What banking can teach health care about protecting patient data

If a credit card company quietly were to allow third parties to track, analyze and resell your purchases without clear consent, regulators would act, and quickly. Consumers would demand answers. And the company would face real consequences. Health data is even more personal — or at least it should be. 

That reaction reflects something fundamental: People expect their financial data to be protected because it is deeply personal. Spending patterns reveal where we go, what we value and how we live. The idea that this information might be casually shared or repurposed feels like a violation.

It captures not just what we do, but who we are — our diagnoses, medications, mental health history and genetic risks. Yet even as federal agencies move to shape the governance of artificial intelligence in care delivery, the culture and expectations surrounding health data privacy continue to lag behind those that define the financial system. More concerning, there is still insufficient urgency across both the public and private sectors to close that gap.

AI is rapidly becoming embedded in clinical workflows, expanding both the scale and speed of health data use. We also have wearable data that tracks biometrics continuously. Sensitive information now moves across electronic health records, consumer platforms and a growing network of technology vendors. These tools hold real promise: improving diagnosis, reducing administrative burden and tailoring personal treatment. But they also create new pathways for flawed or biased data to influence medical decisions, insurance coverage and patient trust.

This transformation is unfolding within a data environment that remains fragmented and unevenly governed. The result is a persistent and troubling paradox: Americans often encounter stronger, more consistent protections for their financial transactions than for their diagnoses, medications or genetic risks.

There are lessons here.

First, trust must be built deliberately. Public confidence in modern banking did not emerge simply because new technologies became available. It was the result of coordinated standards, strong oversight and early regulatory signals that made those technologies safe to use. 

When ATMs were introduced, clear rules around security, authentication and consumer protection helped normalize their adoption. Health care now faces a similar moment. AI will only scale if patients and physicians believe its use is governed by clear, consistent safeguards — and if leaders demonstrate the will to put those safeguards in place.

Second, privacy protections must reflect the true sensitivity of the data. Financial systems are built on the assumption that transactional information is inherently confidential. Health data is even more revealing, yet protections often vary depending on where information is stored or which platform collects it. 

Still, there is an important difference between a stolen credit card and the misuse of your medical information. A credit card can be replaced, and access to a compromised bank account can be shut down. Your medical information cannot be replaced. It is unique to you and permanently linked to who you are. As AI use accelerates, these inconsistencies increase the risk that errors or bias will be amplified — and that patients will lose confidence in how their information is handled.

Third, technological capability does not eliminate the need for professional oversight. Digital banking improved convenience, but it did not diminish the importance of governance, accountability or expert supervision. This also applies in medicine where AI can support clinical judgment, but it cannot assume responsibility for patient outcomes. 

Physicians must remain central: evaluating how these tools are deployed, how data is interpreted and how risks are communicated. Yet, physicians cannot exercise meaningful oversight unless AI developers provide the tools that can tell us when information is shared and when it is not, that can track who used information and when and that requires consent before information is used to train AI. 

Health care is entering a period of rapid and consequential change. Patients are increasingly asked to trade personal health information for convenience and access. Many are also turning to general-purpose AI tools and online sources for medical guidance. Yet the policy response remains uneven despite the stakes.

The U.S. built a financial system that most people trust with their savings because accountability, standardization and privacy protections were treated as foundational — and because leaders acted with clarity and purpose when new risks emerged. Building a health data ecosystem worthy of that same confidence will require the same resolve.

What is needed is a national privacy and information accountability infrastructure, one that covers AI developers and companies that store vast quantities of data. Congress should pass legislation that sets a common floor, creating protections for patients inside the health care ecosystem and when they use consumer-facing digital health tools, apps and AI systems outside of it. 

AI will shape the future of medicine. Whether it strengthens or weakens the patient-physician relationship will depend not just on the technology itself, but on whether we are willing to act — now — to earn the trust it requires.

John Whyte, MD, MPH is chief executive officer at the American Medical Association.