WA Health Artificial Intelligence Policy MP 0193/25 and Standard 8.4: Principle 4, privacy protection and security: collect, use and disclose information only under the Information Access, Use and Disclosure Policy and the Privacy and Responsible Information Sharing Act 2024; never enter Official or Official: Sensitive information including personal and health information into public generative AI connected to the internet without specific approval; apply anonymisation, de-identification, synthetic data, encryption and secure aggregation to personal information; have vendor data collection, access, use, storage and transfer arrangements disclosed to and agreed by the Information Custodian or Steward; comply with Information Privacy Principle 10 on automated decision-making; subject AI systems including vendor products to security risk assessment under the WA Government Cyber Security Policy and the Information Security Policy; complete a cloud service assessment for cloud hosting under the Cloud Policy; and keep staff current on AI-specific threats such as theft of data or algorithms, data poisoning, algorithm tampering and reverse engineering of patient data

What does 8.4 require?

WA health entities must ensure privacy and appropriate use of personal and health information when using AI: collecting, using and disclosing information only in accordance with MP 0015/16 Information Access, Use and Disclosure Policy and the Privacy and Responsible Information Sharing Act 2024; never entering Official or Official: Sensitive information, including personal and health information, into public generative AI systems that integrate with the internet unless specific approval exists to release it for public use and reproduction; always applying data protection techniques to personal information such as anonymisation and de-identification, synthetic data, encryption and secure aggregation; having a vendor's arrangements for the collection, access, use, storage and transfer of WA health data disclosed to and agreed by the relevant Information Custodian or Steward; and complying with Information Privacy Principle 10 on automated decision-making where personal information is used to make significant decisions about individuals. Because AI systems are critical assets holding large volumes of data, entities must ensure that AI systems including vendor products undergo a security risk assessment and are protected under the WA Government Cyber Security Policy and MP 0067/17 Information Security Policy, that a cloud service assessment under MP 0120/20 Cloud Policy is completed where the system is cloud hosted, and that relevant staff stay current on security threats specific to AI, including theft of information or algorithms, poisoning of training data to produce inaccurate, biased or malicious outputs, tampering with algorithm performance to hijack outputs, and reverse engineering to recover identifying patient information, applying recommended updates and protections.