Read time: 4 minutes
Managed care organizations (MCOs) should implement and maintain both operational controls and contractual safeguards to prevent artificial intelligence (AI) developers from receiving and using personal information and other proprietary and confidential information for unintended purposes.
Technology that uses AI will not reach its potential if the individuals using and affected by the technology do not trust it. We see this lack of trust cited in statements by politicians, the media, and individuals (in lawsuits) in connection with the use of AI. One contributor to this perspective is the perception that companies lose control of large amounts of data to AI developers when they develop, train, and use AI models. This article highlights six considerations to help retain control of data when engaging an AI developer. It assumes the reader has some foundational knowledge of AI terminology and characteristics.
1. Rights to MCO’s datasets and subsets, compilations and derivatives
AI developers typically will not assert ownership over datasets provided by an MCO to develop, train or use an AI model and will agree to limit their rights to such data. However, MCOs should contractually protect the datasets and also all subsets, compilations and derivatives of the datasets. In other words, the contract should be drafted to reduce the risk that an AI developer will argue that it has created net-new data (that it owns) when the AI developer processes the dataset. For example, an AI developer may perform significant processing of datasets to convert the data into a form usable by the AI (i.e., a derivative of the original dataset) or the AI developer could combine an MCO’s data with other data (i.e., a compilation) for AI development and training purposes.
2. Access to MCO’s datasets
MCOs can take additional operational steps to protect their datasets. Even if the contract assigns ownership of data to an MCO, identification and prevention of data misuse by an AI developer may be difficult or impossible. To help counteract this concern, many of the more sophisticated AI developers have bifurcated their AI solution so that the foundational pre-trained AI model runs in the developer’s environment, and an MCO’s datasets used to train the AI model remain in the MCO’s environment. MCOs should ask about operational steps the AI developer can take to limit or prevent access to MCOs’ datasets and contractually require compliance with those limits.
3. Rights to fine-tuned weights
To improve the quality of AI models, MCOs will likely want to train (e.g., customize or fine tune) the pre-existing, out-of-the-box AI models provided by AI developers. Industry terminology is inconsistent, but commonly AI developers describe the part of the AI model that is customizable for customers through training/fine tuning as the set of “weights” within the model. Therefore, “fine-tuned weights” are the aspect of an AI model that has been customized using an MCO’s datasets and will reflect the MCO’s business practices (and may be trade secrets). Regardless of terminology, an MCO should ensure that contracts do not grant AI developers ownership of or the ability to use the fine-tuned weights for anything other than providing the AI solution to the MCO. Even if an MCO grants some rights to the fine-tuned weights, MCOs should contractually prohibit using or sharing fine-tuned weights with competitors.
- Despite fears, sophisticated AI developers are generally not trying to take their customers’ data
- MCOs should focus on operational steps that can be taken to protect data and trade secrets in addition to executing strong contractual protections
- A mature AI governance program should incorporate standard contracting principles with AI developers as well as operational safeguards for data shared with AI developers