Protecting patient privacy in clinical foundation models: Technical and legal perspectives
This work addresses the underexplored risk of indirect patient privacy leakage through deployed clinical foundation models, a challenge inadequately mitigated by current legal and technical safeguards. It proposes, for the first time, a context-aware privacy risk assessment framework that systematically integrates technical and legal perspectives to evaluate indirect leakage risks across the model’s entire lifecycle. By combining privacy risk modeling, leakage scenario simulation, and compliance mapping with technical measures such as differential privacy and access control, the framework elucidates representative leakage mechanisms. It delivers an actionable risk assessment workflow and cross-jurisdictional compliance guidance, enabling robust privacy protection without compromising model utility.