Zoom terms now allow training AI on user content with no opt out

But performance matters, too, of course. It's tricky to balance them.

Covered entities (including the EMR and hospital itself) can use protected health information for quality improvement without patient consent and deidentified data freely.

Where this gets messy is that deidentification isn’t always perfect even if you think you’re doing it right (especially if via software) and reidentification risk is a real problem.

To my understanding business associates can train on deidentified transcripts all they want as the contracts generally limit use to what a covered entity would be allowed to do (I haven’t seen Zoom’s). I know that most health AI companies from chatbots to image analysis do this. Now if their model leaks data that’s subsequently reidentified this is a big problem.

Most institutions therefore have policies more stringent than HIPAA and treat software deidentified data as PHI. Stanford for example won’t allow disclosure of models trained on deidentified patient data, including on credentialed access sources like physionet, unless each sample was manually verified which isn’t feasible on the scale required for DL.

Edit: Zoom’s BAA: https://explore.zoom.us/docs/en-us/baa.html

“Limitations on Use and Disclosure. Zoom shall not Use and/or Disclose the Protected Health Information except as otherwise limited in this Agreement or by application of 42 C.F.R. Part 2 with respect to Part 2 Patient Identifying Information, for the proper management and administration of Zoom…”

“Management, Administration, and Legal Responsibilities. Except as otherwise limited in this BAA, Zoom may Use and Disclose Protected Health Information for the proper management and administration of Zoom…”

Not sure if “proper management and administration” has a specific legal definition or would include product development.

Edit 2: My non-expert reading of this legal article suggests they can. https://www.morganlewis.com/-/media/files/publication/outsid...

“But how should a business associate interpret these rules when effective management of its business requires data mining? What if data mining of customer data is necessary in order to develop the next iteration of the business associate’s product or service? … These uses of big data are not strictly necessary in order for the business associate to provide the contracted service to a HIPAA-covered entity, but they may very well be critical to management and administration of the business associate’s enterprise and providing value to customers through improved products and services.

In the absence of interpretive guidance from the OCR on the meaning of ‘management and administration’, a business associate must rely almost entirely on the plain meaning of those terms, which are open to interpretation.”

> the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software

So notice most of these are somehow qualified to the service they are providing you, but the AI part stands alone. If it was to improve the service to me, that would be pretty reasonable, but here it says they can use it for AI as an end unto itself.

Something about the inscrutability of modern AI (nobody knows how it really works, what the limits of its capabilities are etc.) seems to lend itself to this kind of open ended vagueness. If they just wrote "we can use your user generated content for anything we like" it would almost amount to the same thing but people would be outraged. But when they say "it's for AI" everyone nods their head as if it's somehow different to that.