AI Health Data Privacy Risks and How to Protect Yourself

People often turn to large language models to interpret lab results because traditional healthcare can feel slow or confusing. The speaker, despite authoring a book on health‑data privacy, admitted to uploading personal lab results to an AI portal, saying, “I had just put my own protected health information into a completely unprotected portal.” Roughly 40 million users per day ask ChatGPT health‑related questions, illustrating the scale of this impulse.

The Scope of the Problem

Health‑data hacking has become commonplace. In 2024, three in four Americans experienced at least some form of health data breach, and about 50 % of the population is expected to have data hacked annually. Medical identity theft imposes a heavy burden—on average it takes 200 hours and $14,000 to resolve. Data brokers compile and sell lists based on conditions such as HIV/AIDS, depression, or weight‑loss goals, and companies like GoodRx, BetterHelp, Hims, and Hers have been cited for selling user data to advertisers.

The AI Factor

HIPAA, passed 30 years ago, was designed to protect information within formal healthcare systems and never applied to digital health apps or AI tools. Today, AI companies are launching features that integrate directly with personal health records, while privacy policies remain fluid. Companies may alter terms of service or even sell data during bankruptcy, as seen with 23andMe. Some AI firms, such as Anthropic, are reportedly pulling back on internal privacy safeguards to stay competitive in the “AI arms race.” The speaker warns, “The cat is out of the bag when it comes to our healthcare data privacy.”

Navigating the Future

To mitigate risk, users should exercise rights under state privacy laws—California, for example, allows individuals to access or delete collected data. Before linking medical records to an AI, consider potential consequences for employment, security clearances, and legal exposure, including subpoenas for reproductive‑health information. Safer practices include redacting identifying details or asking questions in general terms rather than providing exact lab values. The speaker advises, “If you do end up connecting to your medical record, slow down.” Ultimately, a new societal paradigm is needed that supports victims of data breaches rather than attempting to lock all data down, because “the kicker is most of your data is already out there. So if you use these tools, at least you get some upside.”