AI scribes and the GDPR: 7 questions to ask before you start
A recording of a consultation contains health data. Under the General Data Protection Regulation (GDPR) that is a special category of personal data, with stricter rules. Before introducing an AI scribe, it is worth asking the vendor a few specific questions.
This article is not legal advice. For an assessment in your organisation, involve your data protection officer.
1. Where is the data processed?
Ask where the servers are for the application, the database, speech recognition and the language model that writes the note. These are often different providers. If any processing happens outside the European Economic Area, ask on what legal basis the data is transferred.
2. Is the audio kept, and for how long?
The recording is only needed until it has been turned into text. Ask whether it is deleted after transcription, whether the vendor or one of its subprocessors keeps it, and whether recordings are used to train models.
3. Who are the subprocessors?
The vendor should be able to name the providers it passes data to (infrastructure, speech recognition, language model) and under what terms.
4. Is there a data processing agreement?
The clinic is usually the controller and the vendor the processor. Their relationship is governed by a data processing agreement (Article 28 GDPR), which sets the purpose of processing, security measures, deletion periods and what happens in an incident.
5. How are patients informed?
Patients should know that the conversation is recorded and processed, and why. Agree within your organisation how you will inform them and when consent is needed.
6. Can the amount of personal data be reduced?
The safest data is data that was never recorded. If the patient's name, national ID number or address is not needed for the note, do not say it while recording, or start recording after identifying the patient.
7. Who can access transcripts and notes?
Ask how sign-in is protected, whether the vendor's staff can see the content, and whether users can delete their own transcripts.
How MedGlas answers these questions
- The application and database run in AWS Frankfurt, in the European Union.
- Note drafts are generated by a language model in EU regions.
- MedGlas does not keep audio recordings after transcription. The transcript and note text are stored in the user's account and deleted automatically and permanently 24 hours after the record is opened; users can delete a record sooner.
- If an upload fails, for example with no connection, the recording waits encrypted (AES-GCM, with a key that is generated in the browser and never leaves it) only on the user's own device until it is sent. It is deleted once sent, at sign-out, or after 24 hours at the latest.
- We recommend not saying direct patient identifiers during a recorded conversation unless they are needed.
Read more in the privacy policy or write to us at hello@cliniatlas.com.