by Dr. Vikram Venkateswaran
In the realm of Generative AI (Gen AI), the healthcare industry is on the verge of transformative changes that promise to reshape the delivery of care. Within this paradigm shift, one critical aspect demanding attention is the role of cybersecurity controls.
In a recent announcement, Paul McCartney, the last surviving Beatle, declared that the group would release a ‘final’ Beatles song1. This news garnered significant attention, given that the other band members have passed away. What we now know is that Gen AI will be used to create the song based on unreleased recordings of the lead singer, John Lennon. This showcases the power of Gen AI and the potential of this emerging technology.
While music has a huge impact on health, the Life Sciences and Health Care (LSHC) industry is not very far behind in its adoption of Gen AI. In life sciences, Gen AI is poised to develop drug candidates, screen potential therapies, and then map their impact even before clinical trials.This approach will ensure a reduction in the time spent on drug discovery and the thorough assessment of the efficacy and toxicity of drug candidates before they advance to human clinical trials.
Gen AIsignificantly impacts the patient experience by streamlining healthcare data, clinical data diagnosis, and clinical decision support systems, as well as increasing access to care. In a nutshell, there are four key areas where Gen AI can be seen to impact the LSHC industry:
1) Improving clinical operations efficiency
2) Enhanced patient experience
3) Enabling novel Research and Development (R&D)
4) Shaping new care models
While the industry’s transformation is promising, for the Gen AI programs to scale and be adopted across the value chain, there must be a strong focus on cybersecurity controls. These controls must scale with the Gen AI programs to ensure their success in meeting business and clinical objectives.
In the case of Drug Discovery mentioned above, there is a significant risk of Intellectual Property (IP) of the pharmaceutical company. This risk arises because Gen AI models are trained on the organisation’s clinical data, and unauthorised individuals or those with malicious intent could gain access to this data, leading to potential IP theft.
To mitigate such risk, the pharmaceutical company would need to invest in cybersecurity measures such as encryption, secure data hosting, and privilege access management, among others. These cyber investments are crucial to reduce the risk of IP loss, which, in turn, can impact the growth and development of the pharmaceutical company.
Furthermore, six categories of cyber risks associated with Gen AI models must be addressed to ensure the scalability and commercial success of these programs:
1) Generative AI Model Risk- Vulnerabilities in the Large Language Models (LLMs) itself that can lead to loss of IP.
2) Infrastructure Risks- Inherent risks in the cloud or on-premises infrastructure used to host these Gen AI models.
3) Data Risks – Particularly relevant to LSHC, encompassing data identification, classification, and overall security due to new regulations like the Digital Personal Data Protection Act (DPDPA) and the sensitivity of clinical data.
4) People Risk – Ensuring that the right people work on these models and that Gen AI models do not cause harm in the course of their decision-making.
5) Application Risk- Vulnerabilities in the AI algorithms themselves, leading to suboptimal results or data leakage.
6) Training and Testing Risk – Cyber risks related to the process of leveraging training and testing data for healthcare.
To manage these risks effectively, a structured approach is essential, beginning with a focus on business and clinical objectives for using Gen AI. This should be supported by a governance layer comprising policies, procedures, cybersecurity measures, risk management, and controls. Establishing processes for Gen AI life cycle management, including adoption, maintenance, scaling, customisation, and decommissioning, is the next step.
Lastly, adherence to regulatory compliance and key principles of risk controls like confidentiality, integrity, availability, authenticity, authorisation, and privacy is essential to ensure the success and security of Gen AI in the healthcare and life sciences sector.
To conclude, the LSHC industry’s success or failure in adopting Gen AI depends on its capacity to effectively handle cybersecurity risks. Giving due diligence to this aspect will pave the way for Gen AI’s widespread development and contribute to the continued advancement of human potential and growth.
Dr. Vikram Venkateswaran, Partner, Risk Advisory, Deloitte India
(DISCLAIMER: The views expressed are solely of the author and ETHealthworld does not necessarily subscribe to it. ETHealthworld.com shall not be responsible for any damage caused to any person / organisation directly or indirectly.)
