Privacy, Security and AI in the Workplace

In this episode, Brach Eichler’s Healthcare Law team breaks down one of the most urgent issues facing healthcare organizations today: the rising use of artificial intelligence in the workplace—and the serious privacy, security, and compliance risks that come with it.

Member Lani M. Dornfeld, Esq., CHPC, explores how generative AI tools handle data, why seemingly “de-identified” information may not be as safe as it appears, and what happens when workforce members rely on AI without proper governance.

Listeners will learn key steps healthcare organizations can take to protect PHI and confidential business information, including AI governance structures, vendor vetting, regulatory compliance initiatives, and ongoing monitoring practices.

Tune in for practical, actionable guidance on managing AI responsibly and maintaining compliance in an evolving digital landscape.

📞 If you would like a copy of our Compliance Checklist for Effective Management of AI in the Workplace or assistance with your organization’s privacy and security program, please contact: Lani M. Dornfeld, Esq., CHPC, at 973.403.3136 or [e-mail].

*This is intended to provide general information, not legal advice. Please contact the authors if you need specific legal advice.

Episode Transcript

(00:00):
Thank you for tuning in to the Brach Eichler Talks podcast

(00:06):
, where we explore and discuss today's trending legal topics.
In this episode, we'll discuss a recent article from Brach Eichler's December Healthcare Law
Update titled, "Privacy, Security, and AI in the Workplace." Recent polls and news articles
indicate that a significant portion of the workforce is using artificial intelligence (AI) tools for work purposes.

(00:28):
Absent organizational regulation, training, and oversight, employees will use these tools as
they see fit… This puts health care organizations at risk of breach of both protected health
information and confidential business information among other risks.
Many AI tools use "generative" AI, a type of artificial intelligence designed to produce new

(00:49):
material- such as text, images, audio, and other output- based on patterns the model has
"learned" from large collections of data.
The model is continuously hungry for more and more data, that is, "input." Because generative
AI models are typically built on large shared model architecture, data provided in the form of
"prompts" may be stored somewhere the organization does not control, may be processed along

(01:14):
data provided by outsiders, is often used to "train" and "improve" the model, may be handled
by multiple vendors and subprocessors, and may be retained in unexpected or unknown ways.
Resultingly, a health care organization's data may be at significant risk when workforce
members use generative AI tools, especially without governance and oversight.

(01:36):
This is true even when the user believes inputted data has been de identified.
Generative AI models can piece together rare combinations of facts, distinctive data,
narrative patterns, biographical details, and other input, which could result in the model
being able to attach specific health and other personal information to a specific individual.

(01:58):
Health care organizations can address these and other risks through a combination of:
Governance- establishing and deputizing a cross functional AI governance committee responsible
to oversee AI management and work force training.
Vendor/App Vetting- adopting protocols for vetting potential AI apps and scrutinizing AI vendor
contracts… Regulatory Compliance

(02:20):
Initiatives- establishing and implementing legal and regulatory compliance initiatives.
Ongoing Monitoring- monitoring workforce activity, obtaining workforce feedback, conducting
periodic compliance audits, and staying abreast of changes in law and in the AI marketplace…
If you would like a copy of our compliance checklist for effective management of AI in the

(02:42):
workplace or assistance with your organization's privacy and security program, please contact Loni M.
Dornfeld, Esq., CHPC, at 973-403-3136 or [e-mail].
Don't forget to subscribe to our podcast on Spotify, Apple Podcasts, and YouTube.
Follow us on LinkedIn and Facebook for updates on new episodes.

(03:04):
For more information and resources, visit brock eichler dot com.
This is intended to provide general information, not legal advice.
Please contact the authors if you need specific legal advice.
Brach Eichler LLC is a full service law firm based in Roseland, New Jersey with over eighty attorneys.
The firm is focused on the following practice areas, health care law, real estate, litigation

(03:28):
, trusts and estates, business transactions and financial services, personal injury, criminal
defense and government investigations, labor and employment, environmental and land use,
family law services, patent, intellectual property, and
information technology, real estate tax appeals, tax, and cannabis.