Reed Smith In-depth

Key takeaways

  • Health care may be one of the first industries targeted with federal AI regulation in the United States.
  • The Department of Health and Human Services will be heavily involved in developing a strategy for regulation of AI development and use within its areas of oversight in 2024. Congress is taking a more measured approach and its future involvement in AI regulation remains unclear.
  • Companies that implement compliance-by-design in their developed and deployed AI, through a mature AI governance program, may significantly reduce business and legal risk and cost from AI in the long run.

Companies in the health care industry are commonly at the forefront of collecting and using personal health data and cutting-edge technology to improve and personalize patient care. That objective often means that health care companies must interpret and apply old (and obsolete) laws and regulations to products and services unimagined at the time of enactment. The lack of a modern legal framework related to personal health data and emerging technologies in the United States and the associated legal and business risks can lead to the unintended negative consequence of reduced investment by the health care industry in new products and services.

For better or worse, Congress has not acted with alacrity to modernize laws that regulate privacy, cybersecurity, data breach response, or young technologies growing in importance, like artificial intelligence (AI). The Health Insurance Portability and Accountability Act (HIPAA) regulates the collection, use, disclosure, and security of certain personal health data and practices in the health care industry, but HIPAA was originally enacted nearly 30 years ago and is of limited scope.

That is not to state that Congress has not been considering the issues, but proposed bills in these areas have made little progress. For this reason, some state legislatures have enacted laws to help fill the void. Over the last year, the White House has been more potent than Congress in its sphere of control. While such activity could potentially influence laws and regulations at the federal level of government in the United States, the impact may be limited as the White House’s role is to enforce laws – and not create them.

This alert looks at some of the most recent activity by Congress and the White House with respect to the development and use of AI so that companies in the health care industry can be aware of what the future may bring.