A Generative AI Policy for Healthcare Employers: Keeping Patient Data Safe

A generative AI policy for healthcare employers has one job above all: keeping patient and service-user data out of places it should not go, while still letting staff use approved tools safely. Health data is special category data, and the staff using AI tools are often registered professionals with their own regulators' expectations, so a health setting may want a policy that addresses those points. This guide sets out what Irish official sources say about the risks, then offers a labelled, section-by-section outline you can adapt. For the general employer version, see our guide to what a generative AI acceptable use policy should cover; this post covers only what is different in healthcare and social care.

Why health settings need their own policy

The Data Protection Commission (DPC) describes health data as special category data under Article 9 of the GDPR and says processing of these categories is prohibited except in limited circumstances (the DPC page shows no date). Our guide to GDPR and special category health data explains that foundation. For a policy writer, the practical point is simple: the cost of a mistake is higher when the information typed into an AI tool is about a person's health, care or circumstances.

The DPC's blog "AI, Large Language Models and Data Protection" (18 July 2024) says GDPR applies where personal data is involved, to both the people and organisations using AI and the providers of the models. It tells organisations to understand an AI system before using it: what personal data it uses, how it uses it, where it goes when third parties are involved, and whether it is retained or reused. It also warns that, without a retention schedule and associated processes, an organisation risks non-compliance with the storage limitation principle.

What regulators and professional bodies have said

• HIQA. HIQA published its National Guidance for the Responsible and Safe Use of AI in Health and Social Care Services on 29 July 2026. The announcement says it is for all health and social care services, is built around accountability, a human rights-based approach, safety and wellbeing, and responsiveness, and covers governance, transparency and public engagement. We could not open the final document, so the specifics below come from HIQA's January 2026 consultation draft, which may differ from the final text. The draft says a data protection impact assessment is needed if an AI tool processes health-related data, asks for "enforceable controls" to stop identifiable data being entered into public large language models, says staff should be able to override an AI output, and expects services to carry out a training needs analysis and keep records that staff have completed training. Our summary is in HIQA's national guidance on AI in health and social care.
• Medical Council. Its position statement on AI (no date shown) says doctors remain responsible for their clinical decisions, that patients should be informed when AI tools are used in their care, and that if public generative AI software is used, personal information becomes public domain. It also says continuing professional development should include AI literacy.
• NMBI. The Code of Professional Conduct and Ethics for nurses and midwives, in effect from 14 February 2025, has an explanatory note on artificial intelligence that says practitioners should be cautious about interpreting AI recommendations and remain accountable for their own actions and omissions. The Code also says confidentiality covers all forms of record management, including physical and electronic data.
• Department of Health and HSE. The national AI for Care strategy announcement (no date shown) refers to clear governance and clinical accountability, human oversight and alignment with the EU AI Act. The HSE's AI and Automation Centre of Excellence page says the HSE applies a governance framework based on the EU AI Act and classifies AI projects by risk.

A policy outline for healthcare employers

Everything in this section is our suggestion. None of it is quoted as a legal requirement, and you should adapt it with your data protection officer, clinical governance lead and legal adviser.

1. Purpose and scope

Our suggestion: state who the policy covers (employees, agency staff, students on placement, volunteers, contractors) and what it covers (any tool that generates text, images, audio or code from prompts, including features built into email, note-taking, transcription and search software). Say which regulators' standards sit above the policy.

2. An approved-tools list

Our suggestion: keep a short list of tools that have been through a risk assessment, and say that anything not on the list may not be used for work. The DPC's advice to understand the product first is the reason for this step. Record, for each approved tool, who owns it, what data it may handle and where its data goes.

3. A hard line on patient and service-user data

Our suggestion: say plainly that identifiable patient, resident or service-user information must not be entered into any public or unapproved generative AI tool, and define identifiable broadly (names, dates of birth, addresses, health record numbers, and descriptions that could identify a person in a small service). HIQA's draft asks for enforceable controls, so consider technical measures such as blocking unapproved tools on work devices, not only a rule in a document. The same applies to personal phones used for work.

4. Human review and accountability

Our suggestion: require a named person to check any AI-generated content before it is used, filed or sent, and make clear that AI output does not change who is accountable. This reflects the Medical Council's statement that doctors remain responsible for clinical decisions and the NMBI Code's emphasis on caution and accountability. The policy should not describe how to make clinical decisions; leave that to clinical governance and professional guidance.

5. Transparency to patients and service users

Our suggestion: where AI is used in a way that affects people's care or involves their data, say who is responsible for telling them and where the information is published. HIQA's draft expects services to be open about when, where and for what purpose AI is used, and the Medical Council expects patients to be informed in proportion to the use.

6. Assessment before adoption

Our suggestion: no new tool goes on the approved list without a documented data protection assessment. The DPC says a DPIA is mandatory where processing is likely to result in a high risk, and lists large-scale special category data and innovative use of technology among its criteria; HIQA's draft says one is needed if a tool processes health-related data. Include supplier questions on data location, retention and reuse of prompts.

7. Records and retention

Our suggestion: decide whether prompts and outputs are records, where they are stored and when they are deleted. Align this with your existing retention schedule.

8. Incidents

Our suggestion: tell staff that pasting patient data into an unapproved tool should be reported straight away as an incident. The DPC says organisations must notify the DPC of a breach that presents a risk to individuals within 72 hours of becoming aware of it and must keep an internal record even where they decide there is no risk. Staff cannot help you meet that if they fear blame for reporting.

9. Training

Our suggestion: make short, role-based training part of onboarding and refresh it when tools change. HIQA's draft refers to AI literacy obligations and a training needs analysis, with records of completion.

10. Review

Our suggestion: set a review date, because the sources above are moving. HIQA's guidance is new, the AI Act's application dates should be checked against the Commission's current position, and the Medical Council says its statement will be periodically reviewed.

Making the policy stick

A policy that nobody reads will not protect patient data. A practical approach is to give staff a one-page summary with three or four concrete examples of acceptable and unacceptable use, name a contact for questions, and review whether people are using unapproved tools because the approved ones do not meet a real need. For Dublin-based providers with several sites, check that agency and locum staff receive the same briefing as employees.

What we could not confirm

We could not open HIQA's final guidance, so draft wording is flagged as draft. We did not find a published HSE staff policy on generative AI that we could cite, and the HSE page we read does not mention generative AI. The NMBI, Medical Council and Department of Health pages cited show either no date or the dates noted above.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Can staff use public generative AI tools with patient information?

The sources we read point strongly against it. The Medical Council warns that personal information becomes public domain if public generative AI is used, and HIQA's draft asks for enforceable controls to stop identifiable data entering public large language models. Our suggestion: prohibit this in your policy.

Do we need a DPIA for a generative AI tool?

The DPC says a DPIA is mandatory where processing is likely to result in a high risk, and HIQA's draft says one is needed if an AI tool processes health-related data. Ask your data protection officer to decide for each tool.

Is this policy a legal requirement?

We have not found a rule requiring a written generative AI policy as such. The sources we read expect governance, accountability, assessment and training (HIQA's guidance and the Medical Council statement are guidance and position statements; the DPC describes a DPIA as mandatory for high-risk processing), and a written policy is a practical way to show them.

Who should own the policy?

That is a local decision. A practical approach is joint ownership by your data protection officer and clinical or care governance lead, with HR and IT involved in training and technical controls.

A good policy is short, specific about patient data, and honest about who is accountable. Start with the data rule and the approved-tools list, and build outwards from there.