¿El ChatGPT cumple con HIPAA? cuestionario

Las respuestas y explicaciones aparecen a medida que realiza el cuestionario.

1. ¿Por qué los planes ChatGPT para consumidores, como Free o Plus, no son adecuados para la información de salud protegida?
   • They encrypt data too heavily
   • OpenAI does not sign a business associate agreement for those plans
   • Solo trabajan en ingles.
   • HIPAA bans all AI tools
2. Según HIPAA, ¿cuál de ellos es un socio comercial?
   • A patient reading their own chart
   • A hospital's parking contractor that never sees patient data
   • A vendor that creates, receives, stores or transmits PHI on a covered entity's behalf
   • A health plan
3. Un proveedor anuncia su chatbot como "certificado HIPAA". ¿Qué dice la guía sobre ese reclamo?
   • There is no official government HIPAA certification, so the badge is marketing
   • It means HHS audited the product
   • It replaces the need for a BAA
   • It is required by the Security Rule
4. Un paciente pega sus propios resultados de laboratorio en ChatGPT. ¿Cómo se aplica HIPAA?
   • The patient has violated HIPAA
   • OpenAI becomes the patient's covered entity
   • The lab must report a breach
   • HIPAA does not restrict what patients do with their own information, but the data then falls under OpenAI's terms
5. ¿Qué requiere el método de desidentificación Safe Harbor?
   • Removing only the patient's name
   • Encrypting the file
   • Removing 18 kinds of identifiers, including dates more specific than the year
   • Getting the patient's verbal permission
6. A clinician turns off model training in ChatGPT settings, then pastes a patient note. Why is this still a problem?
   • Turning off training does not create a BAA
   • The setting only works on weekends
   • Training settings delete the account
   • It isn't a problem once training is off
7. Why does the guide call a BAA 'necessary but not sufficient'?
   • BAAs expire after 30 days
   • The organization still has to do a risk analysis, configure access and retention, and disable features outside the BAA's scope
   • BAAs only cover paper records
   • A BAA must also be approved by the FDA
8. After someone pastes PHI into an unapproved chatbot, what does the guide say generally has to happen?
   • Nothing, if the chat is deleted
   • The employee must pay a fixed fine
   • The patient must be discharged
   • A breach risk assessment weighing the nature of the PHI, who received it, whether it was viewed and how well the risk was mitigated