Privacy-preserving AI can protect your heart data, the bill is the problem

A heart monitor used to be a box beside a hospital bed. Electrodes fed a cable, the cable fed a screen, and a nurse watched the screen. The threat model fit on a sticky note.

Cardiac care doesn’t work like that anymore. A patch or smartwatch records the electrocardiogram (ECG). A phone or gateway relays it. A cloud service stores and analyzes it, and a cardiologist reviews it from somewhere else entirely. Increasingly, those recordings also feed AI models trained across several hospitals. Every one of those hops is a place where sensitive data, or something derived from it, can leak.

Ask most vendors how they protect all this and you’ll hear some version of “it’s encrypted in transit and at rest.” That’s true, and it’s necessary. It just doesn’t answer the question that matters.

Where “encrypted” stops helping

Encryption in transit protects the wire. Encryption at rest protects the disk. But the moment a cloud service needs to compute something, like an average heart rate or an arrhythmia alert, the data usually gets decrypted. Now the plaintext sits in memory on someone else’s server.

Collaboration adds another wrinkle. When hospitals jointly train a model, the thing crossing the network often isn’t the raw ECG at all. It’s model updates, and those can leak information about the patients behind them.

A recent PhD dissertation from Istanbul Technical University, by Beyazıt Bestami Yüksel, builds its whole approach around this problem. It splits the data’s journey into separate trust boundaries and assigns each its own protection. There are three:

• The source: the sensor and edge device, where speed matters most.
• Communication and storage: familiar territory for TLS and AES.
• Computation and collaboration: where data has to be processed or learned from without being exposed.

None of this is exotic. It’s threat modeling, applied to a data lifecycle instead of a network diagram. But it forces a question that “in transit and at rest” lets you skip: who can see the data while it’s being used?

The expensive part

That last boundary is where the tooling is youngest. Two techniques come up again and again. Homomorphic encryption lets a server run calculations on data while it stays encrypted. Federated learning lets hospitals train a shared model without pooling patient records: each site trains locally and sends only its updates. Combined, the exchanged values can be aggregated while encrypted, so an aggregator that follows the protocol but is curious about the data cannot read any single hospital’s contribution. That “honest-but-curious” assumption is the threat model the work is built on.

It works. It also isn’t free, and the bill depends heavily on how the data is divided up.

Yüksel tested this on a public dataset of about 21,800 ECG recordings, split to simulate several hospitals. In the simplest setup, each site held different patients but the same kinds of measurements. Encryption added roughly 30% computational overhead. When sites instead held different pieces of information about the same patients, overhead jumped to around 450%. In the most tangled arrangement, it reached 1,200%. Through all of it, diagnostic accuracy barely moved, staying between about 97% and 99.9%.

That’s the part the marketing tends to skip. The accuracy cost of privacy-preserving AI can be small. The compute cost can be an order of magnitude, and it hinges on organizational facts, like who holds which data, that engineers rarely control.

It’s worth stressing that these were simulated hospitals, not a live deployment. Real institutions have messier data and messier networks, which tends to push costs up, not down.

Why this matters beyond cardiology

You probably don’t build heart monitors. But you likely run pipelines with the same shape: device telemetry, relayed through gateways, stored in the cloud, analyzed by services you don’t own, and feeding AI models.

So draw the lifecycle and ask what protects the data at each stop, especially while it’s in use. When a vendor promises “fully encrypted AI,” ask what it costs in your setup, not theirs. Yüksel’s design uses a lightweight scheme at the sensor where latency dominates, standard cryptography for transit and storage, and reserves homomorphic encryption for the boundary where institutions compute together.

Download eBook: Identity-First Threat Intelligence