Patient data never goes into the model

The first rule in this track is short: patient data never goes into a general AI service. Patient data is not only what is in the medical record. Names, medical record numbers, dates of birth, addresses, phone numbers, complaints, lab results, wound photos, medicine lists, one person's follow-up schedule, even what was said at the registration desk: all of it is patient data. A general AI service means a chat service or assistant that your clinic has not set up and contracted to hold health data, including free accounts and your own paid personal account.

Why so strict? Health data is specific personal data under Law No. 27 of 2022 on Personal Data Protection. Law No. 17 of 2023 on Health protects the confidentiality of patients' health information, and Minister of Health Regulation No. 24 of 2022 governs medical records, including electronic medical records, and who may open them. Once patient data is pasted into a service outside the clinic's systems, you no longer know where it is stored, for how long, or who can read it. Data that has left cannot be pulled back. The third lesson of this module explains those rules in plain words.

The rule does not make AI useless in a clinic. Most clinic administration can be helped without a single item of patient data: building a duty roster from staff numbers and opening hours, planning appointment slots from visits per hour, computing stock needs from per-item usage summaries, tidying SOPs, and drafting notices or message templates with general content. This track is built on work like that.

The most common temptation sounds like this: "I removed the name, so it is safe." For ordinary office data, the lesson on masking data already explains that replacing names with codes does not make data anonymous. In a clinic the problem is sharper, because clinic notes are free text and full of unique details.

A visit note can mention age, job, village, the date of an event, family relationships, a rare illness, or an event people nearby know about, such as an accident at a factory last week. One detail alone may not be enough, but two or three together are often enough to point to one person, especially in a small town where the clinic serves residents who know each other. Removing names by hand also misses things easily: a name can reappear mid-sentence, in a file name or in a photo.

That is why this track does not teach how to "anonymise" patient notes so they can be pasted. Real anonymisation of free text takes expertise, tools and a formal clinic decision, and the result still has to be assessed by someone authorised. For daily work the answer is simpler: do the task without the note at all. If a task can only be done by reading one patient's note, it stays inside the clinic system with the people entitled to it, without a general AI service.

You may ask: what if the clinic buys a system with an AI feature built in? That is a different decision this track does not cover. Such a system is chosen by the clinic's leadership together with the person appointed for data protection, with a clear contract, legal basis, access settings and logging. Until there is a written decision like that, this track's rule applies to every tool.

The rule also covers invented examples. Making a fake but realistic patient note for "practice" sounds safe, but the habit is dangerous: an invented example easily picks up real details you remember from yesterday's patient, and other readers may take it for real data. In this track, every example uses schedules, stock, SOPs and general topics.