Medical Imaging AI Puts Your Privacy at Risk: What You Need to Know
Artificial intelligence is increasingly used to interpret X-rays, MRIs, and CT scans. The technology can spot tumors or fractures faster than the human eye, and hospitals are adopting it quickly. But as a recent article from the Radiological Society of North America (RSNA) points out, this shift brings serious privacy risks that patients rarely hear about.
When you undergo imaging, the data isn’t just a picture of your bone or organ. It often includes your name, date of birth, medical record number, and sometimes biometric information. AI systems that process these images may send the data to cloud servers owned by third-party vendors. How those vendors handle your data is not always clear, and existing laws like HIPAA have limits that leave gaps.
What Happened
At RSNA 2026, experts presented findings on the privacy vulnerabilities introduced by medical imaging AI. The core issue: many AI tools are developed by companies that are not directly covered by HIPAA. While the hospital must follow privacy rules, the software vendor may not. Contracts and business associate agreements are supposed to bridge this gap, but enforcement is inconsistent.
Additionally, researchers demonstrated that de-identified images—those with visible patient details removed—can sometimes be re-identified. Metadata embedded in the image file (such as scanner serial numbers, dates, or facility codes) can be combined with public records to link an image back to a specific person. This risk is not theoretical; it has happened in other sectors of health data.
The RSNA article, published in May 2026, explicitly calls this a “Pandora’s box” of problems, urging radiologists and patients alike to consider the trade-offs.
Why It Matters
Health data is among the most sensitive information about a person. A leaked medical record can lead to discrimination in insurance or employment, identity theft, and personal embarrassment. Unlike a stolen credit card number, you cannot change your medical history.
Medical imaging AI amplifies the risk because it often involves large datasets being transferred, processed, and stored by multiple parties. A breach at a single vendor could expose thousands of patients’ scans. Furthermore, patients often unknowingly consent to data sharing as part of standard imaging consent forms. The forms are long, full of legal jargon, and few people read them carefully.
The regulatory picture is incomplete. HIPAA covers providers and insurers, but many AI developers are not “covered entities.” State laws like California’s CCPA or Washington’s My Health My Data Act offer some additional protection, but they vary widely and do not fully address the cloud-computing architecture used by many AI tools. Federal privacy legislation remains stalled.
What Readers Can Do
While you cannot eliminate these risks entirely, you can take practical steps to protect your privacy before undergoing a scan.
Ask about AI use. When your doctor orders an MRI or CT, ask whether AI will be used to interpret the images. If yes, ask which company provides the software. You have a right to know who handles your data.
Request a copy of the consent form. Before you sign, read the form. Look for clauses that mention data sharing, cloud processing, or research use. If you are uncomfortable, ask to speak with the privacy officer at the facility.
Ask about data retention and deletion. Find out how long your images and the AI-generated analyses are kept. Some vendors store data indefinitely for algorithm improvement. You may be able to request deletion after a certain period, though laws vary.
Opt out if possible. Some facilities allow you to decline AI analysis and still receive a human read. This option may not be widely advertised, so ask directly.
Limit non-essential scans. Some imaging is not medically necessary. Discuss with your doctor whether the scan is truly needed. Fewer scans mean fewer data points in the system.
Monitor your medical records. Periodically review your electronic health record for unauthorized access or unfamiliar entries. Many patient portals let you see who has viewed your data.
Sources
- “Medical Imaging AI Opens a Pandora’s Box of Privacy-Related Risks,” Radiological Society of North America, May 20, 2026. (Accessed via Google News RSS)
- RSNA 2026 conference coverage on privacy and AI.
- HIPAA Privacy Rule, U.S. Department of Health and Human Services.
- California Consumer Privacy Act (CCPA) and Washington My Health My Data Act.
The RSNA article is a clear warning from within the radiology community. It acknowledges that innovation and patient safety are not mutually exclusive, but that privacy protections need to catch up. As a patient, staying informed and asking questions is the best defense.