Module 1 · Start safely
The rules that apply and who is responsible
In short
The anchors: the PDP Law (health data is specific data), the Health Law (confidentiality of patient information) and the Medical Records Regulation. Your clinic's policy turns them into practice, and every document has an approver. Not legal advice.
After this lesson you can
- Explain in plain words the health data rules that apply to AI use in a clinic
- Name the core contents of an AI usage policy at the clinic where you work
- Decide who approves each kind of clinic document made with AI's help
Terms in this lesson
Understand
Three rules anchor this track. You do not need to memorise articles; you need to know what is protected.
Law No. 27 of 2022 on Personal Data Protection (the PDP Law). Health data and information are specific personal data (Article 4(2)), which calls for extra care. A clinic usually acts as the Personal Data Controller: the clinic decides what patient data is used for and bears the consequences. Sending data to a service that processes it abroad has its own conditions, and a protection failure must be notified within a short deadline. The basics are covered in the lesson on PDP Law basics.
Law No. 17 of 2023 on Health. This law replaced several earlier health laws, including Law No. 36 of 2009. One of the things it protects is the confidentiality of patients' health information: that information is not disclosed except in the situations the rules allow. Medical and health workers act within their competence and authority, which is why clinical decisions cannot be handed to a machine.
Minister of Health Regulation No. 24 of 2022 on Medical Records. This regulation governs medical records in health facilities, including the duty to keep electronic medical records, what records contain, their security and confidentiality, and who may access them. The record stays in the clinic's proper system and is opened by people entitled to it for the purposes allowed.
What it means for you: pasting patient data into a general AI service discloses health information to a party with no right to it, through a channel the clinic does not control. That is why the first rule of this module has no exceptions.
National rules are general. The clinic's AI usage policy turns them into daily work. A useful policy fits on one or two pages and answers seven things: which tools and accounts may be used; which tasks AI may help with; which data may never go in; which uses are banned, namely diagnosis, triage, treatment and doses; which documents must be checked by whom before use; whom to report to if data has slipped out; and when the policy is reviewed.
If your clinic has no written policy yet, that is not permission to use anything. Use this track's rules as a temporary limit, then propose to the clinic manager that it be written down. The mini project in module 5 helps you draft it.
Every document made with AI's help needs an approver: a person who checks its content, signs it and answers for it if it is wrong. A common split in a small clinic: any clinical content, including patient text that mentions the body, medicines, food or test preparation, is approved by an authorised clinician; clinical SOPs by the clinic's person in charge; operational documents such as rosters, opening-hours notices and registration flows by the clinic manager; stock and medicine purchasing documents are checked by the responsible pharmacist or pharmacy staff; questions about new tools and reports of data that slipped out go to the person appointed for data protection.
Job titles at your clinic may differ. What matters is that before a draft is made, you already know who approves it. The person drafting makes sure the material is free of patient data and marks the document DRAFT until it is approved.
Before
The prompt
Write out the laws that forbid clinics from using AI, with the article numbers.
What came back
Under Article [number] of Law No. 36 of 2009 on Health, clinics are prohibited from using artificial intelligence in services, and violations carry administrative sanctions.
After
The prompt
I am clinic admin staff, not a lawyer. Goal: material for a five-minute staff briefing on why patient data must not go into a general AI service. Reader: registration and admin staff. Material: rule text I copied from an official source: [pasted text]. Limits: use only the text I pasted. Do not add article numbers or other rules from memory. If something is unclear, write "check with the person in charge". Shape: five short points in everyday language. Check: at the end, say for each point which part of the text it rests on.
What came back
1. Patients' health information is confidential (basis: the pasted confidentiality section). 2. Health data is specific personal data (basis: Article 4(2) of the PDP Law). 3. Medical records are opened only by people entitled to them (basis: the pasted access section of the Regulation). 4. Pasting patient data into a service outside the clinic discloses it to another party. 5. On AI tools provided by the clinic: check with the person in charge.
What changed
- The first answer cites a replaced law and invents a ban that does not exist, in a confident tone.
- The second request supplies the official text as material and forbids additions from the model's memory.
- Points the text does not answer are flagged to ask, not guessed.
Common mistake
- Mistake
- Assuming that if the clinic has no written AI policy, any use is fine as long as you are careful.
- Why it hurts
- National rules on health data and medical records apply even when the clinic has not written a policy. Without a written limit, each staff member draws their own line, and the loosest line ends up setting the clinic's risk.
- Do this instead
- Use this track's rules as the temporary limit: no patient data, no clinical decisions, every document has an approver. Then propose a written policy to the clinic manager.
Try
Sorting card
Who approves or handles each of these in a small clinic?
Next month's staff roster
A general handwashing leaflet for the waiting room
Whether staff may use a new AI service
A notice about holiday opening hours
A report that a patient list was pasted into a personal AI account
A reminder template on preparing for a lab test
6 cards left
A new staff member asks: "May I use my personal AI account to draft the opening-hours notice?" The clinic policy says only work accounts provided by the clinic may be used. What is your answer?
Take home
Pocket rule card for AI at the clinic
- Health data is specific personal data; the clinic bears the consequences
- Patients' health information is confidential and records are opened only by those entitled
- I know where the clinic's AI usage policy is kept and which accounts may be used
- Before drafting, I know who approves it
- I know whom to report to if patient data has slipped out
What went wrong for us
Every document has a named approver
- Context
- With AI, drafts of SOPs, notices and message templates can be ready in minutes. In a clinic, such documents are used by many people and some are read by patients.
- What tends to go wrong
- A draft that is quick to make easily circulates before anyone has really checked it, and once it circulates it is hard to trace who approved it.
- What it costs if ignored
- If a document is wrong, there is no clear person to fix it, and staff do not know which version applies.
- Root cause
- Fast drafting was not matched by a written approval step.
- How we do it
- A document made with AI's help is used only once it has an approver named by role, an approval date and a version number.
- The rule we keep
- A draft without an approver keeps a DRAFT mark and is not posted, shared or sent to patients.
The lessonA document nobody has approved may not be used by anyone yet.
What it means for your workBefore using an AI-made draft in the clinic, write down who approved it, when, and which version.
Sources
- Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (JDIH BPK) (accessed 26 October 2026)
- Undang-Undang Nomor 17 Tahun 2023 tentang Kesehatan (JDIH BPK) (accessed 26 October 2026)
- Peraturan Menteri Kesehatan Nomor 24 Tahun 2022 tentang Rekam Medis (JDIH BPK) (accessed 26 October 2026)