AI bot sends confidential info out after recording doctors’ meeting: IPC

A personal email address. Otter.ai. A doctor not removed from a meeting invite even through the doctor no longer worked at the hospital.They all added up to a privacy breach, according to the Information and Privacy Commissioner of Ontario (IPC).Canadian HR Reporter, a website, reported there were two critical security gaps in the hospital’s processes:Policy violation: A former physician had used a personal email address to join a hospital meeting group, directly contravening hospital policy.Offboarding oversight: When the physician left the organization in June 2023, the meeting organizer failed to remove them from the recurring meeting invite.The physician installed Otter.ai on a personal device in September 2024. On Sept. 23, 2024, the AI bot automatically joined a virtual hepatology rounds meeting, recorded the session and distributed a transcript containing health info.The IPC confirmed that the personal health information (PHI) of seven patients was compromised, including:Patient names and sexPhysician namesDiagnoses and medical notesTreatment informationThe distribution list included 65 users. The Canadian HR Reporter article notes that 12 of those were no longer employed by the hospital. While 53 recipients confirmed deletion or non-receipt, the remaining former employees could not confirm the deletion of the sensitive transcripts.In response to the breach, the hospital has taken the following steps:Firewall blocks: Blocking access to AI tools like Otter.ai and Deepseek.com while on-site.Enhanced training: Updating staff training to explicitly state that privacy breaches may result in: Disciplinary action, reporting to regulatory colleges, personal fines of up to $200,000, organizational fines of up to $1,000,000.Mandatory reviews: Staff are now required to review meeting participant lists and remove unapproved AI tools before discussing PHI.The IPC made several recommendations beyond the hospital's immediate responses:Direct third-party contact: Organizations should not rely on former employees to delete data. Hospitals contact vendors (like Otter.ai) directly to demand the deletion of unauthorized data.Offboarding audits: Conduct audits to ensure access to all systems—including calendar invites—is revoked upon employee departure.Virtual lobbies: Enforce the use of “waiting rooms” or lobbies for virtual meetings, requiring the host to manually approve every participant.

AI bot sends confidential info out after recording doctors’ meeting: IPC

Register for free access or login.

Related Topics