The adoption of artificial intelligence (AI) technologies in the healthcare and digital health sector is rapidly gaining momentum, offering significant potential to enhance patient care, improve diagnostic accuracy, and streamline administrative processes. From small allied health practices to large hospitals, many organisations are already leveraging generative AI and large language models (LLMs) to optimise their operations.

However, this technology comes with a considerable set of cybersecurity and privacy risks that healthcare providers must address. Understanding these key risks is essential for protecting patient data, securing the provider’s digital environment, and maintaining compliance with the relevant compliance frameworks, such as the Privacy Act 1988.

Importantly, AI tools are not immune from standard cybersecurity risks stemming from vulnerabilities, misconfigurations, insecure integration, and third-party dependencies through their architecture or software “wrappers”. Such risks can be multiplied in scenarios where where developers prioritise market positioning over security, and where organisations may adopt these tools without sufficient due diligence, creating a potential security gap.

There are also an additional set of AI-adjacent risks stemming from potential data poisoning and injection attacks, incorrect handling of personal information, inaccuracy of outputs, and unauthorised or unintended third-party access to user prompt-based personal data.

In light of these risks, it is imperative to establish robust frameworks for the implementation of AI technologies. Organisations should conduct comprehensive due diligence, ensuring that privacy and cybersecurity considerations are at the forefront of their AI strategy. By fostering an environment that prioritises safety and compliance, the healthcare sector can embrace the transformative potential of AI while safeguarding patient data and maintaining trust.