When Your X-Ray Is a Deepfake: The Privacy Risks of Medical AI

Artificial intelligence is changing medical imaging for the better—faster reads, better detection, fewer missed tumors. But the same technology that helps doctors spot disease also introduces new ways for your private health data to be exposed, altered, or misused. Recent research presented at the Radiological Society of North America (RSNA) shows that AI-generated deepfake X-rays can fool both radiologists and diagnostic algorithms, raising urgent questions about data integrity and patient privacy.

What happened

In March 2026, RSNA published findings demonstrating that synthetic X-ray images—created using generative AI—are convincing enough to deceive trained radiologists and the AI tools they rely on. Researchers could generate realistic chest X-rays that appeared to show pneumonia or other conditions when, in fact, no such pathology existed. The implications go beyond misdiagnosis: if someone can forge a medical image, they can also steal or manipulate real ones.

Medical imaging data is particularly vulnerable. Many picture archiving and communication systems (PACS) still store images without encryption, especially in smaller clinics. The data is often shared across institutions for research or AI training, sometimes without explicit patient consent. A growing number of cyberattacks target radiology departments because these high-value datasets are rich with identifiable information—name, date of birth, and detailed anatomical scans that can’t be reissued like a credit card number.

Why it matters

For patients, the risks are not abstract. A manipulated image could lead to unnecessary treatment or a missed diagnosis. Beyond clinical harm, a breach of imaging data is permanent. You can change a password, but you cannot change the structure of your lungs or your bone density. Health insurers, employers, or others could use these images to discriminate or deny coverage if they fall into the wrong hands.

The RSNA study also highlights a trust problem. If radiologists can’t be sure an image is authentic, the entire diagnostic process is undermined. And when AI models are trained on datasets that may contain synthetic or tampered images, their accuracy suffers—creating a cycle of error that affects everyone.

Most patients are unaware that their CT scans, MRIs, and X-rays may be stored indefinitely and shared with third parties for AI development. Consent forms often bury these details in dense legal language, if they mention them at all.

What readers can do

You don’t have to be powerless. Here are practical steps to protect your medical imaging data:

Ask about data handling before your scan. Request a clear explanation of how your images will be stored, who has access, and whether they will be used for AI training or research. You have the right to opt out of secondary uses in many jurisdictions.

Check your provider’s security practices. Inquire whether your clinic or hospital encrypts imaging data both at rest and in transit. Smaller facilities may not, but you can ask if they follow standards like HIPAA or the European equivalent.

Request a copy of your own images. Most radiology departments can provide a CD or digital download. Keeping your own record gives you control and a reference in case of tampering.

Use patient portals wisely. Many hospitals now offer online access to imaging reports. Enable two-factor authentication on your portal account to reduce the risk of unauthorized access.

Stay informed about breaches. If you receive a data breach notification from a healthcare provider, take it seriously. The breached data may include imaging files, not just billing information.

Support stronger consent rules. Advocate for legislation that requires explicit, understandable consent before your medical data is used to train commercial AI systems. Some states and countries are moving in this direction.

Sources

Medical AI offers real benefits, but the privacy and security gaps are not getting enough attention. As the RSNA research shows, the line between real and synthetic images is blurring. Until stronger protections become standard, taking a few minutes to ask questions and secure your data is a small effort with outsized payoff.