OpenAI's new ChatGPT Health service, designed to offer personalized health recommendations by analyzing user-uploaded medical records and data from smart devices, is raising significant cybersecurity concerns. Experts are urging caution, highlighting that the platform is not subject to the same stringent privacy regulations as traditional healthcare providers.
ChatGPT Health encourages users to consolidate their health information in one place, including medical records, test results, and data from fitness apps. While OpenAI states the service provides recommendations and advice, not diagnoses or treatments, cybersecurity professionals express unease about the potential risks associated with collecting such sensitive personal data. A primary concern is that, unlike healthcare providers, OpenAI and ChatGPT are not covered by the Health Insurance Portability and Accountability Act (HIPAA). This federal law mandates strict privacy and security rules for health data. Robert D’Ovidio, an associate professor of criminology and justice studies at Drexel University, noted that the protections afforded by HIPAA are absent when dealing with services like ChatGPT Health.
An OpenAI spokesperson stated that the company prioritizes privacy and allows users to delete their data at any time. However, Nathan Evans, faculty director of the cybersecurity program at the University of Denver, pointed out that without a federal mandate like HIPAA, there's no external enforcement body ensuring OpenAI's adherence to its stated privacy standards, leaving open the possibility of future policy changes.
Experts also warn that consolidating vast amounts of personal health information could make ChatGPT a more attractive target for cyberattacks. While ChatGPT Health asserts it uses data isolation and segmentation to keep health-related data separate from general user activity, D’Ovidio cautioned that data breaches remain a significant risk. OpenAI claims to employ "purpose-built encryption and isolation" for health data, but the aggregation of such valuable information inherently increases its vulnerability. The partnership with b.well, an AI-powered digital health platform, introduces another layer of complexity and potential risk, as data is shared between multiple entities.
The emergence of AI health tools like ChatGPT Health, and Anthropic's similar offering, Claude for Healthcare, has prompted calls for a re-evaluation of existing privacy regulations. D’Ovidio suggested that lawmakers may need to reconsider the definition of a healthcare provider and adapt regulations like HIPAA to encompass these new technologies, potentially avoiding a patchwork of state-specific rules.
Cori Faklaris, an assistant professor at the University of North Carolina at Charlotte, advised users to think critically before uploading health data, weighing the potential benefits against the loss of control over sensitive information. She also reminded users that AI models can "hallucinate," generating incorrect information, which could be particularly detrimental in a health context. Both Faklaris and Evans stressed that AI health services should augment, not replace, professional medical care.
Furthermore, experts noted that the decision to share health data with any third-party company carries long-term implications. Drawing parallels to the data security questions surrounding companies like 23andMe, they highlighted the unpredictability of future company changes or financial instability. OpenAI's financial situation, with reports of significant operational costs, adds another layer of uncertainty regarding the long-term stewardship of user data.
The fact that ChatGPT Health is not launching in the European Union, which has robust data protection laws like the General Data Protection Regulation (GDPR), was seen by Evans as telling. He suggested this might indicate potential difficulties for OpenAI in complying with stringent international privacy standards, making its launch in the U.S. more feasible due to the absence of equivalent comprehensive regulations.
For individuals considering using AI for health support, experts recommend strong security practices for their accounts, such as using unique passwords and enabling two-factor authentication. They also advise against sharing health data across multiple AI platforms to minimize exposure. The ultimate decision to share such personal information should be made with careful consideration of the associated risks and benefits.