JMIR Publications

ABSTRACT

In this article, we highlight the principal cybersecurity measures that should be implemented to facilitate safe and effective integration of large language models (LLMs) into healthcare. While LLMs offer significant potential for applications in clinical documentation, triage, and medical education, their deployment creates novel vulnerabilities that can compromise patient safety and data confidentiality. We argue that these vulnerabilities must be addressed across the entire AI deployment lifecycle, with distinct threats arising before and after a model enters clinical use. Pre-deployment risks include data and model poisoning, where an LLM’s training data or core parameters are maliciously corrupted to embed biases or backdoors. Post-deployment, LLMs are susceptible to inference attacks such as prompt injection and adversarial inputs, which can be used to manipulate model behaviour and extract sensitive information. Standard performance benchmarks are often insufficient to detect these sophisticated attacks. Therefore, we argue that a proactive, multi-layered security framework combining technical safeguards, rigorous governance and human-in-the-loop oversight, is essential for the safe and trustworthy adoption of LLMs in clinical practice.