Data Privacy, AI Liability Models in Managed Care Pharmacy: Adam Colborn, JD

Liability for artificial intelligence (AI) in managed care pharmacy may follow the current provider-side model, but the situation could evolve, says Adam Colborn, JD, associate vice president for congressional affairs at the Academy of Managed Care Pharmacy (AMCP).

This transcript was lightly edited; captions were auto-generated.

Transcript

What are the key regulatory considerations managed care pharmacists should be aware of when implementing AI tools?

I think the primary issues that managed care pharmacists should be thinking about in terms of AI regulation, there's a couple of key ones that jump out. Data privacy is obviously a big one, and there's, I think, an unresolved question about how loading HIPAA [Health Insurance Portability and Accountability Act]–protected information into a large language model interacts with those requirements. It's not really public information, right? It's not public data but depending on the nature of their use of these programs, it may be going into a data set that's feeding other entities who are not supposed to be receiving protected information. I'd say that's more of a contract issue, so they should look carefully at their contracts and establish really clear organizational parameters around who or what types of information go into an AI-powered program.

From the liability perspective, the folks that I've talked to seem to think that it'll follow the current system where it primarily falls on the provider side. So there's a question, if an AI program says something wrong to a patient through the patient portal or on the phone, is the provider's office and the provider themselves liable? Or is there some liability, possibly shared or entirely located within the vendor? And the early guesses that I've seen from people who know the subject better than me think it'll follow the current provider-side liability. I think there's a possibility that it'll change. This is a new type of technology. It's more vendor-driven in the past than I think comparable systems are. I don't want to close the door on the possibility that vendors will be open to some amount of liability here, but so far, it seems like it's going mostly to the providers.

How can organizations ensure that AI algorithms used in managed care pharmacy are transparent, fair, and free from bias?

This is not limited to AI. I don't think you can say 100% that your data set is free from bias. I think it is a constant process of reviewing and refining the data that you're using in whatever AI system you're using, whether it's for prior authorization, whether it's for patient customer service applications. I would say that certainly in the early days, it's going to come down to rigorous human review from these entities. Over time, it may get a little bit easier as the software improves, as people get more comfortable with it, but I think patients are—and even if the AI risk is not greater than a human, the risk of human error—I think people are just more comfortable with the human error dimension. If I was talking to a payer organization or a provider, I would really emphasize laying out some sort of framework on your website that's accessible to patients and exactly how you are using this data. [It’s] probably worth disclosing what other entities are receiving some portion of the data, and then lastly, just a commitment to rigorous oversight and constant self-improvement I think will go a long way to assuaging whatever patient concerns there might be.