USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
erning PHI would not apply. However, as described above, advances in technology can make de-identi - fied data become identifiable data. Thus, even if data is not governed by current laws and the laws do not change, technology changes can cause some of these laws to start applying, causing de-identification to be a moving target requiring ongoing compliance review. Impact of Health Data Space Regulations Unlike the European Union’s Health Data Space Regu - lation, which creates a comprehensive framework for secondary use of health data for research, innovation and policymaking with centralised data access bod - ies and standardised procedures, the United States has no comparable federal initiative establishing a uni - fied health data infrastructure or streamlined access mechanisms for research and product development. The absence of a centralised health data access framework means companies must negotiate indi - vidual data use agreements with healthcare systems, navigate varying institutional policies, address incon - sistent state law requirements across jurisdictions, and manage complex consent requirements when combining data from multiple sources, thus creat - ing significantly higher transaction costs and longer timelines compared to the streamlined mechanisms envisioned in European health data space initiatives, though potentially offering greater flexibility in com - mercial applications once data access is secured. Further, as with any other data type, US-based organi - sations should ensure that any data originating from Europe is obtained and used in a manner that is in compliance with European data privacy laws. 1.5 Processing of Personal Data in the Context of Artificial Intelligence AI-Specific Requirements and Guidance The US lacks comprehensive federal AI legislation comparable to the EU AI Act, and instead largely relies on the application of existing laws to AI usage. One complication that arises from this is that users of AI systems often cannot specify what caused an AI tool to create the output that it created. One common issue is the use of AI tools in decision-making where a protected class (eg, race, religion, national origin, etc) could affect a decision, such as hiring. This creates an extra oversight step when implementing an AI tool because these tools can use secondary information to
infer protected class information and generate outputs on that basis. Several states have introduced legislation specifically governing the use of AI, particularly in relation to deci - sions that are considered significant life decisions, such as hiring, financial decisions, legal decisions, etc. However, the trend in the US is that regulators are relying on the application of existing laws to AI usage to avoid over-regulating the usage of AI. 1.6 Data Breach Requirement Notification Requirements All 50 states have enacted data breach notification laws with varying requirements for timing, triggers, content and scope, creating a complex patchwork that organisations must navigate following a security incident. Generally, organisations must provide notice to affected individuals when there has been unauthor - ised acquisition of computerised personal informa - tion that compromises the security, confidentiality or integrity of the information and creates a risk of harm. Federal sectoral laws impose additional require - ments: HIPAA requires covered entities and business associates to notify affected individuals within 60 days of breach discovery, notify HHS within 60 days (for breaches affecting 500+ individuals, immediate notice; for smaller breaches, annual reporting), and notify media for breaches affecting 500+ individu - als in a state or jurisdiction. GLBA requires financial institutions to notify customers as soon as possible when sensitive customer information has been mis - used, with notification to primary federal regulators. The FTC has authority to bring enforcement actions against organisations that fail to provide reasonable security or that make deceptive statements about their security practices, even absent specific breach notification violations. Organisational Action Items and Authority Investigations Prior to any data breach, organisations should obtain cyber insurance so that breach response resources will be made very quickly available, at controlled costs, and using vendors pre-approved by their insurance. Regardless of whether an organisation has cyber
549 CHAMBERS.COM
Powered by FlippingBook