On October 15 in Santa Fe, NM, Andrea Downing, president and co-founder of The Light Collective, discussed patient trust at the annual ADAPT (Advancing Data Access, Privacy, and Trust) Conference hosted by the Healthcare Trust Institute (HTI). The Light Collective, a patient-led 501 nonprofit headquartered in Oregon, advances the rights, interests, and voices of patient communities in health technology.

Speaking about the intersection of cybersecurity, privacy, and patient advocacy, Downing argued that patients often have little say in how their health information is collected, shared, and used. She called for greater patient representation in decisions about digital health and artificial intelligence (AI).

“Patients move at the speed of desperation, health systems move at the speed of trust, and attackers and scammers move in the space in between,” Downing said, describing how patients can be left vulnerable while navigating illness and digital services.

Downing’s advocacy grew out of concerns about online patient communities and the risks of data misuse. Her work investigating digital tracking practices highlighted tracking pixels embedded in healthcare websites and patient portals that can transmit information to technology companies. She said these practices have exposed millions of patients to potential privacy harms, despite increased regulatory attention.

She also highlighted the growing impact of cyber incidents beyond hospitals’ IT systems. Ransomware can disrupt clinical services, while compromised online support groups can expose members to harassment, scams, and the loss of years of community resources.

Another emerging concern is the use of automated bots to infiltrate patient research. Downing described how bots entered an institutional review board-approved study conducted by the Light Collective in 2023, raising questions about the reliability of survey responses and the resources needed to identify and remove fraudulent data. She warned that such interference could undermine research findings and decisions based on patient-reported outcomes.

As healthcare organizations increasingly adopt AI, Downing said patients need more than privacy policies and consent forms that are difficult to understand. They need meaningful influence over the decisions that affect their data and care.

Through the Patient AI Rights Initiative, the Light Collective has worked with patient advocates to explore principles for responsible AI. Two priorities emerged: patient-led governance, including voting representation in decision-making, and a stronger duty of care toward patients whose lives and health information may be affected.

The initiative has also examined whether consumer-facing health applications offer practical protections, such as data deletion, the ability to withdraw consent, restrictions on advertising trackers and clear disclosures about AI models that process patient information.

Downing said many applications fall short of these expectations, while privacy policies can leave patients struggling to understand their rights.

Downing emphasized that addressing digital harm requires cooperation among patient communities, cybersecurity professionals, privacy experts, healthcare organizations and policymakers.

She also stressed that patients facing serious diagnoses or major medical events should not have to navigate complicated reporting systems or manage digital threats on their own.

She said the central message is that cybersecurity must be treated as a patient safety issue. Building trustworthy digital health systems requires not only stronger technical protections, but also meaningful patient participation in how those systems are designed, governed and held accountable.

Pietje Kobus-McAllister has an international background and experience in content management and editing. She studied journalism in the Netherlands and Communications and Creative Nonfiction in the U.S. Pietje joined Healthcare Innovation in January 2024.