Privacy with Surgical Robotics: Challenges in Applying Contextual Privacy Theory

Abstract

The use of connected surgical robotics to automate medical procedures presents new privacy challenges. We argue that conventional patient consent protocols will no longer work. Indeed robots that replace surgeons take on an extraordinary level of responsibility. Human surgeons undergo years of training and peer review in an strongly regulated environment, and they derive trust via a patient's faith in the hospital system beyond the surgeon him/herself. Robots on the other hand derive trust not through the hospital system they operate within, but the integrity of the software that governs their operation. From a privacy perspective, there are two fundamental shifts. First, the threat model has shifted from one where the humans involved were untrusted to one where the robotic software is untrusted. Second, the basic unit of privacy control is no longer a medical record, but is replaced by four new basic units: the subject on which the robot is taking action; the tools used by the robot and the valid form of tool usage; the sensors (i.e data) the robot can access and the operations permitted over them; and, finally access to monitoring and calibration services which afford correct operation of the robot. We suggest that contextual privacy provides useful theoretical tools to solve the privacy problems posed by surgical robots. However, it also poses some challenges: not least that the complexity of the contextual-privacy policies, if rigorously specified to achieve verification and enforceability, will be exceedingly high to directly expose to human regulators/auditors/users that review contextual privacy policies. Another key challenge, is that contextual privacy accommodates information flows but not property. A medical robot works with both information and physical tissues and fluid material. While informational norms allow for judgements about contextual integrity and the transmission principle governs the constraints applied on information transfer, nothing is said about material property. Certainly, contextual privacy provides an anchor for useful notions of privacy in this scenario. However, it appears the to solve the privacy challenges in the field of surgical robotics well, one needs to consider extending contextual privacy to cover both information and material flows.