Privacy counsel flags regulatory risk in a GenAI pilot that would ingest resident health notes. What should the program manager recognize?
Select an answer to reveal the explanation.
Short Explanation
Resident health notes are not free training snacks. When privacy counsel waves a red flag, that regulatory risk can stop or reshape the pilot—and early is cheaper than later.
Full Explanation
When privacy counsel flags regulatory risk in a GenAI pilot that would ingest resident health notes, the program manager should recognize that regulatory and privacy risks can halt or reshape civic AI adoption plans and must be assessed early. Health-related personal data typically triggers heightened legal, ethical, and reputational duties; generative systems that train on, log, or leak such content can create severe civic harm. The correct recognition works because early flags should drive scoping, minimization, vendor terms, or no-go decisions—not polite deferral until after launch.
Claiming health notes never create privacy or regulatory obligations fails because resident health information is among the most protected categories in public-sector contexts. Treating regulatory flags as a reason to keep AI pilots secret from counsel fails conceptually—the opposite of sound practice; secrecy increases liability. Asserting privacy concerns only apply to printed flyers, not digital pilots fails because digital processing, storage, and model logging are central privacy risk surfaces.
Exam caveat: a privacy flag is not always a permanent ban; it may require de-identification, purpose limitation, on-prem processing, human review, or choosing a different non-health use case—but those redesigns must be intentional. Operational check: complete a privacy impact assessment, define prohibited data classes for the pilot, verify vendor subprocessors and retention of prompts/outputs, and obtain written counsel conditions before any health-note ingestion.