A clinic and a laboratory may use the same AI tool for different material. One prepares a synthesis from patient records; the other examines confidential research findings. Disclosure can have lasting consequences in both cases, but their nature and the applicable duties require a specific assessment.
Design therefore starts from the intended processing. The team identifies information and recipients, including the copies generated along the way. It can then connect legal and scientific constraints to access, hosting and retention decisions.
Distinguish information and disclosure consequences
Patient records contain personal health data. Unpublished experimental results may involve trade secrets and patent interests. One project can process both, for example a study using clinical records to develop new knowledge.
| Information | Risk to examine | Design consequence |
|---|---|---|
| Patient records | Unauthorised access or incompatible use | Role-based access and limited disclosure |
| Research data concerning people | Reidentification or use outside the approved framework | Data qualification and applicable protocol |
| Unpublished findings | Loss of confidentiality or prejudicial disclosure | Classification and controlled transmission |
| Public literature | Incorrect sources or interpretation | References and result verification |
The boundary does not necessarily follow institutional walls. A clinic may create patentable findings and a laboratory may process personal data. Permissions should follow those categories and authorised projects.
Incident handling cannot make disclosed copies disappear. Restoring service and addressing the consequences of a leak are separate tasks for both settings. Confidentiality and availability therefore belong in the assessment.
Qualify the processing before selecting a tool
For a private clinic, health-data protection involves the FADP and applicable professional secrecy. Outsourcing requires examination of providers and their real access. A confidentiality clause or Swiss hosting alone does not qualify the whole chain.
The Human Research Act applies to projects within its scope. The team determines that scope and required approvals with competent parties. Not every use of health data is automatically a research project, and the institution’s name does not decide the answer.
Removing direct identifiers does not establish anonymity. Combinations of dates and characteristics may still identify a person. Pseudonymised information remains subject to applicable personal-data rules where reidentification remains possible under the assessment.
For a model adapted on personal data, examination also concerns information the model could reveal. EDPB Opinion 28/2024 offers a European analysis. It does not replace the Swiss assessment of the project.
For unpublished findings, the team examines confidentiality and potential patent protection. EPC Article 54 connects novelty with prior public availability. Sending information to a provider is not automatically public disclosure. Content and confidentiality obligations matter, and Article 55 provides limited exceptions.
Where appropriate, patent counsel reviews a planned transmission before filing. Architecture makes the resulting decision enforceable through approved destinations and attributable exchanges.
Design the data path to the model
Consider an assistant helping an authorised study team find information. Authentication precedes a search limited to accessible documents. The application prepares necessary extracts and sends them to the selected model environment. The answer returns with sources and limitations.
The architecture identifies the document-preparation jobs, indexes, caches and logs that create additional copies of data. The inventory records where each copy is stored and which administrators can access it. Prompts, model responses and external-service calls are included. This maps the processing beyond the original database.
Minimisation happens before model transmission where the use allows it. Removing unnecessary fields or selecting relevant passages requires its own tests. Too much removal can destroy meaning; too little can retain identifying details.
Permissions extend to derived results. A synthesis can expose confidential information without showing the original file. Exports and stored conversations must follow the same access decisions.
A no-training commitment may coexist with operational or abuse-monitoring retention. The organisation examines the actual product and settings rather than transferring terms from a consumer account or a different provider.
Propagate correction and deletion through the chain
Retrieval separates source documents from model weights and can make content updates easier. It does not guarantee that deleting one source row immediately affects every future answer.
Indexes must detect or receive the change. Caches and histories may retain previously used extracts. Azure AI Search documentation illustrates the need for explicit propagation of some deletions into an index.
The team identifies affected representations, executes withdrawal and tests questions that previously retrieved the information. The record states the scope and date, including copies governed by a different retention rule.
For a model fine-tuned on records, correcting the source does not automatically change learned weights. Assessment may require another model version or further training, or another measure evaluated for the case. No generic procedure can promise removal of every influence without verification.
A deletion request itself must be assessed against duties such as record retention. Material withdrawn from an assistant may still need to remain in the clinical reference record. Restoration procedures must avoid automatically reintroducing withdrawn content into the assistant.
Test a complete use
The first trial uses an authorised scope and representative cases. Clinical retrieval checks document versions and permissions alongside answer quality. Confidential research tests transmission rules and the evidence required for disclosure decisions.
Forbidden-access cases matter as much as successful ones. Rephrasing must not bypass permissions. Tests also cover a malicious instruction inside a document and a source awaiting withdrawal.
Review combines responsibilities. Clinicians or researchers judge relevance, data owners qualify use, engineers verify behaviour and legal specialists assess obligations. This collaboration connects design with the people who understand the information and its value.
The operating documentation retains the configurations and test results for each data-processing stage.
- Permitted purposes and data categories.
- Roles and recipients, including administration conditions.
- Component versions and processing settings.
- Results of access, quality and withdrawal tests.
- Change, incident and recovery procedures.
A security breach requires assessment of consequences and notification duties. The FDPIC explains the relevant notification conditions, including risk to people. The organisation needs the evidence and contacts required to perform that assessment in the applicable time.
Architecture quality rests on the relationship between information, authorised use and observable controls. That relationship supports new AI processing while keeping its exchanges and retention verifiable.
Sources and scope
- FOPH | human research legislation
- FDPIC | the revised FADP
- EDPB Opinion 28/2024
- EPO | novelty under Article 54
This article presents architectural choices. Human-research law and professional secrecy, together with data protection and patent rules, require qualification of the actual project by competent people.