The Estonian data protection authority (AKI) has published clarifications on the use of artificial intelligence (AI) in the healthcare sector, reminding that the same data protection rules apply regardless of the technology used.

The authority emphasizes that the GDPR is technologically neutral and that the introduction of AI does not change existing obligations. The responsibility for processing patient data lies with the healthcare provider, not with an employee acting on their own initiative. Therefore, a healthcare professional cannot decide alone to use an AI application, even if publicly available, to record or transcribe consultations. The adoption of such technology must result from a decision by the establishment, preceded by an analysis of the legal bases, risks, service conditions, and if necessary, a data protection impact assessment. Clear and complete information to patients must also be ensured.

The authority warns against the increase in the volume of data processed, notably when audio recording consultations which may capture information irrelevant to care. Each step of the processing (recording, transcription, analysis) must be evaluated separately and based on an appropriate legal basis. Patient consent, if used, must be freely given and not condition access to care. The AKI also specifies that the use of a paid AI service does not in itself guarantee compliance; a thorough analysis of the conditions remains essential to ensure the protection of health data, which are particularly sensitive data.