  The use of connected surgical robotics to automate medical procedures
presents new privacy challenges. We argue that conventional patient consent
protocols no longer work. Indeed robots that replace human surgeons take on an
extraordinary level of responsibility. Surgeons undergo years of training and
peer review in a strongly regulated environment, and derive trust via a
patient's faith in the hospital system. Robots on the other hand derive trust
differently, via the integrity of the software that governs their operation.
From a privacy perspective, there are two fundamental shifts. First, the threat
model has shifted from one where the humans involved were untrusted to one
where the robotic software is untrusted. Second, the basic unit of privacy
control is no longer a medical record, but is replaced by four new basic units:
the subject on which the robot is taking action; the tools used by the robot;
the sensors (i.e data) the robot can access; and, finally access to monitoring
and calibration services which afford correct operation of the robot. We
suggest that contextual privacy provides useful theoretical tools to solve the
privacy problems posed by surgical robots. However, it also poses some
challenges: not least that the complexity of the contextual-privacy policies,
if rigorously specified to achieve verification and enforceability, will be
exceedingly high to directly expose to humans that review contextual privacy
policies. A medical robot works with both information and physical material.
While informational norms allow for judgements about contextual integrity and
the transmission principle governs the constraints applied on information
transfer, nothing is said about material property. Certainly, contextual
privacy provides an anchor for useful notions of privacy in this scenario and
thus should be considered to be extended to cover both information and material
flows.
