Cybersecurity, privacy, and AI-related issues

Fact Pattern

• You are the Chief Information Security Officer for Incorporated Intelligence, Inc. (“Incorporated Intelligence”), a multinational medical devices manufacturing company.
  • Incorporated Intelligence has laboratories and manufacturing facilities in the United States and five other countries (in Europe and the Pacific Rim).
• Incorporated Intelligence’s best seller is the Intelligent HeartBeat (“HeartBeat”).
  • HeartBeat is an implantable “intelligent, wireless pacemaker and heart monitor that acts not just as a cardiac pacing device, but also allows doctors thousands of miles away to monitor a patient’s every heartbeat, send alerts to the patient, and take real-time corrective action by sending electronic signals via the internet to the implanted device….” (quoted from Incorporate Intelligence’s marketing flyer).
• The HeartBeat device has five critical components.
  • Each critical component is manufactured in a different country outside of the United States.
  • Once manufactured, the components are shipped to Incorporated Intelligence’s plant in the United States, where the HeartBeat device is assembled, packaged, and shipped to medical facilities in the U.S. and around the world.

• The critical components of the HeartBeat device include both hardware and software.
  • The HeartBeat device, which is about 1 inch long and 1⁄4 inch wide, includes, among other things:
    • A microprocessor
    • 1GB of memory, and
    • A Bluetooth communication component.
  • The HeartBeat software includes:
    • A Linux-based operating system and
    • Data analysis and machine learning software.This software allows the HeartBeat pacemaker to:
      • Conduct some basic data analysis
      • Run machine learning algorithms, and
      • Make real-time adjustments to the pacemaker without the intervention of the patient’s doctor.
• The HeartBeat pacemaker connects to a patient’s smartphone via an app.
  • The app is manufactured by a third-party software developer and sold to Incorporated Intelligence, which in turn distributes it to the patients.
  • The app connects to Incorporated Intelligence’s servers via the internet.
  • Data transmitted to Incorporated Intelligence is stored on the cloud run by a third party cloud service provider. All data collected from patients is kept for at least seven years.
  • Incorporated Intelligence uses data collected from its patients as well as data acquired from third parties to train machine learning algorithms used in the HeartBeat pacemaker.
    • It also uses these same trained algorithms in other of its “intelligent” medical device products.
    • Some of these other “intelligent” medical device products are developed in joint ventures with other companies.
  • Doctors access patient data via Incorporated Intelligence’s cloud service provider.
  • Incorporated Intelligence is subject to various health privacy statutes in the U.S. and in other countries, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA). You do not need to know about the specifics of HIPAA for this assignment—other than knowing that the statute (and similar statutes in other countries) require that patient medical data be kept secure and that it is not shared with third parties without the express consent of patients.
    • A patient’s doctor is authorized to receive information about the patient with a HeartBeat pacemaker.

Assignment

• Incorporated Intelligence has two new board members who are worried about the company’s financial and legal exposure due to cybersecurity, privacy, and AI-related issues.
• The Board of Directors has given you the fact pattern set forth above and asked you to write a memo discussing the cybersecurity, privacy, and AI-related issues raised by the fact pattern.
  • The Board has asked you to base your memo on what you have learned in the Technology Fundamentals class, and The article, My Pacemaker Is Tracking Me From Inside My Body
• You should assume that every word in the fact pattern is there for a reason and thus you should make sure to incorporate as many facts as possible from the fact pattern when you are developing the arguments in your memo.
• The memo should be no longer than 600 words.

Note: Please use the following headings in your memo:

1. Artificial Intelligence Issues
2. Cybersecurity Issues
3. Privacy Issues