Module 3: Data Privacy, GDPR & HIPAA - DRAFT

Principle: You Are a Data Steward

Client and company data are entrusted to you under contract and law. AI tools amplify both value and risk.

---

Data Classification (Example Structure)

Customize these classes to align with RBA, Inc.’s formal policy.

Class	Examples	AI Rules
Public	Public web info, press releases	Approved research tools OK.
Internal	RBA, Inc. internal docs, non‑client strategy	Only approved tools; use “no training” settings where possible.
Confidential – Client	Non‑public client info, strategies, pricing	Only tools with appropriate contracts; never personal accounts.
Restricted – PII/PHI/Financial	Names, IDs, health records, account/PCI data	Only tools with DPA/BAA and strict minimization.

Always ask: “Can I achieve this with anonymized or aggregated data?”

---

GDPR: Key Concepts for AI Use

• Lawful basis
  Ensure a valid basis (e.g., contract, legitimate interests) before processing personal data in AI tools.

• Data minimization
  Only send what is strictly necessary. Prefer pseudonymized or de-identified data.

• Data subject rights
  Design workflows so access, correction, and deletion are feasible (know which tools received which data).

• Contracts with AI vendors (DPAs)
  Before sending personal

  • Contract in place (DPA or equivalent)
  • No training on your data unless explicitly agreed
  • Clear retention/deletion rights and breach notification obligations

---

Machine Unlearning & Data Removal (Operational View)

Reality:

• Deleting a chat from your UI rarely guarantees removal from all back-end systems.
• Model-level unlearning is a developing area; do not assume it exists.

Practical actions:

1. Track which tools receive which categories of data.
2. Use ephemeral sessions and conversation deletion where supported.
3. For erasure or incident requests:
   • Identify tool, timeframe, data type.
   • Follow vendor’s documented deletion process.
   • Log requests and confirmations.

---

HIPAA Considerations

When engagements involve PHI:

• Use only tools with:

  • Executed BAA
  • Documented encryption and auditing
  • Settings that prevent training on PHI

• De‑identify whenever feasible.

• Limit PHI access to authorized roles.

• Treat AI vendors like any other business associate in your data flow maps.

---

Employee Checklist (Privacy)

• I classify data before using AI tools.
• I avoid sending raw PII/PHI unless absolutely necessary and contractually allowed.
• I know which AI tools have the correct contracts in place.
• I know who to contact if I suspect a privacy issue.