Healthcare is undergoing significant change due to AI innovation. It enhances medical imaging, discovers new medications, and aids in disease diagnosis. But each breakthrough depends on data. This brings up serious concerns related to national security, cybersecurity and privacy. 

In his recent policy brief, Justin Sherman highlights a pressing issue in the US: how to balance AI progress and data control in healthcare with the need for data to flow across borders. This problem involves not only privacy but also data control, how the data flows and use of data for training AI models. There is also concern that foreign advisories might gain access to this information. 

Health Data Has Become Strategic Infrastructure

For years, health data was primarily viewed as a compliance issue managed under healthcare regulations like HIPAA. 

It’s a rapidly evolving perspective. Some of the most advanced AI systems being built today in the fields of healthcare and life sciences, medical imaging, patient histories, genetic databases, research records, and behavioural health indicators are driven by health data. The need for big, varied, and high-quality datasets increases with the sophistication of the AI system. 

This opens a plethora of innovative opportunities. 

But it also creates significant risks. Health data is personal and cannot be easily replaced if compromised, unlike passwords or credit card numbers. Governments and national security agencies are beginning to see sensitive health and genomic data as assets of strategic importance, data that could be used for surveillance, profiling, intelligence, or future AI model development. 

Why Are Cross-Border Health Data Flows Under Scrutiny?

Modern healthcare systems are operated globally. Cross-border information transfer is frequently necessary for research collaborations, cloud infrastructure, pharmaceutical trials, AI model building, and healthcare analytics. 

At the same time, governments are becoming more concerned about how foreign entities may obtain sensitive information that comes from their own citizens. This concern has grown in the US, especially in relation to nations that are thought to pose a risk to national security. The Protecting Americans’ Data from Foreign Adversaries Act and the Department of Justice’s Data Security Program are two recent initiatives that demonstrate a definite shift toward stricter oversight of sensitive data transfers. 

Government and financial documents are no longer the only focus. These days, biometric identification, health data, genomic information, and even behavioural patterns are considered strategically sensitive assets that need to be actively protected. 

Where HIPAA Falls Short in the AI Era? 

HIPAA was established for a different time, when medical records were kept in filing cabinets or isolated hospital databases rather than constantly flowing via cross-border cloud environments and AI training pipelines. 

The U.S. Government Accountability Office has flagged privacy-related gaps in the federal guidelines pertaining to AI systems, noting out that existing frameworks weren’t built to handle the complexity, speed, or size of how AI models now consume and process personal data. When machine learning systems run by foreign partners, research institutes, or third-party suppliers receive the same data, data governance frameworks that were appropriate for traditional healthcare operations become increasingly insufficient. 

What This Means for Healthcare Organizations and Businesses? 

The implications extend well beyond government policy. Any organization that collects, processes or transfers health-related data including but not limited to hospitals, insurers, wellness platforms, health tech startups, pharmaceutical companies or AI developers, now operates in a far more complex regulatory and geopolitical environment. 

Key areas requiring immediate attention include: 

1. Data Mapping and Data Discovery: Knowing precisely where health data moves across vendors, systems and borders 

2. Consent Management: Ensuring people are aware of and have control over how their health data is used, including for AI training 

3. Vendor Management: Evaluating each third-party partner’s jurisdictional vulnerability and data access rights 

4. Cross Border Transfer Compliance: Compliance with changing DOJ regulations, adequacy rulings, and data localization standards 

5. Privacy Governance Frameworks: Creating internal responsibility processes that go beyond HIPAA checklist compliance 

References

1. Atlantic Council – The US AI Health Data Collision: Charting the Future of US Cross-Border Data Flow Policy, Health Data, and Health and Biopharma AI Policy – Justin Sherman 

2. U.S. Government Accountability Office (GAO) – Artificial Intelligence: OMB Action Needed to Address Privacy-Related Gaps in Federal Guidance 

3. U.S. Department of Justice – Data Security Program and Executive Order 14117 materials 

4. U.S. Department of Health & Human Services (HHS) – HIPAA Privacy Rule guidance

Health data is no longer just a compliance issue. It’s a strategic one.

As AI reshapes healthcare and national security concerns intensify, organizations need privacy frameworks built for today’s reality, not yesterday’s regulations.

Consult Privacy Experts today – Book A Demo