Patient Data and US AI Services in Healthcare
Yes, but only with clear conditions. Patient data is sensitive personal data, so the care provider must show where data is stored, transits, and is processed, which legal mechanism supports any third-country transfer, and how risks are managed. In practice, most providers start with workflows without direct patient data and set written requirements before sensitive data is considered.
The question is being asked right now in every region and at every private care provider: AI can lighten the load of documentation, summarization, and administration – but the strongest models come from US vendors, and patient data is among the most sensitive data GDPR recognizes. The answer isn’t a flat no. It’s a yes with conditions, taken in the right order, with the documentation in place.
The starting point: patient data requires full traceability
Patient data is sensitive personal data under Article 9 of GDPR. That raises the bar for the whole chain: before a US AI service is even considered for healthcare data, the vendor choice has to be able to show three things.
- Where data is actually processed. Not just where it’s stored, but where it transits and – most importantly – where the inference happens, meaning the actual computation when the model reads and answers a request.
- Which legal mechanism supports the transfer. If any part of the processing happens in the US, or US personnel could access the data, a valid transfer mechanism and a documented analysis of it are needed.
- How the risks are managed. An impact assessment (DPIA) is effectively mandatory whenever health data meets new technology.
If the vendor can’t answer in writing where storage, transit, and inference happen, the investigation is over: that path isn’t ready for patient data.
HIPAA agreements are a signal – not an answer
US vendors often meet the healthcare question with their own domestic constructs. Anthropic offers HIPAA-aligned agreements (BAAs) on request, and OpenAI handles the equivalent through an approved healthcare tier. That says something positive: the vendor has processes for healthcare data and is used to regulated customers.
But HIPAA is US healthcare law. A BAA doesn’t replace a single part of the GDPR analysis – legal basis, transfer mechanism, Data Processing Agreement, and DPIA still have to be in place under European rules. Treat HIPAA support as a maturity signal to factor in, never as an approval to lean on.
The AI Act can raise the bar even further
GDPR isn’t the only body of regulation. The EU’s AI Act classifies certain health-related uses as high-risk under Annex III, and high-risk systems are subject to tightened requirements on risk management, documentation, and human oversight. Public care providers also have to carry out a fundamental rights impact assessment – a FRIA under Article 27 – before a high-risk system goes live.
The classification depends on the use, not the technology itself. A writing aid for administrative text is something entirely different from a system that influences triage or care decisions. So define exactly what the AI will do before the legal assessment happens – otherwise you assess the wrong thing.
The pragmatic path: start where there’s no patient data
The practical mistake is starting at the most sensitive end. The order that works looks like this:
| Step | What's included |
|---|---|
| 1. Workflows without patient data | Drafts of patient information, routine documents, training material, internal knowledge search in non-sensitive material |
| 2. Written requirements in place | Zero data retention or documented modified monitoring, statements on storage, transit, and inference, subprocessor list |
| 3. Tightened technical conditions | Customer-controlled encryption keys where offered, EU processing as an active configuration, logging and access control |
| 4. Only now: sensitive workflows | DPIA complete, any FRIA complete, a limited-scope pilot, and ongoing review |
A concrete scenario: a primary care clinic has AI draft appointment letters, patient brochures, and internal routines – text entirely without patient data. Meanwhile, the organization works through the legal analysis for record-adjacent workflows, puts the written requirements to the vendor, and builds a habit of review and quality control. By the time the sensitive step is tested, both the expertise and the paper trail already exist.
At Weapp we build AI solutions on the same principle: value first where the risks are low, and architecture that can handle tightened requirements as usage grows.
Date the assessment – the guidance keeps moving
Regulatory guidance on AI in healthcare keeps evolving, both from Swedish authorities and at the EU level. What’s judged an acceptable setup today may need to be reassessed after the next piece of guidance or ruling.
So date every assessment, note which statements and versions of the vendor terms it’s built on, and set a review point – for instance annually or at every material change in terms. A dated analysis that gets revised is strong protection under audit. An undated analysis that no one owns is nearly as bad as having none at all. Not sure where your organization stands? Get in touch and we’ll help you structure the assessment.
Frequently asked questions
Is it illegal for healthcare providers to use US AI services?
No, there's no general ban. But patient data is sensitive personal data under GDPR, and the care provider must be able to show a legal basis, a valid mechanism for any third-country transfers, and a documented risk analysis. The requirements are high – but they can be met with the right configuration and documentation.
What is a HIPAA BAA, and is it enough in Sweden?
A Business Associate Agreement is a US healthcare contract that governs how a vendor handles patient data under HIPAA. A vendor offering a BAA is a signal of maturity around health data, but it doesn't replace the GDPR analysis – Swedish healthcare still has to assess legal basis, transfers, and risks itself.
Do we need a DPIA before introducing AI in healthcare?
In practice, yes. Processing health data with new technology is a textbook example of when a GDPR impact assessment is required. On top of that, public care providers may need to carry out a fundamental rights impact assessment, a FRIA, under the AI Act before a high-risk system goes live.
Which AI workflows can healthcare start with?
Workflows without direct patient data: drafting patient information, administrative text, summarizing guidelines and routines, coding support for the IT department. These give the organization experience, routines, and a decision basis without exposing sensitive data.
What should we require from the vendor before patient data is considered?
Written statements on where storage, transit, and inference happen, zero data retention or documented modified monitoring, customer-controlled encryption keys where offered, and a complete subprocessor list. Marketing pages and verbal assurances aren't sufficient evidence.