AI in healthcare: what clinics and health companies can build safely in 2026.
Where AI is earning its place in clinics, diagnostics and health-tech, the line between a helpful tool and a regulated medical device, and what HIPAA, UK and EU rules require of the system.
The AI that’s working in healthcare right now mostly isn’t diagnosing anyone. It’s doing the reading and writing that eats clinicians’ and coordinators’ time: summarising records, drafting letters and reports, answering patients’ routine questions, and following up so fewer people drop out of care. Those uses deliver quickly and sit on the safer side of the regulatory line, provided the system is built for health data from the start.
We’ve built this kind of system ourselves. For a premium diagnostics clinic, our clinical intelligence platform turns test results into clinician-ready health narratives in under sixty seconds. It has tripled patient follow-through, and it won the Innovative AI Award. This guide covers where AI helps, where regulation begins, and what the system has to get right.
Where AI helps in healthcare today
Clinical summaries and reports
Pulling a patient’s history, results and notes into a readable summary or a draft report for a clinician to review and sign. The clinician stays the author; the system does the gathering and the first draft.
Patient communication and follow-through
Explaining results in plain language, answering routine questions about appointments, preparation and aftercare, and reminding patients about the next step. Follow-through is where much of the value is lost in healthcare, and where AI can recover it.
Documentation and coding
Turning consultations into notes, letters and suggested codes for review. AI scribes are now common in primary and specialist care.
Operations
Referral triage for a person to confirm, prior-authorisation paperwork, scheduling, and answering staff questions from internal protocols with a reference to the source document.
Where regulation begins
The key question is whether the system influences diagnosis or treatment. In the UK, the MHRA confirmed in July 2026 that AI scribe and ambient voice tools used only to transcribe, summarise, draft letters or suggest codes for a clinician to review aren’t medical devices. Tools that support diagnosis or treatment decisions, or take automated action, are. In the EU, AI that’s part of a regulated medical device falls under the AI Act’s rules for regulated products, which now apply from 2 August 2028. Our EU AI Act guide covers the timeline.
Deciding where your system sits is a design decision, made early. A tool that drafts for a clinician is a project of weeks to months. One that recommends treatment needs clinical evidence and a regulatory pathway, and takes far longer.
HIPAA: model providers need a business associate agreement
In the US, any vendor that creates, receives, maintains or transmits protected health information on a covered entity’s behalf is a business associate under HIPAA (45 CFR 160.103). That includes the company hosting the language model. In practice:
- Anthropic offers a business associate agreement covering its first-party API and Enterprise plans, but not every feature. The Batch API, Files API, code execution, computer use and web fetch are excluded.
- OpenAI offers a BAA for its API on request, assessed case by case.
- Every other component that touches health data needs the same scrutiny: hosting, logging, monitoring and analytics tools.
The architecture should keep protected health information out of anything not covered: no patient details in logs that go to an uncovered tool, and no features used outside the BAA’s scope.
UK and EU: health data is special-category data
Under UK and EU GDPR, health data is special-category data, so it needs both a lawful basis and an additional condition, plus a data protection impact assessment for most AI uses. The UK’s new automated-decision rules, in force since 5 February 2026, still restrict significant decisions made solely by automated means using special-category data. So keep a clinician in the decision. In Italy, the national AI law requires that patients be told when AI is used, and that the decision always rests with the medical professional (Law 132/2025, Article 7).
What a healthcare AI system has to get right
| Requirement | How it’s built |
|---|---|
| Accuracy on your own records | An evaluation set of real, de-identified cases reviewed by clinicians, scored before every release |
| No invented facts | Every statement traced to a source document, and the system says when the record doesn’t answer the question |
| A clinician in the loop | Drafts are clearly marked and need sign-off before they reach a patient or the record |
| Protected data | BAAs or equivalent agreements for every component, minimal data in prompts and logs, and access controls by role |
| Traceability | A record of what the system produced, from what inputs, and who approved it |
Our notes on retrieval that knows when to say “I don’t know” and evals before features go deeper on the two that matter most.
Questions healthcare teams ask
Can we use ChatGPT or Claude with patient data?
Not through consumer apps. Through business APIs with a signed BAA (US) or the appropriate data protection agreements (UK and EU), and only within the features those agreements cover, yes.
Will patients trust AI-written explanations?
They trust explanations their clinician has reviewed. Our clinic system’s narratives are clinician-ready, not clinician-free, and patient follow-through tripled.
Where should a clinic start?
With the paperwork that delays care: results summaries, referral letters or follow-up messages. These are high-volume, easy to review, and quick to measure.
Modulus Labs AI builds clinical summarisation, patient communication and documentation systems with clinicians in the loop and health-data controls built in. Tell us about your workflow, and we’ll reply within one business day.