# The Role of AI-Based Chatbots in Public Health Emergencies: A Narrative Review
## 7 Challenges and Limitations of AI Chatbots in Infectious Disease Outbreaks
### Privacy and Data Security Risks  
The deployment of AI chatbots in healthcare often requires collecting personal health information (PHI) to provide tailored advice, raising significant privacy concerns [139]. Ensuring compliance with regulations such as HIPAA and GDPR is essential, but many chatbot platforms may lack the necessary infrastructure, posing risks to user data security [133]. The challenge is especially relevant during epidemics when individuals may share more sensitive data, increasing the potential for breaches that can lead to identity theft, discrimination, and a loss of trust in healthcare systems [63].  
One of the key challenges is ensuring that chatbots collect only the minimum amount of data necessary to provide accurate responses. The principle of data minimization should be a cornerstone of chatbot design, ensuring that sensitive information is not unnecessarily stored or shared [140]. Additionally, end-to-end encryption and secure authentication protocols are critical to safeguarding PHI [141]. These technical measures must be complemented by user education, ensuring that individuals understand how their data are being used and what protections are in place [118]. Another important consideration is the transparency of data usage. Users should be informed about the types of data being collected, the purposes for which it will be used, and the entities with which it may be shared. This transparency is crucial for building trust, particularly in communities that may be skeptical of AI technologies [142]. Furthermore, real-time feedback mechanisms should be implemented to allow users to report privacy concerns or data breaches, enabling the continuous improvement of chatbot security measures [143]. The issue of data ownership also warrants attention. In many cases, the data collected by chatbots are stored and analyzed by third-party providers, raising questions about who ultimately controls this information. Clear guidelines and agreements must be established to ensure that data ownership remains with the individual or the healthcare provider, rather than the technology vendor [63]. Finally, the long-term storage of health data poses additional risks. While historical data can be valuable for research and improving chatbot performance, it also increases the potential for misuse. Policies must be put in place to ensure that data are anonymized and securely stored, with strict access controls to prevent unauthorized use [144].  
To safeguard PHI, techniques like end-to-end encryption, anonymization, and secure authentication protocols are critical [141]. Anonymization reduces the risk of data breaches by ensuring that compromised data cannot be linked to individuals, while multi-factor authentication helps secure access to the chatbot system [143]. Regular security audits should be conducted to identify and mitigate vulnerabilities in the chatbot infrastructure [144]. Socio-technical strategies are also vital. Compliance with regulations like HIPAA and GDPR must be demonstrated, and users should be informed about data collection practices and asked for informed consent [142]. Adopting the principle of data minimization--collecting only what is necessary for the chatbot's function--can limit exposure to sensitive data [140]. Educating users on how their data are protected and their rights under privacy laws is key to fostering trust [118]. Research is needed to explore how AI chatbots can deliver personalized advice while maintaining compliance with privacy regulations. Incorporating privacy by design from the outset ensures that privacy considerations are integrated at every stage of chatbot development [142]. Additionally, advanced techniques like federated learning and real-time encryption should be investigated to balance data utility and privacy without compromising chatbot performance [63].