Sector
AI consultancy for healthcare and the NHS
Patient data cannot go to an offshore API, and IG will not approve what cannot show where the data went. We build inside the boundary and produce the evidence IG needs.
The constraint
Why healthcare AI projects stall
Healthcare often has the strongest clinical case for AI and the tightest deployment constraint. Identifiable patient data is special category data, and IG is right to refuse processing it cannot fully characterise.
Projects rarely stop for clinical scepticism. They stop because the pilot ran on a synthetic or de-identified extract and nobody planned for real records. By then the architecture is wrong at the foundation.
Then the quieter question: is it a medical device? A tool that informs a clinical decision may fall within MHRA scope, which changes the whole compliance picture. Answer it first.
Where it works
Where AI earns its place
Ordered roughly by how quickly they get approved. The first is usually the right first project: it is the least contentious.
Administrative and correspondence load
Draft referral letters, discharge summaries and routine correspondence for clinician review. Big time saving; the clinician stays the author.
Coding and documentation support
Suggest clinical codes from documentation, as a prompt for the coder. Measurable accuracy, clear human decision point.
Policy and guideline retrieval
Query local policy, SOPs and national guidance with citations. Non-clinical, non-identifiable, often the right first project.
Waiting list and referral triage support
Surface and prioritise for human review against defined criteria. Never decide: that framing determines whether it is a medical device.
The gate
What assurance will ask for
We produce it during delivery. Cheaper, and more likely to be accurate.
- DPIA completed before processing, covering special category data and lawful basis
- Data flows showing everywhere identifiable data is processed or stored
- DSPT alignment and DTAC evidence where the system is a digital technology being procured
- A written position on whether the system is a medical device, with reasoning
- Clinical safety involvement, including hazard log and clinical safety officer sign-off
- Logging and retention agreed against the organisation’s retention schedule
Illustrative scenario. A composite of how an engagement typically runs, not a specific client.
Illustrative: an NHS trust corporate function
Staff struggle to find the current version of local policies and SOPs. Following the wrong one is a real clinical risk.
The corpus holds no patient data, which changes the project: document retrieval, not clinical AI, on the trust’s existing infrastructure with a much lighter approval path.
The build enforces per-user permissions from the source system, cites every answer to a document and version, and treats "not covered by current policy" as a valid answer. The DPIA is short: low-risk processing, classified first.
The trust’s more ambitious clinical use cases are scoped separately, with the medical device question answered before any build.
Questions from this sector
Can we use AI with identifiable patient data at all?
Yes, with the right architecture and evidence: processing inside your own boundary (self-hosted or a private deployment you control), a DPIA before processing, a clear lawful basis, and IG involved from design. Piloting on de-identified data and hoping production sorts itself out does not work.
Is our tool a medical device?
It depends on intended purpose, and it is for your regulatory and clinical safety colleagues to decide. We describe exactly what the system does and does not do: whether it informs a clinical decision, whether a clinician remains the decision-maker. That lets the call be made properly and early. No answer changes a project’s shape more.
How does this fit with DSPT and DTAC?
We produce that evidence during delivery. Data flows, retention, access control and supplier position are documented as part of the build, in the form your IG team and DTAC assessment need.
Next step
Start with a 30-minute call
No deck. Tell us the problem. We will say whether AI is the right tool, what it would take and roughly what it would cost.