AI in healthcare: patient data stays in-house.
Care standards, hygiene plans, the QM handbook: in hospitals and practices knowledge sits in documents that are hard to find day to day. RAGSuite answers questions from them with sources, and runs on your hospital’s servers, without an internet connection if you like.
Not a medical device · no diagnosis · answers from your documents
„Who is informed of an outbreak on a ward?“
Infection control staff and the ward manager, immediately. Report it with form H-07.
„When is the next internal audit in the emergency department?“
In the second quarter. The documents are in SharePoint four weeks before.
„How do I report a fault on a medical device?“
Take the device out of use, then raise a ticket with medical technology quoting the inventory number.
Key takeaways
- Health data is a special category under Art. 9 GDPR; professional secrecy (section 203 StGB) and, for cloud services, section 393 SGB V add to it.
- RAGSuite runs on your hospital’s servers, air-gapped if you like.
- Typical uses: care standards, QM handbook, medical technology and patient information on the website.
- RAGSuite is not a medical device and not meant for diagnosis or treatment.
Which rules apply to AI in healthcare?
AI in healthcare faces stricter rules than other sectors. Four of them shape every decision:
Health data (Art. 9 GDPR)
They are a special category and may only be processed under narrow conditions. A data protection impact assessment is usually needed.
Professional secrecy (section 203 StGB)
External service providers may only gain insight as contributing persons and must be bound to confidentiality.
Cloud rules (section 393 SGB V)
Processing health and social data with a cloud service requires, among other things, a location in the EU and a current C5 attestation of the service.
EU AI Act
AI that counts as a medical device is a high-risk system. A knowledge assistant for internal documents usually is not.
RAGSuite is not a medical device and not meant for diagnosis or treatment decisions. It answers questions from your documents.
AI in healthcare: examples from hospitals and practices.
Care and wards
Care standards, hygiene plans, service instructions: the right passage in seconds, on night shifts too.
Quality management
QM handbook, procedures, audit documents: answers with sources for certification and inspections.
IT and medical technology
Manuals, fault procedures, contacts: the service desk is relieved of standard questions.
Patient information on the website
Visiting hours, admission, contacts: answers from your public pages, with an AI notice.
Website chatbot →AI in the hospital: run on your own network.
RAGSuite runs on your hospital’s servers or in your provider group’s data centre. Documents, search index and history stay there; with a local language model no request leaves your network, air-gapped if you like. Because no external cloud service processes your data, many questions from data protection and purchasing fall away.
For content without patient data, such as the public website, you can also use RAGSuite Engine. For patient data we recommend running it on your own servers.
What your data protection officer settles before the start.
Tick off what you’ve already clarified. Nothing is stored.
In healthcare a wrong answer isn’t an option. Every RAGSuite answer cites its source: that’s what made it a fit for our clients.
Questions about AI in healthcare.
Is AI in healthcare compatible with data protection?
Yes, if the legal basis, professional secrecy and data flow are clarified. It is simplest when the AI runs on your own network and no patient data goes to third parties. For health data a data protection impact assessment is usually needed. Clarify the use with your data protection officer. This is not legal advice.
What do hospitals use AI for today?
Mostly for knowledge without patient data: care standards, hygiene plans, the QM handbook, medical technology and patient information on the website. Staff find the right passage in seconds instead of in binders. These uses pay off quickly and keep data protection questions small, because no patient records are in the index.
Does section 393 SGB V apply to self-hosted AI?
Section 393 SGB V governs processing health and social data with cloud services. If RAGSuite runs on your own servers, you use no third-party cloud service for it. Whether your data centre, or your provider group’s, counts as a cloud is for your data protection officer to assess case by case.
Can we use RAGSuite Engine?
For content without patient data, such as the public website or general hospital information, yes. For patient data we recommend running it on your own servers, because the cloud rules of section 393 SGB V do not apply there. Many hospitals combine both: website chatbot in the RAGSuite Engine, internal knowledge on their own network.
Is RAGSuite a medical device?
No. RAGSuite answers questions from your documents and is not meant for diagnosis or treatment decisions. So under the EU AI Act it usually does not count as a high-risk system. If you use it for medical decisions, that classification changes and stricter duties apply to your organisation.
AI for your hospital, without patient data leaving the building.
We show you RAGSuite with documents like yours and go through your DPO’s questions with you.