Yes. AI tools can create a new security and privacy risk especially when they have access to patient records, email, scheduling, imaging or billing software. The topmost risks include patient data entered into AI tools, third-party or vendor exposure, prompt injection attacks, AI mistakes impacting the clinical record, and the creation of new credential and integration points.

The riskiest situation arises when an AI tool has access to both Protected Health Information (PHI) and the permission to act. In this situation, a successful attacker could review patient information and then use AI to communicate with patients.