A public hospital district runs AI on patient-adjacent administrative data. What compliance capability should it track?
Select an answer to reveal the explanation.
Short Explanation
Patient-adjacent admin AI doesn’t get a free pass on rights requests. Track how you’ll honor access, correction, and related data-subject rights—even when the AI is “just admin.”
Full Explanation
Public hospital districts running AI on patient-adjacent administrative data should track GDPR-like data-subject rights handling—processes to receive, verify, and fulfill access, correction, and related requests for personal data processed by or through those AI systems. Even when clinical care AI is segregated, administrative AI for scheduling, billing navigation, or call-center assist can process personal data that triggers rights obligations under applicable regimes and institutional policy. Rights-handling capability is a compliance control, not a courtesy desk script.
A policy that data subjects have no rights regarding AI processing fails legal and ethical baselines for personal data in a public hospital context. Automatic denial of every access or correction request without review fails by concept: blanket denial is not a lawful or defensible rights process. Exporting all administrative AI data publicly with no safeguards fails confidentiality and amplifies breach, re-identification, and misuse risk for patient-adjacent records.
Exam caveat: “GDPR-like” signals rights-oriented process capability; local law may be HIPAA-plus-state privacy rather than GDPR itself—do not invent extraterritorial coverage, but do not skip rights handling where personal data is processed. Operational check: maintain a rights-request runbook covering administrative AI systems, identity verification, response timelines, and logging—and exercise it with a test request against an administrative AI data store.