Can a healthcare organization use the Zoom IQ AI Meeting Summary feature?

[Hammock3]

Can a healthcare organization that uses Zoom for discussing PHI (Protected Health Information) safely use Zoom's "Meeting Summary with Zoom IQ" AI tool without violating HIPAA? 

The healthcare organization has a BAA in place with Zoom.

This is in reference to: 

https://stackdiary.com/zoom-terms-now-allow-training-ai-on-user-content-with-no-opt-out/ 

https://blog.zoom.us/zooms-term-service-ai/

[VA]

@Hammock3 We’ve updated our terms of service (in section 10.4) to further confirm that we will not use audio, video, or chat customer content to train our artificial intelligence models without your consent. In addition, our blog post has been edited to include information for our healthcare customers.

[alaurabrody]

Where exactly do you opt out? How can a user give or refuse consent? That needs to be made very clear. Many people use this service for counseling and private sessions that may not be covered by HIPAA, and it needs to be very clear to every user of this service that their personal, private information could at any time be used.

Thank you,

Laura Brody

[VA]

@alaurabrody Zoom Generative AI features are default OFF. Zoom will not use audio, video or chat customer content to train our artificial intelligence models without account owners’ consent. For the two generative AI services we recently launched on a free trial basis (Zoom IQ Meeting Summary and Zoom IQ Team Chat Compose), Zoom customers control whether to enable these AI features for their accounts and can choose to provide their communications content (including audio, video, and chat content) to Zoom for model training. If a customer has opted to share data with Zoom for Zoom’s product improvement purposes, communications content may be used to train AI models. More can be learned here. Examples of what it looks like for admins to opt in, including the pop-ups that meeting attendees will see, are available in our blog post.

[alaurabrody]

Thank you, Virginia. I have seen the recent updates that assure people that the generative AI features are set to off for customer content. My other concern is that this is not the case for telemetry data, which is not considered customer content. This can be  a serious issue.

According to this article :

"Sean Hogle, a tech and intellectual property lawyer, wrote in a post on Hacker News that the new sentence only applies to customer content, which does not include telemetry data. This type of data includes information on the event time, client type, and the client's operating system, according to Zoom's website."

Source: https://www.msn.com/en-us/news/technology/zoom-says-it-wont-use-your-calls-to-train-ai-without-your-...

This is definitely a privacy concern. I am also concerned that admins might opt in for AI, and attendees to their meetings may not fully understand what that entails.

Thank you again,

Laura