Anonymization doesn’t just mean “leave their names out”. An entire patient's medical history is in itself personal identifiable information. Instead of googling for “headache”, they now have stored a copy of every medical detail in your life.
If it is de-identified per HIPAA, little.
OTOH, the more patient info you are putting in, the less likely it is actually legally deidentified.
Data that has ostensibly been "anonymized" can often be deanonymized.
Especially when the system we're discussing is literally the most advanced AI model we're aware of.
if you enter an entire patient history, it could easily be an identifier of the person whereas Google queries have a smaller max limit number of tokens
Can OpenAI get HIPAA certification? Perhaps offer a product that has it?
I've heard the Azure OpenAI service has HIPAA certification; they don't have GPT-4 yet, though.
The pdf on this page has the services that are under audit scope, check the table in appendix A; OpenAI is in scope for HIPAA BAA.
The data moat effect is greater with OpenAIs products.