To review ABA software data use AI training and secondary use terms, trace each data class from collection through access, disclosure, retention, derivation, analytics, product improvement, model training, advertising, sale, subcontractors, export, and deletion. Compare contracts, BAAs, privacy notices, settings, and product behavior. Require clear scope, authority, opt-in or prohibition, change control, and evidence. Never assume de-identification, aggregation, synthetic data, or an AI toggle resolves every restriction.

Define Rina's data use, AI training, and secondary-use terms

Rina distinguishes client PHI, consumer health data, workforce data, practice-confidential information, usage telemetry, prompts, outputs, derived labels, de-identified data, synthetic test data, and vendor operational logs. One term such as customer data can hide materially different rights. The map records each category and activity separately.

Build the data-use and model-training rights map

The record captures review ID; product, version and feature; data class and source; person or practice ownership interest; regulated status; collection and necessity; vendor and subprocessor access; permitted purpose; treatment, payment, operations or other authority; product improvement; customer-specific and general model training; fine-tuning; evaluation; telemetry; derived data; de-identification method and residual risk; synthetic provenance; sale, advertising or sharing; retention; deletion; opt-in, opt-out and default; setting; notice; contract and BAA term; change control; evidence; owner; and disposition. Structured fields support comparison, routing, alerts, evidence expiry, and validation. Narrative preserves clinical reasoning, client and family experience, accessibility, uncertainty, disagreement, legal deferral, source limits, and why an accountable owner accepted, restricted, remediated, deferred, or rejected the item.

Apply Rina's procurement or rollout workflow

Rina reads every controlling document, tests configured settings, asks the vendor direct questions, and records inconsistencies. Privacy, security, clinical, data, employment, competition, contract, and legal owners review their domains. Prohibited data stays out of the feature until terms and behavior satisfy the approved route. Material changes trigger re-review before continued use.

Protect the data use, AI training, and secondary-use terms boundary

FTC staff has warned AI companies to honor privacy and confidentiality promises, including commitments about model training. That staff post is not a new general AI statute. HIPAA duties depend on entity and relationship, while other state, consumer-health, biometric, employment, contract, and competition rules can apply separately.

Keep authority and evidence attributable

Rina assigns each clinical, privacy, security, technical, accessibility, finance, contract, workforce, and operational decision to a qualified owner. Software and vendors may surface evidence or propose an action. They cannot accept the practice's risk, grant professional authority, replace client involvement, or approve their own control effectiveness.

Make unknowns and conditions visible

Rina records each unknown, assumption, exception, dependency, workaround, safeguard, owner, deadline, escalation, and retest. An unanswered question stays unknown. A conditional acceptance states the exact remediation, operating restriction, evidence, expiry, and consequence of missing it.

Work through Rina's fictional example

Rina reviews 18 fictional data activities in one platform. Twelve have clear authority, purpose, setting, vendor and subprocessor use, retention, deletion, and change control. One model-training term conflicts with the BAA, one telemetry field includes identifiers, one de-identification claim lacks a method, one opt-out resets after updates, and two derived-data uses are unclear. Three repair. Three stay disabled. This synthetic example tests workflow and denominator logic. It establishes no clinical, privacy, security, accessibility, contract, insurance, payer, employment, record, financial, or legal conclusion for a real practice or vendor.

Calculate Rina's measures honestly

Initial activity readiness is 12 of 18, or 66.7%. Fifteen activities reach approved or prohibited disposition, or 83.3%. Products, features, data classes, activities, purposes, models, subprocessors, and settings retain separate denominators.

Address the main data use, AI training, and secondary-use terms risk

A general privacy promise can coexist with a separate product term that permits training, broad telemetry, indefinite retention, or reuse of derived information.

Test Rina's control against hard cases

Rina tests prompt logging, note drafting, customer-specific model, general model, human review by vendor, telemetry, de-identification, synthetic test set, subprocessor, advertising, sale, opt-out, deletion, and terms update. Each test retains product and version, configuration, data, user, starting state, expected safeguard, observed result, defect, owner, retest, and disposition. Failed, skipped, and unknown cases remain visible with reasons.

Run Rina's independent acceptance test

Rina gives a reviewer the data-flow map, contracts, BAA, privacy terms, settings, vendor answers, and tests. The reviewer selects each data class and follows every permitted activity and deletion path. A hidden secondary use or unresolved conflict fails.

Maintain the data-use and model-training rights map

Rina assigns a review cadence and triggers for requirement, product, version, configuration, workflow, integration, subprocessor, data use, law, contract, incident, staffing, access, cost, and ownership changes. The data use, AI training, and secondary-use terms page remains draft until every named external review finishes.

Use public organizational guidance within scope

Rina uses the CASP Organizational Guidelines public overview only for high-level business, clinical-operations, and risk-management context. CASP sells the detailed guidelines. The data-use and model-training rights map is an editorial model built for this task and does not imply CASP approval of a product or architecture.

Map business-associate duties and contract terms accurately

Current HHS Business Associates guidance describes function-based roles, subcontractors, agreements, and exceptions. HHS sample BAA provisions address HIPAA concepts and explicitly caution that sample language alone may be insufficient as a binding state-law contract. HHS cloud guidance preserves CSP business-associate status even for encrypted ePHI without a key. Rina scopes every relationship.

Connect procurement and rollout to risk analysis

HHS risk-analysis guidance requires a regulated covered entity or business associate to assess risks and vulnerabilities to all ePHI it creates, receives, maintains, or transmits. Rina feeds findings from the data use, AI training, and secondary-use terms into current risk analysis and risk management rather than treating a contract, demo, score, or training record as certification.

Use current Security Rule safeguards

Current 45 CFR 164.308 covers administrative safeguards, 45 CFR 164.312 covers technical safeguards, and 45 CFR 164.316 covers policies, procedures, and specified documentation retention. Rina checks each applicable standard and implementation specification for the deployed workflow without claiming the rule requires one product or design.

Review consumer-health and AI data promises separately

The FTC Health Breach Notification Rule guidance has its own entity, PHR, multiple-source, and exclusion tests. FTC staff also tells AI companies to uphold privacy and confidentiality commitments, including promises about training and undisclosed uses. Rina treats that staff post as enforcement-oriented guidance, not a new universal AI statute.

Use voluntary frameworks as organizing aids

The NIST Cybersecurity Framework 2.0 helps organizations manage cybersecurity risk. The NIST AI RMF page describes AI RMF 1.0 as voluntary and says it is being revised. The OIG General Compliance Program Guidance is voluntary and nonbinding. Rina uses these sources to organize evidence for the data-use and model-training rights map, never as legal safe harbors.

Build accessibility into procurement and rollout

Rina checks the DOJ Title III overview and web-accessibility guidance within their scopes. The ASHA AAC Practice Portal says AAC users should always have access to their communication tools. Demonstrations, contracts, training, support, and rollout cover keyboard, screen-reader, language, device, AAC, and alternative-channel needs.

Related resources

Sources