Reply to thread

Message: <blockquote data-quote="Gorgon Zee" data-source="post: 9706637" data-attributes="member: 75787">Only approved tools can be used for data that is private, sensitive or restricted (includes PHI/PII, financial, etc. -- basically anything not public). Approval is by a committee including me, our VP for compliance and our VP for security. In general, to be approved a tool must:<ul> <li data-xf-list-type="ul">Secure our data subject to HIPAA and other requirements. </li> <li data-xf-list-type="ul">Not use our data to train a model. Or if they do, secure that model so we are the only ones with access to it.</li> <li data-xf-list-type="ul">We typically (always?) require a contract that defines these requirements.</li> </ul>The second point is often a sticking point. Using our data to train their models is very valuable for another company -- it builds their IP. However, my current understanding of the law is that you cannot actually do this without the consent of the people whose data you are sharing: If we use their data to improve care of OUR patients; it's OK -- but using their data in ways that will not benefit them requires consent. I am not a lawyer: The above is my understanding of the law and I believe that others may have a different / more lenient view. So do not take the above as fact, but simply as the interpretation that I use in my daily work.</blockquote>