SAFETY AND SECURITY OF GENERATIVE AI IN HEALTHCARE: A RISK-AWARE FRAMEWORK FOR CLINICAL LLM DEPLOYMENT

Abstract

Generative artificial intelligence (GenAI), particularly large language models (LLMs), is rapidly transforming healthcare by supporting clinical documentation, medical information retrieval, patient communication, clinical decision support, medical education, research, and administrative workflows. Despite these opportunities, the deployment of LLMs in healthcare introduces significant safety and security risks because clinical decisions directly affect patient well-being. Unlike conventional software systems, LLMs can generate plausible but incorrect information, exhibit hallucinations, reproduce biases, expose sensitive information, respond unpredictably to adversarial prompts, and provide outputs that may be difficult for clinicians to verify. This paper proposes a Risk-Aware Clinical LLM Deployment Framework (RAC-LDF) that integrates clinical safety, cybersecurity, privacy protection, evidence verification, human oversight, model monitoring, and governance into the lifecycle of generative AI systems. A conceptual literature-based methodology is used to identify major risk categories and map corresponding mitigation mechanisms. The proposed framework contains six major layers: data and privacy protection, model assurance, clinical evidence grounding, secure inference, human oversight, and continuous governance. Recent evidence demonstrates that LLMs can achieve strong performance on medical knowledge tasks while still producing clinically inappropriate or potentially harmful outputs, highlighting the difference between benchmark performance and safe clinical deployment. Current guidance from the World Health Organization, National Institute of Standards and Technology, and medical-device regulators further emphasizes human autonomy, transparency, accountability, safety, equity, cybersecurity, and lifecycle monitoring. The paper concludes that clinical LLM deployment should follow a risk-stratified approach in which autonomy is proportional to clinical risk. High-risk applications should require stronger validation, human review, auditability, and continuous post-deployment monitoring. The proposed framework provides a practical foundation for healthcare organizations seeking to adopt generative AI while reducing patient-safety, privacy, cybersecurity, and governance risks.