Episode 233 - Podcast with Lucia C. Savage, Founder and CEO, Savage Healthcare Strategies
In the Age of AI, Healthcare Privacy Goes Beyond HIPAA

Ritu: Hi, listeners. Welcome to Season Seven of our Big Unlock Podcast. My name is Ritu M Uberoy, and I’m the managing partner here at Damo Consulting. I’ll be your host today for the Big Unlock. Today we are welcoming Lucia Savage to our podcast, and really happy to have her here. She’s a nationally recognized expert on healthcare regulation, digital health, and health information privacy. Using strategic advice to advance digital technology to deliver the highest healthcare, she drives the organization’s innovation while helping them adhere to the highest standards for privacy, security, clinical fidelity, and patient safety. She retired from Omada Health in March of 2026 after helping Omada go public in June, and she currently serves on the boards of directors of Tidepool Inc. and Academy Health and is an advisor at Claimable Inc. We are really excited to welcome Lucia to the podcast today because we are going to be talking about privacy, which is a really hot topic, and every other LinkedIn post is about privacy, security, and governance. So welcome, Lucia, to the podcast, and looking forward to a great discussion.

Lucia: Thanks so much for having me. I’m very excited to be here.

Ritu: Thank you. Would you like to add anything to that introduction I read out for you?

Lucia: No, I think we should just hop right in.

Ritu: Okay, great. Lucia, I think the first thing we need to discuss is what are these privacy rules that are applying to these consumer health apps versus the traditional healthcare companies? Because we’re seeing it firsthand — we’ve built a prototype of an application on Replit, and when we wanted to scale it, we thought, “Oh my god, this is not covered by any BAAs. What’s happening if we try to port it to another place?” We have the cloud, we have the place where we store the data, we have the Replit code itself. So talk to us a little bit about that. How are those models changing, and what are your thoughts on that?

Lucia: Sure. I’m going to take you down a little history path. From 2014 to 2016, I served in the Obama administration, and I was the chief privacy officer at the Office of the National Coordinator for Health IT. Now, that agency primarily writes rules for how the EHRs operate. But when Congress created HITECH and all the funding, they also created the chief privacy officer within ONC, whose specific obligation was advising ONC specifically and the agency generally about how to maintain privacy when we had even more digital data.

If you go even farther back in time, you’ll remember that HIPAA itself was a law about digitizing the claims data. The A is for accountability there. And at that time, Congress asked ONC to write a report about this problem, the state of how health information was regulated when it wasn’t within a HIPAA-covered entity. I’m not going to get into what HIPAA-covered entities are. There’s tons of information out there about that. And so we did. We published that report in 2016, so ten years ago — ten years ago July, so literally a decade. What we said was there’s some FTC law. There’s this thing called the Health Breach Notification Rule that Congress created that is about when you have a consumer application and there’s a breach of the data, what do you have to do? But there wasn’t really law specifically addressed at digital health information within states. There were obviously medical confidentiality laws, and those precede HIPAA by decades. Those are very old-fashioned, so your therapist and your doctor are specifically regulated.

Fast-forward ten years, and with repeated failures of Congress to do something nationwide that would address the problem of privacy outside of HIPAA-covered entities, states have taken action. Colorado was one of the first, but some of the more famous states here are, surprisingly, Texas, which has a very robust law. Washington State has a law called My Health My Data Act, which is specifically about health data. California has the California Consumer Privacy Act and multiple subsequent amendments. Ten years down the path, 23 states have these laws now that are about very particularized protections for consumers in the space where data is collected by a consumer-oriented app — a personal app that you download from the App Store that’s not from your health system. They also regulate things like data brokers and the whole data industry that’s happening behind the scenes with those apps.

The last thing I would say, it’s really important to understand the tech here, because Facebook famously doesn’t sell data. Facebook famously profiles you and sells an ad to you, but they actually are not selling the data. That’s not true of many companies — many, many companies actually have part of their business plan monetizing the data they’ve collected from people. It’s kind of buyer beware from the consumer side. HIPAA is a law that has incredible brand recognition and very little understanding. Everybody knows it. They know it so well they can misspell it with two Ps instead of two As, but they don’t really understand how it works. I wrote about this recently with Devin McGraw. It’s in Hospitalology. It’s very specifically designed for the problem of data being moved around within the traditional healthcare system. It’s not designed for other things, and we have that in the US. They have different methods in Europe and South America. But in America, we have what we call sectoral privacy, specific rules for specific economic sectors, so healthcare, education, et cetera. It’s not really designed to apply in the consumer setting.

I think the debate we’re going to see coming forward in Congress is whether we actually need congressional action at all, because we have these 23 states — and by the way, two years ago it was 17 states, so to add six states in two years is pretty remarkable. Some legislatures don’t even meet every year. Or we can look to our federalized system where states pick the laws that are right for them. For whatever you’ve done, the approach would be, and I’ll tie this up, you have to figure out what law applies to you in terms of where you’re incorporated and what your revenue is. That’s one trigger for these laws. And then you have to figure out where your users are. That’s why these Washington, Texas, and California laws are so remarkable — their users are everywhere. Texas and California are the two most populous states. When they do something and companies have to comply with that thing, it has this beneficial ripple effect everywhere.

Ritu: You’ve raised some very interesting points, Lucia, about HIPAA and this counterintuitive argument that we should not simply extend HIPAA to these consumer health apps because they’re now covered by these new privacy laws. But why do you believe consumers would actually have less control if HIPAA was extended, why isn’t HIPAA the right framework, and why should states have these different privacy laws to cover these consumer apps?

Lucia: Sure. Back on the history train. If you’re digitizing the claims data, which was the original intent, and you have a developing quality measurement infrastructure — remember the original HEDIS measures were based on simple math about claims. The example that I learned many years ago was if a physician has 100 women in their panel that are eligible for mammograms, did you get 100 mammogram claims? That’s a perfect score for a mammogram screening. So we always had this concept of using the data for more than just the simple act of payment, and that’s why HIPAA has all these specialized rules about what you can de-identify and what you can’t de-identify and also sharing between the covered entities. If you’re a hospital or a physician practice and the health plan needs to do their HEDIS measurements — HEDIS is a specific example in that early 2002 regulation. It’s right in there, H-E-D-I-S. So the plan was always to be able to do population-level analytics, always to be able to de-identify the data for research or take a lot of the identifiable information out of it and render a limited data set. That idea is part of what makes HIPAA appropriate for what it’s for, but it also has this side effect: it has this rule where the covered entity can allow somebody else to de-identify it, and there’s a standard for that, and then do whatever they want with it, because when it’s de-identified, it’s not protected by HIPAA anymore.

If you take that concept of de-identification and plunk it down in these state laws, the first thing you get is a conflict, because the state laws don’t typically allow that kind of de-identification without a person opting into that de-identification. That’s one problem. The second problem is the state laws have these other protective features, like delete my data. You’re not allowed to ask a covered entity to delete your data. But you are allowed to ask a consumer app that’s regulated by one of these laws to delete your data. From my perspective, I think delete your data is a pretty strong right. I’ve exercised it myself in California with the creepy unauthorized ambient scribes that show up on your Zoom calls. We’ve all had that experience. I say, “Delete my data.” You get a back and forth, and finally they realize they couldn’t have emailed you the transcript if they didn’t have your email, and you get your data deleted. But we don’t have that right in healthcare. If you go to a doctor’s office and you have one appointment, and it turns out that’s not the right doctor for you and they have to refer you to somebody else, you can’t say, “Please delete my data.” That’s a medical record of the doctor. It’s about their practice. They need to keep it for various other documentary reasons, and you can’t have it deleted. So that’s a really big difference in the rights.

Ritu: I think you’ve spotlighted a really good example about what HIPAA was originally designed for, which was a healthcare system where we could reasonably identify the provider, the payer, the patient, and the business associate. But now with generative AI, these clinical interactions are potentially involving multiple things which we talked about — the EHR, the cloud provider, an AI model, ambient, the third-party data sources, multiple downstream agents. So I guess what we’re realizing is that this architecture is exposing a fundamental limitation in the way we are currently regulating this health data. Do you think these organizations need to start governing the life cycle of the entire data rather than simply the type of organization that’s holding it?

Lucia: Having been the privacy officer in a digital health company where the complete operations are 100% digital, with a fully digital stack and a large engineering team, I can tell you that you can’t do that job and comply with the law unless you understand the complete data flow. The right way to do this when you’re advising a company, even if you’re just the CISO, is to ask what is the data, and follow its chain of custody until it becomes unregulated data. That’s one thing. And people are just careless about that. That’s how we get into this world where they don’t realize that their pixels are feeding data back to Facebook. There’s lots of litigation about that for the tracker technology. They don’t realize that they haven’t negotiated terms with their LLM developer to prevent the LLM from reusing that data for learning, which would be really important if you were doing a deal with Anthropic or OpenAI. They don’t do the full process, and the full process is the right way to do this.

The other thing I would say is that there are rules that are, I’m going to say, left lying on the table is the simplest way to put it. For example, in HIPAA, when you give somebody a de-identified data set, or you can sell it to them for the cost of data prep, so that’s kind of a blank check, you’re supposed to contractually require that they not re-identify it. You’ll see that as language in all the agreements. But I’ve been doing this 30 years since HIPAA was passed, and I’ve never heard of a single lawsuit for somebody breaching a BAA because they re-identified the data. And with AI, we have to admit that re-identification is a lot easier. When you take a large data set from a health system, it’s legally de-identified, it goes over to biopharma, they start adding other information to it, their AI gets a hold of it, and pretty soon, predictively, they know it’s you and they know it’s me. You’re not supposed to do that. As I look ahead, I’m thinking, when is that going to show up in court? Because it will show up in court. The plaintiffs’ lawyers have gotten really smart about this.

Ritu: Transparency and honesty are fundamental to deploying AI responsibly in healthcare. But what does this transparency actually look like for a patient? You’re mentioning these LLMs and these systems and this AI which can do so much, and if the AI is summarizing their chart, it’s actually influencing what the clinician sees. Should we be asking for consent for every AI-enabled interaction? But then won’t it become extremely burdensome? Like you mentioned the ambient where the data is going from one doctor to the other, or when you get a referral, how does that work?

Lucia: Ambient scribes are a great situation. I’m a patient in the Kaiser system here in northern California, so best health system in the country, yay me, and they use ambient scribes. When I go to the doctor, I get asked, “Do you mind if I record this?” It’s an oral consent, and they record what I’ve said. It takes like 15 seconds. I didn’t have questions about what recording meant. And you can capture it orally; it doesn’t require paperwork. All that’s in the regulations. The actual process of asking, to me, fosters patient engagement and fosters trust. My doctor is looking out for me because they’re asking me this question. And then of course the health system has some obligation to make sure that recording is handled in the right way, and I think there are many issues at the granular level to be sorted out. For example, there are scribe companies, and I understand that they don’t retain the recordings. Well, if you’re a malpractice attorney, wouldn’t you want to see the raw recording instead of the transcript? If you’re really trying to get to what went on. By the way, I’ve been in healthcare a long time, and in the ’70s and ’80s, doctors dictated onto a microcassette, shipped the microcassette off to a transcriptionist, and a transcript was offered. But if you were representing that doctor in a lawsuit, you had in your evidence pile the actual microcassette, so you could check the original. That’s a thing that will just get sorted out over time.

I also think there are other things. Within these state laws, not only have some states taken an activist approach to privacy, but they’re also taking an activist approach to AI. For example, there are some states that require that you tell the patient, not just through a watermark, but when they’re interacting with an AI. In California, you’re supposed to tell people, and it’s not just a healthcare rule, it’s an AI rule. If you’re on the phone and it’s an ambient voice chatbot, you’re supposed to know as a consumer that it’s an AI. And I’m not in the bowels of dozens and dozens of companies, but when you look at what companies are developing versus what seems to be emerging law that is then regulating them, some of those things make me ask: why did you do that thing? Because we didn’t need that law, and you did a thing badly, and now we have a new law to deal with. So there’s a measure of responsibility. A really responsible developer will figure out how to do it with adherence to the law, but with the new technology. A lot of the law, particularly HIPAA, but other law as well, is a little bit technologically neutral. Here’s a really great example. We know already in healthcare that only humans can get licenses. We know that’s how the law works. So why would you not train your AI to guardrail against asserting that it’s a human or that it’s a licensed professional? I’m using that term technically, I think I’m using it properly. For example, if you were building a nutrition education AI, you might train it to say, “I’m not a dietician, but here’s what I understand from reading dietetic literature.” But we don’t have that. We have companies that build AIs that say, “Well, as your therapist…” And so now we have another layer of laws saying thou shalt not let your AI assert that it’s a licensed professional. We kind of didn’t need that, but we got it anyway. If we don’t plan our development with full spectrum consideration of the environment, then we actually get more barriers to innovation.

Ritu: I think both your points are very good. The point about going back to the original recording is so important, especially because of AI hallucinations. As we’ve read so many times, physicians are not saving that much time on ambient. I read the most recent study, which said 16 minutes per day because they still have to review the transcripts and make sure there are no errors in there, nothing unintentional has crept in. Those things can still happen because AI does hallucinate. If you don’t have the original recording, then what makes that true? And the second point, asserting that it’s an AI bot and not pretending to be a licensed therapist, which a lot of the mental health companies are facing flak for, because that’s how they develop dependency — they are trying to take the place of the therapist or saying they’re almost like a therapist. So we can switch tracks a little bit, Lucia. We’re always interested in an origin story. Tell us how you got into this field of healthcare and data privacy. You said you’ve been here for 30 years, so we would love to hear what the original motivation was and how you got started.

Lucia: Well, my one-liner is I’ve been practicing law since before Al Gore invented the internet. I got my license in 1989. It’s an interesting story. My early career was litigating employee benefits. This is before HIPAA was even a law. But we have this other law, ERISA, that gives people certain rights to due process and fairness in the way their employee benefits are supplied, and there are also informational rights embedded in there. I had a little subspecialty in my firm of long-term disability claims, which are all about how sick are you. At that time, interestingly, we had chronic fatigue, and now we know it’s virally caused, but in 1992 we did not know that. We had a lot of litigation where my clients’ disability was being cut short because chronic fatigue was deemed psychosomatic, in air quotes, and we had to come up with a medical strategy to prove it wasn’t psychosomatic in a time when there wasn’t appropriate science. Then I got pregnant with my second kid and realized that my husband is also a courtroom lawyer, and that was unsustainable. Two kids in not-law-firm jobs, just unsustainable.

So I took a position at Stanford University, where I worked half-time for eight years, and I was there when HIPAA was passed. It was also that first Silicon Valley bubble, 1995 to 2003, and most of the ERISA professionals at that time were really involved in deferred compensation, stock plans, that kind of thing. But I was there watching not only the first Silicon Valley bubble, but the very first modern pendular swing against managed care. We had HMOs failing. We had really crude prior authorizations. People were getting deprived of care. Many of the stories of the last three years are like, “Oh, I think I heard that story in 1994.” I got very interested in the problem of healthcare as a legal problem. You can’t solve the legal problems without understanding the public policy and the economics. And then you have to learn a little bit of the science as well.

So I got an opportunity in 2003 to go work full time at Pacific Business Group on Health, which is now the purchaser Business Group on Health, where I was general counsel for five years. That was a great launchpad. HIPAA was brand new. We were building out quality measurements, so really understanding those tools within HIPAA for population health studies, really trying to help the large purchasers understand the new rules and how they could take advantage of them in their planning for their employees. We also, at that time, ran a small group purchasing pool for the State of California, which in many ways is the foundation model for the Affordable Care Act exchanges. I was general counsel for that. We had to close the exchange because it was in a death spiral. It’s a long, separate story, and I can give you some articles other people wrote about it for your show notes.

I went from there to UnitedHealthcare. My job at United was 100% supporting United’s planning for what was emerging to be health information exchange — e-prescribing, health information exchange, medical home, supported by digital infrastructure, data back and forth between United and the physician practices. I worked there for six and a half years. My husband’s job moved to DC, and I was in DC, and Joy Pritts, the first chief privacy officer at ONC, had just left. I was talking to some friends, and my friend said, “Would you like that job?” I said, “I would love that job.” And the rest is history. Obviously that was a political appointment back then, so my job ended in January of 2017, and I started at Omada shortly after that.

Ritu: Thank you for sharing that. That’s always so interesting to hear, the different ways people got to where they are. With all your experience in healthcare over these three decades, tell us about the top three regulatory issues in healthcare innovation that confuse people.

Lucia: Well, we spent a lot of time talking about HIPAA versus health apps. The second thing, which is related, is that we can have a lot of policy and legal debates about what we need to do to make healthcare have better outcomes for less cost — that’s what we’ve been trying to do for a long time. But within that is the role of the patient. If we really want patients to take charge of their own health, we have to support their use of these tools. Now, I’m not an “ask ChatGPT about my health” person. Luckily, I’m very healthy. I don’t manage a chronic condition. But I support people who do that because they are getting the help they need from a place that works for them. They could be asking their doctor neighbor, their nurse neighbor, a child, whatever. We can’t just treat the patient as a place that professionals give information to. We have to treat it as an interactive conversation so patients are managing their health, about everything from high blood pressure and what you eat, to how much you exercise, to a complicated disease like cancer. I have a friend who is a many, many years survivor of stage four cancer, and she’s learned to read the scientific journals because she wants to read about where the science is going. We have to support that, and that means the healthcare professional infrastructure needs to support it. We need to give patients their data. We need to accept the fact that they’re going to use AI.

I saw on LinkedIn, somebody said, I think it was Graham Walker, but I’m not sure, “If you really want this, you should spend some time creating a catalog for the patients in your practice of the prompts they should use with AI, or help them figure out how to prompt AI.” Even if it was just a doctor making one YouTube video that would then be available for people. Imagine if it was an endocrinologist or a urologist, one of these really complicated specialties — I’m not saying primary care isn’t complicated, I’m saying it’s general, but something really specific. That would be so helpful for patients to know how to use these tools. I have a lot of doctor friends, and they say, “I don’t have time. I don’t get paid for that.” There’s actually a CPT code for teaching your patient about online tools. Whether your insurance company will process it, I don’t know, but there is a code. So that’s two. And three, to me, healthcare is such a liberty issue. People approach it really differently, everything from Seventh-day Adventists to hypochondriacs. We really need to trust the science and let adult patients figure things out for themselves. We’re getting there, but I think people’s personal values spill over into other people’s healthcare in a way that probably isn’t helpful.

Ritu: I loved the second point you made. I was talking to one of the C-suite leaders the other day, and it’s almost like patients are coming to the doctors for a second opinion because they’ve done so much research at home, they’ve prepared themselves, they know what questions to ask. When they’re actually coming to the physician, they’re so much better prepared, and they’re actually validating—

Lucia: Right, but it’s just an iteration on Dr. Google, though. I know Dr. Google is really annoying for some doctors. I get that. I’ve heard that. But it is kind of an iteration on that.

Ritu: True. It’s because everyone’s doing it individualistically, without the guidance which you mentioned or any standard prompts or standard guidance from the doctors. So people are just doing the best they can and using the system the best they can and hoping to find something.

Lucia: Right, and the developers — I understand this approach — are just putting it on the table and letting people use it, because maybe they’re worried that if they give more direction on an effective way to use a Claude or an OpenAI for healthcare, they’ll end up doing what they’re not supposed to do, which is providing healthcare. There’s a little bit of tension there about how we empower the patient to be smarter about the information they’re getting while at the same time maintaining whatever swim lanes we decide as a society are right for who gets to supply diagnostics and treatment.

Ritu: As usual, the time has flown by, and we’re almost at the end of the podcast. I think we can close with a general prediction. With your decades of experience, what do you feel? Innovation is moving so much faster in healthcare. Regulation is having a hard time keeping up. AI systems are now changing after deployment, which usually didn’t happen before. So traditional entities like HIPAA and these other regulatory bodies are having a tough time. From all your decades of experience, what are you optimistic about, and what are some of the good things we can take into the future, and which are some things you would happily see change completely for the better?

Lucia: Well, I do think there is a lot of savings in the baseline cost of healthcare administration to be had with AI, and I think there probably will be job displacements because of that, and I’m not even talking about the clinical uses. I think AI in healthcare is here to stay. But I also think a lot of people have their hair on fire because AI in healthcare is unregulated. I personally don’t think that’s true. I think there are a lot of laws, and who can be a licensed professional is just one example. The secret of a good lawyer is looking at old law and new facts and trying to figure out if they fit together, if you can analogize. That’s why I said cassette tape equals ambient scribe. That’s a good analogy. That’s what a really creative lawyer will do for you. You can look at all the healthcare laws and think about that. The laws prohibit double billing and fraudulent billing and up-coding. All of that is already prohibited in law. So your AI shouldn’t do that. We’re in this place where there’s kind of a race to up-code and to find the up-coding, and that’ll sort itself out. So I have a lot of hope for innovation, but my experience at Omada and at ONC, and even before that, was: do it the right way and you will succeed. That right way can actually be a moat. Nobody should want to aspire to be the company that has a giant launch and then a giant liability because they did it wrong. A giant check you have to write to whoever it is. Flo is a great example. Flo did a couple things wrong, and every conversation I have about health information privacy mentions Flo in a negative way. Is that the branding you want? I don’t know.

Ritu: Great. Thank you so much, Lucia. I think it’s been very enlightening, and thank you for educating our listeners. It was a pleasure to have you on the podcast today.

Lucia: Thank you for having me, Ritu. Happy to come on again. We’re at a very important time in healthcare, and we all have to be creative, but be thoughtful.

Ritu: Thank you so much.

—

Subscribe to our podcast series at https://thebigunlock.com/ and write us at info@thebigunlock.com    

Disclaimer: This Q&A has been derived from the podcast transcript and has been edited for readability and clarity.