[Transcript] Episode 438: Google’s Gemini AI Tool & HIPAA

 

Evan Dumas

You’re listening to Group Practice Tech, a podcast by Person Centered Tech, where we help mental health group practice owners ethically and effectively leverage tech to improve their practices. I’m your co-host, Evan Dumas.

 

Liath Dalton 

And I’m Liath Dalton, and we are Person Centered Tech.

 

Liath Dalton 

This episode is brought to you by Therapy Notes. Therapy Notes is a robust online practice management and electronic health record system to support you in growing your thriving practice. Therapy Notes is a complete practice management system with all the functionality you need to manage client records, meet with clients remotely, create rich documentation, schedule appointments and bill insurance all right at your fingertips. To get two free months of Therapy Notes as a new Therapy Notes user go to therapynotes.com and use promo code PCT.

 

Evan Dumas 

Hello, and welcome to Episode 438: Google’s Gemini AI Tool and HIPAA.

 

Liath Dalton 

Yes. The question that comes up so frequently when there is a new tool that gets added to Google’s Workspace suite, or just any time there’s a new tool with potential use application in a practice context, what we want to look at is, is it HIPAA compliance compatible? What are any caveats or considerations or particular usage notes to guide on its appropriate utilization, if it is compliant, compatible, and so on.

 

Liath Dalton 

And we’ve been getting lots of questions recently about this in the context of Google’s Gemini AI tool. Gemini was formerly known as Bard, but like many Google products, has already gone through a name change. And as of the sort of end of 2023 beginning of 2024 the Gemini within Workspace functionality is included in the covered functionality of the Business Associate Agreement with Google for Workspace, which means that it can be used in a HIPAA consistent way that it is not sort of walled off or verboten from being able to be used in connection with PHI. But of course, that then also brings up additional considerations. So Evan, what are some of the basic logistics that folks should be aware of in terms of how Gemini works and how to have Gemini functionality be covered by the BAA, et cetera?

 

Evan Dumas 

Yeah. So Gemini is used as a part of the Google Videos feature so it can help youcreate video contact, presentations, cool stuff like that. Now it is a paid add on, so it costs, like, if you want to get a year package for Google Business, it’s like 20 per user per month, and it’s 24 it’s flexible. So if you do just want to get it for a month, crank out a bunch of like, training videos, things like that, that’s just fine. Now you would be doing all of this from a desktop or laptop computer, because even though there is a Google Gemini app, they’re like, that’s not covered under your BAA. So don’t use that. So just use the one through the the desktop space. So there, there’s that limitation, there. It’s included functionality. So that’s, it’s all covered by your BAA, which is, which is really nice.

 

Liath Dalton 

And it is also addressed in Google’s HIPAA implementation guide as well. And the sort of primary use applications that most folks are leveraging Gemini for are, as Evan said, for slide and video creation, as well as just general content generation when it comes to Google Docs or even emails, right? And that content generation is where things start to bring up additional layers of HIPAA and ethics, standards, concerns or or sort of action areas, of action items.

 

Liath Dalton  

So the one of the beauties of it being included in the covered functionality of the BAA and something that is specifically addressed in the Google HIPAA implementation guide is that the input prompts to Gemini, as well as the generative output are not used to further train Gemini. And that’s one of the areas where, with other AI tools, there are ethical and legal considerations for using Protected Health Information as inputs to a system that then learns from those inputs and expands its sort of database on the basis of that input.

 

Liath Dalton 

So that isn’t something that is of concern based on the way that Google is managing input and output data. However, it is a tool that is not designed specifically for clinical use or health care use, let alone mental health care use.

 

Evan Dumas 

Oh, no, no, no.

 

Liath Dalton 

And so it is not something that would be recommended for clinical documentation generation. You want to use a tool, if you are going to utilize a tool that includes AI for clinical documentation generation, it needs to be not only a tool that is HIPAA consistent, and where you can have a BAA with the service provider, but also should be one that was designed specifically for that use application and has additional sort of safeguards and that the learning mechanisms, the algorithms behind it are set up specifically for that industry and to help address some of the issues of bias that can really come up with AI output as well. Because, of course, the output is all only as good as the input in the data set that it’s working from. So if it’s got a limited data set that’s going to impact the output, and you can see the correlation there with sort of perpetuating biases.

 

Liath Dalton 

So all that to say that’s one of the primary reasons why we are advising that it not be used for any clinical content generation. But also because it’s very important that any time you are using AI for clinical output, it requires clients informed consent?

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Right?

 

Evan Dumas 

Yeah, totally.

 

Liath Dalton 

So the let’s just kind of think through how this could come up, and how that informed consent requirement could potentially get circumvented if the the use policies and procedures aren’t really diligent and intentional.

 

Liath Dalton 

So let’s say you’ve decided to adopt Gemini for help, maybe with generating some templates and internal training videos for your team and maybe some marketing content as well. But then it’s, you’ve gotten licenses for additional team members, and they realize, hey, it’s really nifty at helping me create an email or write a client letter or record summary more more efficiently and making it seem nice and polished and and professional. So I’m not going to use it for progress note generation, but I need to respond to a client message or email about something, and so I’m going to use Gemini to support me in in a more efficient and thorough seeming response.

 

Liath Dalton 

Well, if there’s any clinical content in those communications, then suddenly it is using AI in a setting where informed consent is necessary. So if you are considering adopting Gemini in your practice, the sort of usage notes that we would have in place are first of all, making sure that you have the managed licenses for any users who you’re going to allow to be using that functionality and want to have that capacity or ability available to them.

 

Liath Dalton 

Then make sure that the prohibition on using Gemini through the app or through the browser interface of gemini.google.com is included in your Gemini policy and procedure usage, and then have very clear policies and procedures as well around what use applications are acceptable and what aren’t. We would say that clinical content use applications should be prohibited, because if they are permitted, then that brings up the whole piece of informed consent, first and foremost, but then also opens a can of worms, so to speak, on some of the other issues.

 

Liath Dalton 

So it can be a fantastic tool for supporting sort of internal operations, and the more business-y and marketing side of your practice. So for for that purpose, we think it’s great, because normally the limitation for using a supportive AI tool there would be, you don’t want to be giving it access to your Google Workspace environment, because that breaks the HIPAA compliance seal, as it were. If you’reusing a non HIPAA appropriate AI tool, so then you’re more limited in what you can do, because then maybe you’re having to set up a completely separate Google Workspace account for the business side, and then it just starts making things cumbersome and inefficient.

 

Liath Dalton 

So there are a lot of benefits to Gemini being HIPAA consistent, but we’re still guiding that that doesn’t mean that it should be used for managing Protected Health Information or for clinical documentation.

 

Evan Dumas 

Exactly. Yeah.

 

Liath Dalton 

And as we see more uses of of Gemini in practice and hear stories from group practice clients, who are, you know, reporting the ways in which it works for them and it doesn’t, we’ll probably continue to update this space and do additional episodes, because Google Workspace ends up being one of the core components of most group practices’ tech stacks, where it’s kind of secondary in what It provides, functionality-wise only to your EHR or practice management system.

 

Evan Dumas 

Oh, totally Yeah.

 

Liath Dalton 

So we’re always excited to see the range of what it can provide expand, and just want to continue to be very intentional and diligent about how we adopt and utilize new features and functionalities as they become available. So hopefully this has been helpful. Thanks for joining us, and we’ll chat to you next time.

 

Evan Dumas 

Yeah, talk to you next time, everybody.

 

Liath Dalton 

This has been Group Practice Tech. You can find us at personcenteredtech.com. For more podcast episodes, you can go to personcenteredtech.com/podcast, or click podcast on the menu bar.