U3: Patient data and AI

Two duties run over patient information at the same time: data protection law and the common law duty of confidentiality. Satisfying one does not satisfy the other, and for direct care neither runs on consent in the data protection sense. An AI tool is usually somebody else's, so entering patient data into it is a disclosure.

The unit teaches the lawful basis for direct care under Article 9(2)(h) of the UK GDPR, when consent is in fact required, and what confidentiality requires in practice. It sets out the questions to settle before data leaves your control, and the rules on solely automated decisions in new Articles 22A to 22D, including the restriction where a decision rests on health data. It explains anonymised and pseudonymised data, the test for identifiability and the evidence on how often de-identification fails, then what to tell patients and what to do after a data loss. It maps to the HEE AI and Digital Healthcare Technologies Capability Framework (2023). Veritant is education, not legal advice.

You receive the Master Teaching Document and slide deck as PDFs, and a narrated video. Reading Veritant (U0), the guide to how the units are built, is included free. An assessed certificate is coming: a 20-question online assessment with a pass mark of 80 per cent. Everyone who has bought the unit will be able to take it free.