How to Protect Patient Data When Using AI: A Clinic Checklist

AI can help a clinic summarize records, draft documents and organize the day. But every time patient data is sent to an AI service, that data leaves the clinic's hands. Here is a checklist to protect patient data when using AI, which you can use today whatever software you run. This article is for information only. It is not legal advice.

Why health data needs extra care

Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) was passed by the National Assembly on 26 June 2025 and took effect on 1 January 2026. Decree 356/2025/NĐ-CP of 31 December 2025 details the law and also took effect on 1 January 2026.

According to the list in Decree 356/2025/NĐ-CP, as summarized by the Can Tho City Department of Justice, "health status" is sensitive personal data. The department's introduction to the law also states:

• Processing personal data requires the data subject's consent, unless the law provides otherwise.
• Sensitive personal data requires stricter protection, with limits on processing and sharing.
• When a personal data breach happens, it must be handled and reported promptly.

The World Health Organization (WHO) stressed the same in 2021: humans should stay in control of medical decisions, and patients' privacy should be protected.

Your exact obligations depend on how your clinic handles data. The checklist below is a starting point, not a replacement for a lawyer's advice.

Checklist: protect patient data when using AI

1. Never paste patient data into a personal chatbot

Free chatbots and personal accounts usually come with no data processing agreement with the clinic. It is hard to know how long the data is kept or whether it is used to train models, and the clinic has no log of what was sent. Use them only for tasks that need no patient data, such as drafting a holiday closing notice.

2. Send only the minimum data

Remove names, phone numbers, ID card numbers, health insurance card numbers, addresses and patient codes. Keep only what the task really needs. Note: removing the name does not always make data anonymous. Age, visit date, a rare condition and a workplace together can still point to one person.

3. Know which provider processes the data, and in which country

Ask for the name of the AI provider and where its servers are. If data goes abroad, ask a lawyer what your clinic needs to do.

4. Ask your software vendor these questions

• What data is sent to the AI, and where does it go?
• How long is it kept, and how is it deleted?
• Is the clinic's data used to train models?
• Who at the vendor can see the data, and is that access logged?
• Is every AI call, export and print written to a log?
• Can AI be turned off? If AI fails, can the core work continue?
• If there is a data incident, how will the vendor tell the clinic?
• Can the clinic export all of its own data?

5. Give access by role

One account per person, and no shared passwords. A receptionist does not need to see lab results or revenue. Give the rights to export, read logs and use AI only to people who need them. Remove access as soon as someone leaves.

6. Log exports, prints and AI calls

A log shows who did what, and when. Review it on a fixed day each month.

7. Lock the screen when you leave the desk

The front-desk computer often sits right where patients gather. Lock the screen or sign out every time you step away.

8. Train staff with a few short rules

Do not send photos of records through personal messaging apps. Do not put a diagnosis in a message to a patient. Treat AI output as a draft. Report a suspected data leak right away.

9. Prepare an incident plan in advance

Write down who to tell, which accounts to lock, and how to record the time and the kind of data affected. Ask a lawyer about reporting duties before anything happens.

10. Get legal advice for your situation

Questions to bring to a lawyer: at which steps you need patient consent, what to tell patients, which terms your vendor contract needs, and whether any data leaves the country.

AI drafts, people decide

AI prepares drafts, summaries and suggestions. An authorized staff member reviews and decides. AI does not diagnose and does not choose medicines. Key checks, such as who may open which record or allergy warnings, should be handled by fixed rules in the software, not by an AI model.

How Clinic Hub helps

• AI is switched on per clinic. If AI is off or the provider has a problem, check-in, examination and fee collection still work manually.
• Less data is sent. The patient record summary is sent to the AI without the patient's name, phone number, address or patient code. Free-text notes are filtered to remove identifying details.
• Activity log. Each time an AI feature, such as a record summary, a draft or a document scan, sends data to a provider, a log entry is written before the data leaves. It records the provider, the model and whether personal or clinical data was included. CSV exports and prints are logged too. The clinic owner has a separate page showing only AI activity. The log can only be added to, never edited or deleted.
• Page-level permissions. The clinic owner grants access to each staff member, and new staff start with very little. The built-in receptionist and nurse templates include no bills, financial reports or activity log.
• Automatic lock when idle. After a period without use, the app shows a countdown and then signs the user out, who must sign in again.
• Installation at the clinic. There is an installation package that runs the app, the database and patient documents on a machine at the clinic. Signing in still needs the internet, and if the clinic turns on AI that uses an outside provider, the data sent for each of those calls still leaves the machine.

These features support control, but they do not replace the clinic's own assessment of its legal duties, and they do not mean a clinic is compliant. See also our Security page.

Want to see how these controls work in practice? Request access or take the tour.

Sources

• Law No. 91/2025/QH15 on Personal Data Protection (in Vietnamese) — Vietnam Government Portal
• Decree No. 356/2025/NĐ-CP detailing the Law on Personal Data Protection (in Vietnamese) — Vietnam Government Portal
• Lists of basic and sensitive personal data (in Vietnamese) — Can Tho City Department of Justice
• The 2025 Law on Personal Data Protection: ensuring privacy in the digital era (in Vietnamese) — Can Tho City Department of Justice
• WHO issues first global report on Artificial Intelligence (AI) in health and six guiding principles for its design and use — WHO