AI in Medical Imaging Is Raising New Privacy Risks—Here’s What You Need to Know

Artificial intelligence is making radiology faster and more accurate. Algorithms can spot tumors, fractures, and early signs of disease that human eyes might miss. But the same technology that analyzes your CT scan or MRI also creates new ways your medical images could be exposed, de-anonymized, or shared without your knowledge.

Recent discussion at the Radiological Society of North America (RSNA) highlighted a growing concern: the very data that trains and powers AI in medical imaging can open a Pandora’s box of privacy risks. Here’s what that means for patients, and what you can do about it.

What happened

The RSNA article “Medical Imaging AI Opens a Pandora’s Box of Privacy-Related Risks” (published May 2026) outlines several vulnerabilities introduced when AI systems are applied to medical imaging. Unlike traditional film or DICOM images stored in a hospital’s secure system, AI models often require access to large datasets—sometimes shared across institutions or with third-party vendors. The scan itself, stripped of obvious identifiers like name and date of birth, can still be re-identified through facial reconstruction from a CT or MRI of the head, unique bone structure, or even the pattern of blood vessels in a retina scan.

Researchers have shown that de-identified medical images can be matched to individuals using publicly available data or other health records. The RSNA piece specifically warns that the metadata embedded in imaging files—such as scanner serial numbers, acquisition dates, and facility locations—can create a fingerprint that ties a scan back to a person.

Why it matters

Privacy protections in healthcare were designed for an era of paper charts and film jackets. HIPAA in the United States and GDPR in Europe cover identifiable health information, but they were not written with AI in mind. The “de-identification” standards that many hospitals rely on were never meant to withstand modern re-identification techniques.

Consent forms often ask patients to allow their data to be used for “research” or “AI development,” without explaining that scans might leave the hospital network, be stored on cloud servers, or be fed into commercial algorithms. Once an image is used to train a model, it may be retained indefinitely. A patient who agrees to share their lung CT for a study on cancer detection has little control over whether that same scan is later used to train a facial recognition algorithm.

Real-world breaches have already occurred. In 2024, a major cloud-based image sharing platform used by multiple hospitals suffered a breach that exposed millions of scans. While no cases of re-identification were confirmed public at that time, the potential was there. And the more AI systems need large, diverse datasets, the more attractive those datasets become to attackers.

What readers can do

You don’t have to avoid medical imaging. But you can take steps to understand and limit how your data is handled.

  • Ask your provider before the scan. When you schedule an MRI or CT, ask: “Will my images be used for AI research or commercial purposes? Can I opt out?” Most hospitals have consent forms that you can modify or decline. If you say no to data sharing, your care should not be affected.

  • Read the fine print on consent forms. Look for phrases like “future research,” “third-party partners,” or “AI algorithm development.” If the language is vague, ask for specifics. If you’re uncomfortable, request a version that restricts use to your direct medical care.

  • Inquire about cloud storage. Ask where your images are stored. Are they kept on premise, or in the cloud? If the latter, confirm that the vendor has strong encryption and a published data retention policy.

  • Follow up after your visit. You have a right to access your own medical images. Request a copy for your personal records, and ask how to be notified if the hospital or imaging center issues a breach notification.

  • Support stronger regulations. Current laws are catching up slowly. The proposed Health Data Use and Privacy Act in the U.S. and similar EU initiatives aim to close gaps. Letting your representatives know this matters can help accelerate change.

Balanced innovation

AI in radiology can save lives. But the rush to adopt it has outpaced the safeguards. Patients deserve both the benefits of smarter diagnostics and the assurance that their most personal data—their body’s internal images—won’t be used in ways they never intended. Being informed and asking questions is the first step.

Sources

  • Radiological Society of North America, “Medical Imaging AI Opens a Pandora’s Box of Privacy-Related Risks” (May 2026)
  • HIPAA Privacy Rule (45 CFR Part 160 and 164)
  • General Data Protection Regulation (EU) 2016/679