Healthcare
AI governance for healthcare organisations.
Keep patient data out of the AI tools that should not see it, and show how you control the ones that should.
The rules that apply
Health data is special category data. Pasting it into an AI tool does not change that.
Under the GDPR, data concerning health is a special category of personal data (Article 9), which may be processed only under specific conditions. Large-scale processing of special category data always requires a data protection impact assessment (Article 35(3)).
When staff paste notes, referrals or test results into an AI assistant, that is processing too, often in a tool nobody approved. Governing it starts with seeing it.
Common scenarios
Three situations you will recognise, and how Qastel handles each.
Scenario 1
Patient notes in an AI tool nobody approved
Qastel's detectors recognise health data in prompts, including medical record numbers, diagnosis codes and health plan IDs. A policy enforced by the browser extension or the desktop agent can block the message, redact the findings or ask the person to confirm before sending.
Scenario 2
A new AI tool spreading across departments
Qastel discovers AI tools from your identity provider, network and browsers, and scores each one on data sensitivity, policy coverage and DPA status, so the tool that suddenly reaches clinical data stands out.
Scenario 3
Evidence for your data protection officer
The Data Protection Officer Guardian reviews what sensitive data reached your AI systems over 7, 30 or 90 days, who sent it and which policy caught it, then writes a report and proposes policy drafts. Nothing takes effect until an admin or operator approves it.
Questions people ask.
Does Qastel store patient data?
Prompt analysis is off by default and only an admin can turn it on. When it is on, prompt text is classified in memory and never stored: Qastel records the category it found, such as health data, not the text.
Will a policy get in the way of care?
A new policy can run in monitoring first, recording what it would have done without changing anything for anyone. You choose whether it blocks, redacts, warns or only alerts once it is in Enforcing.
This page is general information, not legal advice.
See it in action.
Get a 30-minute overview of how Qastel discovers, assesses and controls the AI used across a business.