Four paths to voice innovation through healthcare provider and technology partnerships
By, Denesh Pohar, Principal Architect
Voice-driven agents offer massive potential to the healthcare industry. However, real-world voice data may contain individually identifiable protected health information (PHI) that is required by law to be strictly managed and highly secured.
Most of the expertise for building advanced voice-driven AI resides in the technology industry and academia, and not within the healthcare industry. But, even with the best machine learning experts, if training data is not representative of the real world, the system is doomed to be garbage-in garbage-out.
This begs the question: how can AI in healthcare solutions be built cheaply and rapidly with PHI data, while staying true to the letter and spirit of data protection laws and regulations?
There four major approaches to this:
1. Leverage existing de-identified corpora
2. De-identify real-world voice PHI
3. Technology partner copies PHI data
4. Healthcare provider hosts PHI data
Each of these options has different work involved to implement, which is summarized in the table below.
| Option 1 | Option 2 | Option 3 | Option 4 | |
| De-identification work required? | N | Y | N | N |
| HIPAA Protected Data? | N | N | Y | Y |
| Technology Partner-managed Copies of PHI? | N | N | Y | N |
De-identifying Voice Data
De-identified corpora are ideal, because they avoid most legal concerns. However, de-identified healthcare voice data either does not exist or is very hard to get. So, unfortunately, Option 1 isn’t available.
Voice data is difficult and costly to de-identify at scale, relying on techniques such as muting PHI, having actors reenact encounters, etc. So, Option 2 has a substantial up front cost to be paid in full before work can begin.
Working with PHI
In order to use PHI in AI research, technology partners must have a legitimate purpose for collecting and using the data, with clear user consent and appropriate controls for handling and disposing of data, among other things. Although privacy principles suggest minimizing the amount of data collected and limiting access, a researcher may be required to view PHI in order to develop AI models.
Having AI practitioners work with PHI data directly enables rapid prototyping of real-world solutions, testing hypotheses, etc. Once the decision is made to work with PHI, the next question is how to share it. Options 3 & 4 offer different approaches.
Option 3: PHI hosted by Technology Partner
Option 4: PHI hosted by Healthcare Provider
With Option 3, the technology partner may incur significant risk and complexity in hosting the PHI itself, and must implement security controls (authentication, authorization, auditing, etc.). Such infrastructure does not always exist. However, Option 4 can leverage existing infrastructure that the healthcare provider’s IT department has already put in place.
Microsoft Healthcare NExT has successfully deployed the Option 4 approach. Some of the key takeaways for this approach:
- All PHI data remains hosted by the healthcare provider. Technology partner shall not take any copies of it out of the sandbox environment.
- The healthcare provider grants remote access, via its existing remote work access portal, to specific, approved individuals from the technology partner, accessing specific data.
- The cloud is indispensable here, because ML workloads typically need a lot of computing power. Economical on demand scalability helps reduce cost.
We have identified a way for healthcare providers & technology leaders to partner quickly, effectively, ethically and legally, and therefore facilitate the innovation needed to push the state of health delivery forward faster.