AI in the Medical Practice: What's Allowed and What Isn't

There's one rule that overrides everything else: patient data never goes into an AI tool. Not into ChatGPT, not into Claude, not into a translation program. Not anonymized, not in fragments, not "just to try it out real quick."

Anyone who knows and follows this rule can still put AI to sensible use in a medical practice. Just not in the place most people look first.

Why patient data is different

The GDPR has a category of specially protected data. Article 9 names health data among others, and processing it is prohibited as a general rule. There are exceptions, such as treatment itself, but they're narrowly defined.

On top of that comes physician-patient confidentiality under Section 203 of the German Criminal Code. A violation isn't a regulatory offense, it's a criminal one. And the offense is already committed once an unauthorized party has the mere possibility of gaining knowledge, not only once they actually do.

Where AI still helps in the practice

The good news is that a significant share of the work in a medical practice doesn't touch patient data at all. That's exactly where the potential lies.

Practice organization and internal texts

Duty rosters, practice workflows, checklists for medical assistants, onboarding materials for new staff. All of these are texts with no personal data attached, where AI saves time.

Patient information and notices

A notice about changed opening hours. An information sheet on how to prepare for an examination. A text for the practice website about a new service. This content is aimed at all patients, not at one specific person, and it can be drafted excellently with AI.

Administration and correspondence with third parties

Letters to suppliers, inquiries to the regional association of statutory health insurance physicians, job postings for the practice, replies to Google reviews. None of that contains health data.

Research for your own knowledge

A summary of a technical term, an explanation of a study design, preparing for continuing education. Here, AI is a tool for you, not for the patient, and you check the results against expert sources anyway.

The gray area: reviews and complaints

A critical Google review mentions a treatment. Are you allowed to copy it into an AI to draft a good reply?

Be careful. The review may be public, but it contains health information about an identifiable person, its author. And your reply isn't allowed to confirm anything anyway. Even confirming that someone is a patient violates confidentiality.

What becomes possible with a data processing agreement

There are specialized providers offering AI features with medical certification and a data processing agreement in place, for example dictation or coding assistance built into practice management systems. These systems are built and vetted for handling patient data.

The difference from ChatGPT is fundamental. Not because the technology is different, but because the legal framework is: contracts, server locations, certifications, data deletion policies.

If you want to use AI at the core of your practice work, the path runs through systems like these, not through general-purpose chatbots.

A checklist for everyday practice

• Write down which AI tools are allowed to be used in the practice, and for what.
• Make sure all staff know: no patient data, under any circumstances.
• Use placeholders and describe situations in the abstract rather than concretely.
• Check every AI output before it goes to a patient. Professional responsibility stays with you.
• Add an entry to your record of processing activities as soon as you use AI for business purposes.
• When in doubt, talk to your data protection officer before introducing a new tool.

The honest benefit

AI isn't going to change treatment in a medical practice. It's not going to take over documentation either, at least not through general-purpose chatbots.

What it can do: reduce the two to four hours a week spent on notices, information sheets, job postings, review replies, and internal organization down to a fraction of that. That's not a revolutionary promise. It's an honest one.