Beyond the Prompt: Part III

What information should you protect?

Patient and clinical information is an obvious example.

And then there is everything else, much of it shared without a second thought:

  • Medical bills
  • Insurance cards
  • Tax documents
  • Leases
  • Legal correspondence
  • Internal emails
  • Screenshots
  • System configurations
  • Credentials or tokens
  • Health questions containing identifying details
  • Information about patients, coworkers, family members, or customers

There’s also an important point that is overlooked: Not all the information you give an AI belongs to you.

Paste an email thread into an AI tool and you’ve potentially shared information written by other people. Ask an AI to analyze a family member’s medical situation and you’ve shared someone else’s private information. Give an AI access to a folder and you’ve potentially given it access to information about everyone represented in those files. Connect an AI to a database and you’ve potentially given it access to information belonging to thousands of people. These people may never know that their information was submitted, retrieved, or processed by that service.

What stays on your device

Not all of it goes out. Some AI runs entirely on the device. Keyboard autocorrect and next word prediction, face and object recognition in your photo library, on device dictation, and some of the newer writing and summarizing features on recent iPhones and Windows laptops are handled locally.

That is less reassuring than it sounds, for two reasons. The same feature can run locally on one request and reach for the cloud on the next, depending on the size of the task, your hardware, and your settings. And what runs where changes with updates, without announcing itself.

Local also does not mean risk free. It means the risk moved. Information processed on your device is still on your device, which matters if that device is lost, shared, or compromised.

At work

The safest approach is straightforward: Use the AI tools that UTMB has approved.

Approved tools operate under agreements and controls intended to address how organizational information is handled.

https://www.utmb.edu/ai/approved-generative-ai-tools

At home

At home, there generally isn’t an organization negotiating those terms on your behalf or reviewing the provider’s data-handling practices for you. You are responsible for deciding what information you’re comfortable sending to an AI service. And remember, that decision isn’t limited to what you type.

Before using an AI tool, ask yourself three questions:

  1. What am I giving it?
  2. What can it see?
  3. What can it go get?
Those three questions cover a lot more than simply asking whether you’re about to paste something sensitive into a chatbot. The security boundary isn’t the chatbot; it’s the information the AI has access to. Once you give an AI service access to something, you don’t have much control over what happens next.
Back to all news