LLMs like GPT-J or GPT-NeoX).
All in all, I can feel the enthusiasm but it does feel like this thread would have been so much more reassuring with some proactive comments about the privacy/health data issues, rather than have everyone voice the obvious concern with no prepared answers.
[0] https://www.cnil.fr/fr/la-cnil-adopte-un-referentiel-sur-les...
I hope this link will clarify our position.
Here are additional answers related to your points. - We do use Google Cloud to host our backend in EU or in the US but also the data for the Care Platform product. For the Copilot product, we don't host any data. They are hosted locally on the practitioner browser. - Our T&C reserves the right to re-use data in the event we will store the data in future versions of Nabla Copilot. In any case, the reuse of data, even health data, is allowed by GDPR for the improvement of the service provided if the data controller (practitioner) authorizes us and if they have informed the patient. - We did not say that "none of the data is sent outside the EU". Actually we say the opposite in the Copilot APD Annexe 1. We specifically mention Google and OpenAI and we comply with GDPR with a data protection agreement with both these companies.
Maybe its just the doc offices i've been to, but i think this would actually just increase the patient churn in a hospital. There's no way a doc is going to increase their patient time by the 40% saved if the hospital can toss them in front of another patient.
In any case HIPAA will protect you. Your provider will have a business associate contract with them, so they're subject to huge fines if they violate that.
This is a demo. In real life this'll be wrapped with a whole lot of legal contracts.
> in any case, HIPAA will protect you
It protects you insofar as it disincentives honest actors from doing sketchy things with your data. It's punishment for orgs, not protection for patients, like how laws against murder punishes the murderer rather than protecting the victim.
The best thing a patient can do to protect their privacy is to be actively avoid of medical practitioners that, for example, use tools like this which send your private medical consultation transcripts to God-knows-where.
They can be held accountable, but it's unclear how much specialized training or experience they actually have. They could have had a 6-month course, an online course, etc.
And of course you're assuming their EMR is actually secure. In a small office you can usually find the passwords you need stuck to the monitor or under the keyboard.
Then you simply cannot use modern healthcare. Unless you're doctor is cash-pay, off the cuff, they're _legally_ using third-parties to perform their services.
----
If your doctor/healthcare provider is a covered entity, they're bound by HIPAA. That means they're free to establish relationships with Business Associates that are part of delivering healthcare. Those Business Associates must also be HIPAA compliant.