AI in the clinic and in the laboratory: two risk regimes, two architectures

A private clinic that loses patient records notifies the FDPIC, fixes the faults that allowed it, and is still standing at the end of a bad month. A biotech laboratory that lets an unpublished hypothesis out has lost the route to a patent, and no incident process will bring it back. Both organisations buy the same AI subscription, off the same forwarded link.

The asymmetry is about who is watching. The clinic answers to the FDPIC and, once a research project starts, to its cantonal ethics committee: a name to call, a procedure, a deadline. The laboratory has no counterparty at all. Its exposure is one sentence typed into a chat box on a Tuesday, and the invoice arrives eighteen months later, inside a patent file in Munich.

This article separates the two regimes: the asset each one protects, the text that protects it, the shape of the failure, and the architecture I build as a result. It is written for Swiss private clinics and laboratories of 10 to 200 people.

I’m an engineer, not a lawyer, and none of this is legal advice. A research project talks to its ethics committee before it talks to me.

The two regimes side by side

Both organisations handle sensitive information and buy the same tool. Here are the eight points where their situations diverge, and each one moves an architecture decision.

Some organisations tick both columns. A clinic hosting a research project falls under the first regime for its records and the second for the study’s unpublished results. The two sets of controls then live in the same building, on separate shares.

Three regimes over the clinic’s server room

Three texts cover the same server room, and each names who has to answer for the data.

• Art. 321 SCC: the professional secrecy provision that binds lawyers also covers doctors and everyone working under them. It doesn’t stop when the treatment ends or the patient dies.
• The revised FADP: health data counts as sensitive data, and the controller stays answerable even when the work sits with a processor. That stops being abstract on the morning the processor is the one who leaked.
• The Human Research Act: the Act requires an ethics committee to approve any research project falling inside its scope.

Stacked like that, the texts sound heavier than one server room can carry. In practice the opposite: each names a responsible party and says what has to be written down. swissethics publishes protocol templates, and the committee answers before a project starts, CER-VD in Vaud and the CCER in Geneva.

The question that keeps coming back is about the IT provider: does it count as an auxiliary under Art. 321 SCC? Everyone wants to settle it by analogy, and the analogy never quite holds. Infomaniak, with a backup key that can restore any mailbox, isn’t a sealed appliance nobody opens after installation. I worked the question out for a law firm: the answer depended on the mandate and on what the provider could actually touch. So your clinic has to work out its own.

The Human Research Act also explains an infrastructure decision that many people take for academic indulgence. The Swiss Personalized Health Network built BioMedIT, three nodes in Basel, Lausanne and Zurich under one set of rules, instead of leaving every university hospital to build its own secure computing alone.

Projects working on anonymised biological material, and on the health data that goes with it, sometimes fall outside the Act. Removing the names doesn’t get you there: anonymisation has to stay irreversible in practice, and with some genetic material it may never be. The swissethics guidance says to ask when the status isn’t clear. Asking costs a letter. Guessing wrong costs the study.

Two different tests behind the word “anonymous”

The study coordinator tells me “we anonymised it” and means “we removed the names”. They are two different operations, and depending on the regime the two operations don’t even face the same test.

That second row reaches my desk rather than a lawyer’s. Once you fine-tune on clinical records, the model itself becomes the thing you have to question: can anyone get one of these patients back out of it? The EDPB opinion is EU law and doesn’t settle the Swiss question. But nobody has published a clearer account of what the risk actually is.

Retrieval, and the deletion it makes possible

With patient data I reach for retrieval first: the records stay in the clinic’s own store, and the model reads them when questions come in. The choice is settled on the day someone asks you to delete their record.

• With retrieval: I delete one row at the source, and every answer after that reflects the deletion. The request closes the same day.
• With a fine-tuned model: that person’s records are in the weights. To get them out, you correct the corpus and train again, and while the model trains, nobody can say which answer still carries traces of the file.

What retrieval doesn’t do is clean up after itself, and this is where the deployments I inherit are weakest. A passage pulled for one answer has been copied into a prompt, and prompts have a life of their own. Azure OpenAI keeps prompts for up to thirty days for abuse monitoring unless Microsoft has granted you the exemption. That’s in the documentation, and almost nobody reads the documentation.

That’s why I build intelligent search and secure assistants on retrieval. Not for elegance. Deletion has to work, and only retrieval leaves the documents where a deletion can reach them.

The page the clinic writes before connecting a model

De-identification is its own processing operation. I run it before the records reach any model, wherever the use case allows. There’s no toggle for it in the Microsoft 365 admin centre, and nobody writes the operation down for you. One page is enough, and it carries five lines:

• The purpose and the legal basis: the processing intended, and the text that permits it.
• The real access list: the names, not the policy describing who should have had access.
• What goes into the model: the fields sent, and the fields stripped before sending.
• What comes out of the model: the answers produced, and where they go.
• The logs: what they hold, and how long the clinic keeps them.

In three years, when the person who set the operation up has left and an auditor finally asks, that one page is the only version of the control that still exists.

The laboratory’s one-way door

For the laboratory I start with the terms of service, and inside the terms with one clause: does what you type get used to train the next version of the model? A free ChatGPT account and an Azure OpenAI deployment in Switzerland North sit on opposite sides of it. The difference is contractual, not geographic: Switzerland North means Zurich, which is a statement about racks, not about which law you’re under. And no clause helps on the Thursday afternoon a postdoc signs up alone.

Secrecy is the fragile asset. Trade secrets stay protected as long as they stay secret and you can show you took reasonable steps to keep them that way. One sloppy disclosure ends the protection.

Patent novelty is stricter still, and it surprises people who trained under US practice: US law does give them a grace period, twelve months for the inventor’s own publications. European law gives none. Article 54 of the European Patent Convention counts everything made available to the public before the filing date as part of the state of the art. Your own disclosures count. Your own poster session counts. Your own open day counts.

The exceptions are worth knowing. A conversation under an obligation of confidence, express or implied, is generally not public for Article 54 purposes. Article 55 carves out a few more, narrow enough that nobody should try to plan around them. Sending a file to an external processor isn’t a public disclosure by itself: it raises a confidentiality question and an evidence question, and the second is answered by logs you either have or you don’t.

The laboratory’s rule, in three lines

The know-how needs an architecture, and nobody outside the company can design it: nobody else knows which six files matter. Most of the work is the file share, and the share is the part everyone skips. If the sensitive files sit where the general files sit, everything you build downstream turns out to be decoration.

On top of that separation, my rule fits in three lines:

• Public literature: it comes in freely, with no approval and no queue.
• Proprietary material: it leaves only on a decision that someone approved and wrote down, with a named owner, a date and a trace.
• Anything leaving before a filing: it goes past patent counsel first, with no exception for tight deadlines, which are exactly when novelty walks out.

I’ve seen some of these failures up close, and most of them weren’t technical. Your staff will route around a control the moment the approved tool is worse than the tool they found themselves, with no malice at all. So the fix is to buy a better internal tool, not to write a firmer policy.

Behind the no-training clause

A no-training clause is worth having, and it doesn’t execute itself. Seven points need checking:

• Do the service settings match the clause that was signed?
• Who holds an administrative permission, and over what scope?
• Where are the keys, and who can use them?
• Which network controls limit access to the service?
• Which subprocessors does the contract name?
• Which audit rights does the contract open to you?
• Which logs can you produce as things stand, without development work?

Owning the machine changes less than you expect: its updates, its telemetry, its administration and its backups still belong to someone. I describe one such stack in [internal AI without a US cloud](/en/articles/internal-ai- without-a-us-cloud/). Sizing it for the laboratory or the clinic follows the same reasoning.

Where HIPAA and the GDPR actually reach

Handling health data doesn’t put a Swiss clinic inside HIPAA. What does is matching the US definition of a covered entity or a business associate, and that’s about the role you play, not the sector you’re in. Most Swiss clinics match neither. The GDPR reaches further: an establishment in the EU brings it in, and so does Article 3 when you offer services to people in the EU or monitor their behaviour there.

Neither text moves the laboratory’s line. Neither protects an unpublished hypothesis.

Where to start

Mixing the two rooms up costs something in both directions. The clinic that gets the mix wrong freezes: every proposal queues at a committee that was never the right place to send it. The laboratory that gets it wrong relaxes, which is worse: a DPA gets signed and filed, and the file gets mistaken for protection.

Each produces evidence of a completely different kind on the day someone finally asks:

• The clinic: the ethics approval or the letter that asked for clarification, the processing records, the risk analysis, the de-identification procedure it actually followed.
• The laboratory: file classification, signed agreements, access logs, publication rules, controls on what leaves the building.

Spend your first franc on whichever loss you’d find hardest to contain, and go work out which one that is instead of assuming you already know.

Sources and verification date

• EDPB Opinion 28/2024 on AI models, the anonymity test quoted in the table above
• European Patent Convention, Article 54 on absolute novelty, with EPO guidance on confidentiality for what counts as a disclosure
• HHS on covered entities and business associates, for the HIPAA question above
• GDPR, Article 3 in particular

Whether the Human Research Act, professional secrecy, the FADP, GDPR, HIPAA or patent law applies depends on the project, the actors and the actual data flows. Refer sensitive cases to the competent ethics committee and qualified specialists.

Regimes verified on 14 August 2026.