AI in clinics and care: How do you use AI on health data?
Short answer
Health data is sensitive, and healthcare professionals are bound by confidentiality. AI can be used for admin, letters, bookings and summaries if you have a business subscription with a data processing agreement, a condition under Article 9 GDPR, an impact assessment and – ideally – pseudonymisation, so the AI never sees a name and health details together. AI that makes diagnoses or recommends treatment is typically a medical device and high-risk; don't use an ordinary chatbot for that.
What is what?
| Use | Assessment |
|---|---|
| Replying to bookings, moving appointments | Sensitive (reveals that someone is a patient) – pseudonymise |
| Letters and summaries, checked by a professional | Sensitive – pseudonymise, DPIA |
| Prioritising patients (triage) | May be high-risk or a medical device |
| Diagnosis and treatment suggestions | Medical device and high-risk |
See the solutions for patients and residents in care and supported housing.
What to do
- Keep AI away from diagnosis.Use it for admin and writing.
- Carry out a DPIA.Health data combined with new technology usually requires one.
- Pseudonymise.Names and national ID numbers stay in the EU.
- Let the professional check.Everything the AI writes is read by a clinician before it is used.
What the law says
- Article 9(2)(h) GDPR
- Processing of health data for healthcare under a duty of professional secrecy.
- Regulation (EU) 2017/745 – medical devices (MDR)
- Software for diagnosis and treatment is typically a medical device.
- Article 6(1) AI Act
- AI in medical devices that require a third-party assessment is high-risk (from 2 August 2028).
Questions and answers
Can we write clinical notes with AI?
It can be responsible with pseudonymisation, an agreement and a professional who checks. Also check the requirements of your professional regulator.
What about the European Health Data Space?
The EHDS Regulation is being phased in over the coming years and deals with, among other things, access to health data. It doesn't change the need for caution today.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.