Medical AI and Your Privacy: What to Know Before Your Next Scan
Medical imaging has quietly become one of the fastest-growing areas for artificial intelligence. Algorithms now help radiologists read X-rays, CT scans, and MRIs, sometimes catching details a human eye might miss. The potential for faster, more accurate diagnoses is real. But as AI becomes a routine part of radiology, a less visible issue is emerging: what happens to your medical images and the data inside them once they’re fed into these systems.
In May 2026, a presentation at the Radiological Society of North America (RSNA) annual meeting explicitly warned that medical imaging AI “opens a Pandora’s box of privacy-related risks.” The talk highlighted threats that go beyond the usual data breach headlines. For patients, understanding those risks—and knowing what questions to ask—matters more than ever.
What happened
At RSNA 2026, researchers and privacy experts laid out how AI systems used in medical imaging can create new vulnerabilities. The key concern is that medical images contain far more than just the anatomy being scanned. A chest X-ray, for instance, may include facial features, body shape, and even surgical implants or devices that could be used to re-identify a person even after direct identifiers (name, date of birth) are removed.
The presentation noted that many AI models are trained on large datasets that may be shared across institutions or with third-party vendors. Once data leaves a hospital’s control, it can be difficult to track how it’s used, stored, or combined with other sources. Re-identification—linking anonymized scans back to a specific person—has been demonstrated in academic studies using publicly available image databases. The RSNA talk argued that the same techniques could be applied to AI training datasets, with serious consequences for patient privacy.
Breaches are another concern. Medical imaging data is often stored in cloud-based systems or sent to AI analysis platforms. Each transfer point increases the surface area for potential exposure. The talk cited examples of imaging repositories that lacked basic encryption or access controls, leaving thousands of scans accessible.
Why it matters
For the average patient, these issues may feel abstract. But medical images are among the most sensitive pieces of personal data you can generate. A mammogram or an MRI of your brain reveals details about your health that you might not want shared beyond your care team—information about chronic conditions, mental health, reproductive health, or even genetics (some scans capture incidental findings about bone density or soft tissues that can hint at underlying diseases).
When AI is involved, your data may be used not just for your own diagnosis but also to train future models. While that can improve care for others, it also means your images might be retained, analyzed, or shared for years. Existing laws like HIPAA (in the U.S.) provide some safeguards, but they do not always cover secondary uses of de-identified data. Once data is considered “de-identified,” HIPAA restrictions loosen, and enforcement can be inconsistent.
The RSNA presentation underscored that patients are often not told when AI is being used on their scans, or how their data is handled afterward. In a 2025 survey cited during the talk, fewer than one in four patients recalled being asked for consent before their imaging data was used for AI development.
What readers can do
You don’t need to become a privacy expert to take reasonable steps. Here are practical actions you can consider before your next imaging exam.
Ask your provider about AI use. Before a scan, ask your doctor or the imaging facility whether AI tools are used to interpret your images. If so, ask how your data is stored, whether it is shared with outside companies, and for what purposes (diagnosis only, or also training models). Many facilities have patient information sheets that address this.
Review consent forms carefully. When you sign a consent form for imaging or for participating in research, note any clauses about data sharing. If language is vague—“we may share de-identified data for research”—ask for specifics. You have the right to decline secondary use without jeopardizing your care.
Limit sharing where possible. If you are concerned, you can ask that your images not be included in research or AI training databases. Some institutions allow you to opt out of data collection for non-clinical purposes. It is not always guaranteed, but it is worth asking.
Check for transparency tools. A growing number of hospitals now publish “data use” policies or patient privacy dashboards. The American College of Radiology and other groups have started guidelines for AI transparency. Look for facilities that have earned certifications like the ACR’s AI-Label or participate in the Patient Privacy Rights initiative.
Understand your rights under relevant laws. In the U.S., HIPAA gives you the right to access your own medical images and request an accounting of disclosures. In the European Union, the GDPR provides stronger protections, including the right to erasure in some cases. If you are outside these regions, your local health privacy law may offer similar rights.
Watch for red flags. Be wary of imaging centers that are vague about data practices, especially if they offer free or discounted scans in exchange for access to your data for research. If a facility cannot give you a straight answer about who has access to your images and for how long, consider going elsewhere.
Sources
The primary source for this article is the RSNA 2026 presentation “Medical Imaging AI Opens a Pandora’s Box of Privacy-Related Risks,” delivered at the annual meeting of the Radiological Society of North America in Chicago. Additional context was drawn from publicly available summaries of that presentation, as well as prior RSNA releases on AI in radiology and patient privacy. The facts about re-identification risks and data breach examples are based on the presentation’s cited studies, which include peer-reviewed work from academic journals such as Radiology and JAMA Network Open.
For further reading, the RSNA maintains a resource page on AI and ethics at rsna.org/ai-ethics. The American College of Radiology also offers a patient guide to AI in imaging at acr.org/Patient-Resources/AI.