Staff Using Public AI Chatbots on Patient Data: A Policy

Under the DPDP Act 2023 the hospital is the Data Fiduciary for the personal data it holds about patients, and it remains responsible for that data even where a processor handles it on the hospital's behalf. Pasting identifiable patient information into a consumer AI service is a disclosure to a third party. There is no processing contract, no purpose limitation the hospital has agreed to, and consumer terms frequently permit the provider to use submitted content to improve its own service.

Two consequences follow. The notice given to the patient at registration almost certainly does not cover it, because the purposes you described did not include sending their clinical narrative to an unrelated commercial service. And an unauthorised disclosure of personal data is capable of amounting to a personal data breach, with the reporting duties that attach to one. Whether a particular incident crosses that line is a judgement, and it is not a judgement anyone wants to be making retrospectively.

There is a cross-border dimension too, though it is less decisive than most hospitals assume. The Act permits transfer of personal data outside India except to territories restricted by the Central Government, so the geography of processing is not usually the sharp end of the problem. The sharp end is the complete absence of any lawful arrangement with the party doing the processing, wherever their servers happen to sit.

The standard staff defence is that they removed the name. That is rarely sufficient. Indian health records carry a dense set of quasi-identifiers: age, sex, town, occupation, treating consultant, admission date, referring facility and, frequently, an uncommon diagnosis. A thirty-four-year-old man with a rare vasculitis admitted under a named consultant in a district town is identifiable to anyone who knows the district, and free-text histories routinely name relatives, employers and villages.

There is also a structural reason this is harder here than staff expect. The DPDP Act does not offer a safe-harbour list of identifiers you can strip and be deemed compliant. It applies to digital personal data by which an individual is identifiable, and that assessment is contextual. The reassuring mental model borrowed from other jurisdictions, where removing a defined set of fields places you outside the rule, has no direct equivalent to fall back on.

De-identification fails mechanically as well as conceptually. People forget the header on a pasted lab report, the record number embedded in a filename, the letterhead in a screenshot, or the metadata sitting inside a DICOM image. Manual redaction of free text under time pressure is close to unreliable. If your policy depends on staff redacting accurately at three in the afternoon in a full OPD, it depends on something that will not hold.

The most useful thing to teach staff is that the difference between a consumer chatbot and a governed enterprise deployment is mostly contractual and administrative rather than technical. The same family of model may sit behind both. What changes is whether an agreement covers processing purposes, retention, training use, access control, logging and deletion, and whether your administrators can see and govern how the tool is being used inside the hospital.

That framing matters because it defeats the argument that the sanctioned tool must be worse. Usually it is not. It is the same capability with terms attached and a login that ties activity to a person. Where the governed option genuinely is more limited, with restricted file uploads or a smaller working context, say so honestly and explain why. Staff comply with restrictions they understand and route around restrictions that look arbitrary.

When procuring, treat the AI provider as a Data Processor and paper it accordingly: purpose limitation, no training on your content, retention and deletion terms, sub-processor disclosure, security commitments, breach notification timed to let you meet your own obligations, and audit rights. Check what your existing productivity suite already includes before buying anything, since many hospitals are already paying for a governed assistant they have simply never switched on.

You cannot govern what you have not counted. The practical discovery methods are unglamorous: review outbound traffic to known AI domains on the hospital network, check browser extension installs on managed devices, look through expense claims and card statements for small recurring subscriptions, and ask department heads directly with an amnesty attached. Each method finds a different slice of the problem, and none of them finds a personal phone running on mobile data.

Run the discovery as a census rather than an investigation. The framing matters enormously and you only get to choose it once. If the first communication staff receive is a warning, you will collect denials and the usage will move off your network inside a week. If it is an invitation to declare what people are using so the hospital can provide something better, you get an inventory you can actually work from.

Expect the findings to be uneven and mildly awkward. Clinical use is often lighter than feared while administrative use is heavier: HR letters, tender responses, marketing copy, board note drafting. Some of that carries low risk. Some of it involves employee personal data, which the DPDP Act also covers and which gets forgotten routinely because the entire policy conversation tends to be framed around patients.

Write the rules as actions, not as principles. Protecting patient confidentiality is not a rule. Not pasting any document, image, message or export containing patient identifiers into a tool outside the approved list is a rule, and a person can tell whether they have broken it. Keep the prohibited list short enough to remember and put the approved list somewhere staff can find in about five seconds from a ward computer.

Handle the grey zone explicitly rather than leaving it to interpretation. Using a general tool to explain a guideline, draft a policy paragraph or rephrase generic patient education material involves no personal data and should be plainly permitted. Using one to summarise a specific patient's notes should not be, unless it is the sanctioned tool. Give three worked examples on each side, because examples do far more work than definitions do.

State the authorship rule separately, because it is a different category of risk. Anything entering the medical record is authored by the clinician who signs it, whatever produced the draft. That sits comfortably with how the Telemedicine Practice Guidelines treat technology as assisting rather than replacing the registered medical practitioner, and it means the signing clinician owns every error in a generated draft that they did not catch before signing.

Enforcement should be proportionate and predictable. Distinguish three cases: an honest mistake reported promptly, unsanctioned use where no personal data was involved, and deliberate disclosure of patient data after training. The first deserves support and a process fix, the second a conversation, and only the third belongs anywhere near the disciplinary route. Collapse all three into misconduct and the first category simply stops being reported to you.

Pair the rules with technical measures so compliance does not rest entirely on memory. Blocking known consumer AI endpoints on the clinical network, data-loss prevention on large clipboard pastes and file uploads, and single sign-on for the sanctioned tool all shift the default behaviour. None of these is complete, since a personal phone defeats every one of them, but they remove the accidental route, and the accidental route is most of the volume.

Review the position quarterly and expect it to move. The tools change, staff needs change, and rules written eighteen months ago will contain prohibitions that no longer make sense alongside omissions that now matter a great deal. Take the register of declared use, the incident reports and the network data to the same committee that governs your clinical AI, and treat this as a standing item rather than a separate policy nobody revisits.