Privacy

We’ve talked a lot about how technology is transforming healthcare. From ambient listening devices to voice-based assistants, we’re seeing a data explosion. This shift (what many call a “data revolution”) is especially visible in the rise of AI scribes: tools that automatically generate clinical notes from doctor-patient conversations.The promise is big: faster diagnoses, more personalized care, and a lighter admin load for clinicians. But there’s a catch: most of this data never gets used.

We discussed how new technology is transforming healthcare: As the volume of electronic data continues to increase, many sectors refer to this phenomenon as a data revolution. And though this revolution promises faster diagnoses and personalized care, it comes with a catch: most of that data is never even used.Welcome to healthcare’s quiet crisis: the abandonment of unstructured data.

The way healthcare organizations collect and use critical data is changing, and changing fast. From smartwatches to AI-powered documentation, new technologies are transforming how patient information flows, creating new opportunities for continuous health monitoring, early intervention, and improved clinical outcomes. But with so many tools entering the space, it can be hard to keep up.

Clinical notes. Imaging reports. Lab results. Transcripts from patient conversations. It’s all full of critical insights, but none of it fits neatly into rows and columns – it’s all unstructured data.

We’ve said it before, and we’ll say it again: healthcare data has the power to transform care. It can personalize treatments and speed up diagnoses in ways we’ve only dreamed of.But here’s the part nobody really likes to talk about: most healthcare data strategies fail before they even get off the ground.

The European Data Protection Board (EDPB) recently released its comprehensive Guidelines 01/2025 on Pseudonymisation, a document rich with practical insights into the application of pseudonymisation under the General Data Protection Regulation (GDPR).

On December 27, 2024, the U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), issued a proposed rule to enhance the cybersecurity measures required under the HIPAA Security Rule. This Notice of Proposed Rulemaking (NPRM) seeks to bolster the defenses of the U.S. healthcare system against the rising tide of cyberattacks, particularly those targeting electronic protected health information (ePHI). The changes aim to address critical weaknesses, clarify obligations, and align the Security Rule with modern cybersecurity practices.

Anonymized and pseudonymized medical data are at the heart of cutting-edge research and innovation in healthcare. By stripping away personal identifiers and adding additional privacy-preserving measures, these data allow for advanced studies without compromising the privacy of individuals.In Japan, as elsewhere, the path to leveraging this valuable resource has been complex due to the need to balance large-scale data use with privacy protection. Thus, under the Act on the Protection of Personal Information (APPI) healthcare providers have faced challenges in sharing and processing medical data for research and innovation purposes, primarily due to strict consent requirements.

As the world gears up for the AI Action Summit in Paris in February 2025, global policymakers, researchers, and industry leaders are turning their attention to a landmark publication: The International AI Safety Report 2025. This report, a collaborative effort by 96 AI experts from around the world, represents the most comprehensive scientific assessment to date of the risks posed by general-purpose AI—a rapidly advancing form of AI with the ability to perform a wide range of tasks.

I’m thrilled to announce Private AI 4.0. This release redefines how healthcare businesses harness their unstructured data while maintaining fine-grained privacy controls and the highest standards of compliance. With Private AI 4.0, we are turning challenges into opportunities by enabling analytics confidently and securely to improve patient outcomes, accelerate research, and drive operational efficiency.

The European Data Protection Board (EDPB) has recently provided critical guidance on ensuring GDPR compliance during the development and deployment of AI models.

Artificial intelligence and large language models (LLMs) are transforming the way we work, and the boundaries of data privacy are being tested like never before. While most organizations have measures in place to secure their proprietary algorithms and internal data repositories, there’s a growing challenge that can’t be overlooked: the uncontrolled sharing of Confidential Company Information (CCI) by users interacting with third-party AI systems.

The US insurance industry operates under a complex landscape of privacy laws and regulations designed to protect consumers’ personal information. At the heart of this regulatory framework are standards developed by the National Association of Insurance Commissioners (NAIC), alongside federal and state laws like the Gramm-Leach-Bliley Act (GLBA).

The Belgium Data Protection Authority’s recent report, Artificial Intelligence Systems and the GDPR: A Data Protection Perspective, is a timely analysis exploring the interplay of the General Data Protection Regulation (GDPR) and the EU Artificial Intelligence (AI) Act.

Quebec’s new Act Respecting Health and Social Services Information (ARHSSI) introduces a notable tightening of data privacy requirements within the province, with a distinct emphasis on safeguarding health and social services information.

In the fast-evolving world of AI, where data is at the core of decision-making, one challenge remains constant: ensuring appropriate privacy and protection of an individual’s and an organization’s data. At Private AI, we’ve been working on solving this challenge with the introduction of Coreference Resolution as part of our 4.0alpha release.

We previously wrote about Unlocking Compliance with the Japanese Data Privacy Act (APPI) using Private AI and are now following up with an assessment of the Interim Report on Considerations for the Triennial Review of the Act on Protection of Personal Information (Interim Report).

Thailand’s Personal Data Protection Act (PDPA) was signed into law in 2019 and came into force in mid 2022. It is in many ways inspired by Europe’s General Data Protection Regulation (GDPR) but with some notable differences, e.g., potential prison time for violations in addition to criminal and administrative fines and a greater social good carve-out from the consent requirement when processing sensitive information.

AI has undoubtedly taken over the world, becoming an indispensable tool for companies looking to maintain a competitive edge.

Differential privacy is a hot topic given the many conflicting opinions on its effectiveness. For some background, we previously wrote a comprehensive post on the Basics of Differential Privacy where we discussed the risks and how it can also enhance natural language understanding (NLU) models.

GDPR compliance, privacy and engineering team collaboration, and common mistakes companies make with their data.

Discussing developer responsibility, Bill C-11, positive consent, and the importance of Privacy by Design

“When is anonymization useful?” is a tricky question, because the answer is highly data-type- and task-dependent.

On the misleading ways journalists and industry use the term "anonymization."

Understanding key tech for data protection regulation compliance

In the past three years there has been a massive wake-up in customer awareness about privacy. Many customers are now refactoring how they buy, taking their business elsewhere if they don’t trust a company’s data practices.

Privacy Enhancing Technologies Decision Tree: for developers, managers, and founders looking to integrate privacy into their software pipelines and products.