HIPAA Considerations for AI Tools: Protecting Patient Privacy in the Prompt

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-healthcare-hipaa-ai-tools-adults

1. A registered nurse wants to use ChatGPT to summarize a patient discharge summary for a family meeting. Before pasting any patient information, which question must the nurse first answer?

   1. Does my organization have a Business Associate Agreement with this AI vendor?
   2. Will the AI tool store this data on my local computer?
   3. Is the patient's insurance information included in the summary?
   4. Has the patient signed a release for AI-generated communications?

2. Under HIPAA's Safe Harbor de-identification method, how many specific identifier categories must be removed from protected health information?

   1. 14 categories focused on direct identifiers
   2. 22 categories including technological identifiers
   3. 18 categories covering all potential re-identification factors
   4. 10 categories of major identifiers

3. A healthcare system subscribes to the enterprise tier of an AI chatbot service specifically designed for healthcare. What must be confirmed before entering any patient data?

   1. A signed Business Associate Agreement exists between the vendor and the healthcare system
   2. The AI tool automatically deletes data after 24 hours
   3. The patient's primary care physician has approved AI usage for their care
   4. The AI model has been certified by the FDA as clinically accurate

4. Which scenario represents a potential HIPAA violation involving AI tools?

   1. A medical coder uses an AI tool with synthetic (fictional) patient data to practice coding workflows
   2. A billing specialist uses an approved AI tool with de-identified claims data for revenue cycle analysis
   3. A physician enters a patient's symptoms into a free consumer AI chatbot to get diagnostic suggestions
   4. A receptionist uses AI to generate an appointment reminder template without any patient-specific data

5. Which of the following is considered a geographic identifier under HIPAA's 18 identifier categories?

   1. The name of the hospital where treatment occurred
   2. The patient's country of origin
   3. The patient's ZIP code combined with the first three digits of their phone number
   4. The patient's state of residence

6. A research dataset contains patient outcome data grouped by age range and diagnosis. The smallest group contains only two patients. Despite removal of names and direct identifiers, what risk remains?

   1. The data must be reported to HHS immediately
   2. The data is automatically HIPAA-compliant since identifiers were removed
   3. The AI tool used to create the groups has violated HIPAA
   4. Small cell sizes create re-identification risk even without explicit identifiers

7. What is the maximum annual penalty for HIPAA violations within a single violation category?

   1. $1.9 million annually per violation category
   2. $500,000 annually
   3. $100,000 per violation
   4. $5 million in total lifetime penalties

8. According to HIPAA guidelines, what is the appropriate use of AI tools in clinical workflows?

   1. Use AI to diagnose conditions and recommend treatments without physician oversight
   2. Use AI to make treatment decisions while the physician is unavailable
   3. Use AI to directly modify patient medical records based on AI suggestions
   4. Use AI to organize information, summarize notes, and draft options for clinical consideration

9. A healthcare worker removes a patient's name from a clinical note before entering it into an AI tool. Is this sufficient for HIPAA-compliant use?

   1. No, all 18 identifier categories must be removed under Safe Harbor
   2. No, only AI tools with BAAs can process any patient data regardless of de-identification
   3. Yes, removing the name is sufficient since names are the primary identifier
   4. Yes, as long as no other obvious identifiers like photos or dates are included

10. Which party is considered a covered entity under HIPAA regulations?

    1. A software company selling AI tools to hospitals
    2. A health insurance company processing claims
    3. A pharmaceutical company advertising medications
    4. A patient advocacy nonprofit providing counseling

11. Why is the AI prompt window considered part of the documentation environment under HIPAA?

    1. Because the prompt window is hosted on government-regulated servers
    2. Because any patient data entered into a system becomes part of the medical record
    3. Because healthcare workers are required to print and file AI conversations
    4. Because AI companies are required to maintain documentation for HIPAA compliance

12. What does the lesson advise about using de-identified examples when uncertain about AI compliance?

    1. De-identified examples are not useful for healthcare AI applications
    2. De-identified examples should only be used with written patient consent
    3. De-identified examples are always safe to use in any AI tool
    4. Use de-identified examples or stop if any of four key questions cannot be answered affirmatively

13. Which of the following is NOT one of the 18 HIPAA Safe Harbor identifiers?

    1. The patient's blood type and Rh factor
    2. Biometric identifiers such as fingerprints
    3. Medical record numbers
    4. Full-face photographs and comparable images

14. A healthcare worker claims, 'I didn't know this was a HIPAA violation' after entering patient data into an AI tool without a BAA. How does this impact penalty assessment?

    1. It converts the violation into a warning rather than a citation
    2. It automatically reduces the penalty to the minimum $100
    3. It eliminates any penalty because intent is required for violations
    4. It is not a mitigating defense and may result in lower-tier penalties

15. Before using any AI tool with patient-related work, a healthcare worker must confirm which of the following?

    1. The AI tool has won industry awards for accuracy
    2. The patient has given verbal consent for AI analysis
    3. The tool is covered by a BAA, all 18 identifiers are removed, the tool is IT-approved, and the worker knows the acceptable use policy
    4. The AI tool can be accessed from personal smartphones