GDPR Compliance for AI in Healthcare: Patient Data & Medical AI Systems

Article 6 (General Lawful Basis) + Article 9 (Health Data Exception)

Common combinations for healthcare AI:

• Explicit consent (Art. 9(2)(a)): Patient explicitly consents to AI processing. Must be freely given, specific, informed, unambiguous. Can be withdrawn at any time — your AI must handle data deletion.
• Healthcare provision (Art. 9(2)(h)): Processing necessary for medical diagnosis, treatment, or healthcare management. Applies when AI directly supports clinical care.
• Public interest in public health (Art. 9(2)(i)): Epidemic surveillance, quality assurance. Requires EU or Member State law basis.
• Scientific research (Art. 9(2)(j)): AI model training for medical research. Requires appropriate safeguards (pseudonymisation, data minimisation). Most common basis for training medical AI models.

Data Protection Impact Assessment (DPIA)

A DPIA is mandatory for healthcare AI under GDPR Article 35(3):

• Large-scale processing of health data: Any hospital or health system AI likely meets "large scale"
• Automated decision-making with legal effects: AI-assisted diagnosis or treatment recommendations
• Innovative technology: Novel AI applications in healthcare

The DPIA must assess: necessity and proportionality, risks to patient rights and freedoms, mitigation measures, and DPO consultation.

• Right to explanation (Art. 22 + Recital 71): If AI makes or significantly influences medical decisions, patients have the right to meaningful information about the logic involved. Black-box models are problematic.
• Right to human review: Patients can request human intervention in automated decisions affecting their care
• Right to erasure (Art. 17): If consent is withdrawn, patient data must be deleted. This may affect trained models (machine unlearning challenge).
• Right to data portability (Art. 20): Patients can request their health data in machine-readable format — including data processed by AI systems
• Right of access (Art. 15): Patients can request what data was processed, for what purpose, and who received it — including AI processing

1. Pseudonymisation: Replace direct identifiers with tokens. Essential for research AI. Does NOT make data anonymous under GDPR (still personal data).
2. Anonymisation: Irreversibly remove identifying information. Truly anonymous data is outside GDPR scope. But: re-identification risk in health data is high (small populations, rare conditions).
3. Federated learning: Train AI models across hospitals without centralising patient data. Data stays local; only model updates are shared.
4. Differential privacy: Add calibrated noise to training data or model outputs to prevent individual patient identification
5. Encryption: At rest (AES-256) and in transit (TLS 1.3) for all patient data. Article 32 technical measure.