Welcome back
In Level 1 we looked at what AI can and can't do in care work. Today we're starting on the habit that keeps you, your patients and your registration safe: knowing what never goes into an AI tool.
Before we start, a quick reminder. This course gives general information. It isn't clinical or legal advice. Always follow your organisation's policy and your own professional judgement. If your local information governance (IG) team says something different from what you read here, go with them.
Ready? Let's go.
Why health data gets extra protection
The UK GDPR covers personal data. That means any information about a living person who can be identified from it, either directly or indirectly.
Some personal data is more sensitive, so the law calls it special category data. Health data is on that list. So are racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic and biometric data, and information about someone's sex life or sexual orientation.
Why does health get this extra protection? If it leaks, people can face discrimination, stigma or real harm, and a leak can't be undone.
So what does that mean in practice? An organisation needs two things before it can use special category data: an ordinary lawful basis under Article 6 and one of the specific conditions in Article 9. For health and social care, your employer has already worked this out for its approved systems. A free chatbot you opened on your phone has had none of that work done.
This catches people out: "health data" is broader than you'd think. The Information Commissioner's Office (ICO) gives examples such as injuries, diseases, test results, appointment reminders that reveal something about someone's health, and an NHS number when it sits alongside information about their health.
Direct and indirect identifiers
You'll spot direct identifiers straight away: name, NHS number, date of birth, address, phone number, photo.
Indirect identifiers are sneakier. On its own, each one seems harmless. Put a few together, though, and they point to one person. Watch out for:
- Rare conditions or unusual combinations of conditions
- Exact dates, like an admission date, a date of death or the date of a fall
- Specific places: the ward, the care home, the village, the street
- Job, age, family details or a memorable event
- Room or bed numbers and initials
Let's try one together. Imagine this sentence:
"Retired headteacher, 94, on Ward 7, admitted last Tuesday after a fall at the only care home in Little Barton. Has a rare muscle disease."
There's no name in it. Could someone work out who it is? Easily. A small village, one care home, a rare disease and a known job is all it takes.
"But I used initials"
A lot of us think swapping a name for initials or a bed number makes data anonymous. It doesn't.
The ICO's guidance on anonymisation and pseudonymisation, published in March 2025, is clear about this. Pseudonymised data, where you swap identifiers for codes or initials, is still personal data. Only truly anonymised data, where nobody could reasonably identify the person, falls outside data protection law.
To test that, the ICO uses a "motivated intruder": a reasonably competent person with the internet and some determination, who might even ask people who know the patient. Could they work out who it is? If yes, it isn't anonymous.
The safe-rewrite habit
You can still get a lot of value from AI. You just ask about the situation, never the person. Here's the routine:
- Highlight direct identifiers and remove them.
- Hunt for indirect ones: rare conditions, dates, places, jobs, unusual events.
- Generalise. Swap specifics for broad descriptions, like "an older adult" or "a rare neuromuscular condition", or drop them if they don't matter to your question.
- Re-read as the motivated intruder. Could anyone at work, or in the patient's town, recognise this person?
Let's rewrite our example:
"I'm writing a general falls-prevention leaflet for older adults in residential care. What topics should a plain-English leaflet cover?"
See what happened? We didn't make a fake patient. We turned it into a general question. That's usually the safest and most useful prompt anyway.
What never to paste
Here's the firm rule: never enter identifiable patient or service-user information into an unapproved AI tool. That includes:
- Names, NHS numbers, dates of birth, addresses or photos
- Copied notes, letters, referrals, discharge summaries or handover sheets
- Screenshots of records or results
- Details that are "anonymised" only by initials or bed numbers
- Anything a motivated intruder could piece together
When you're unsure, leave it out and ask your IG team. A missing detail costs you a few seconds. A data breach can cost your patient their trust and could cost you your job.
Your turn
Take a recent email or note you wrote, but not a patient record. Underline every direct identifier in one colour and every indirect identifier in another. Then rewrite it as a general question you could safely ask an AI tool. You'll be surprised how many indirect identifiers you find!
Key takeaways
- Health data is special category data under UK GDPR. It needs extra legal conditions and extra care.
- People can be identified indirectly, through rare conditions, dates, places and other details.
- Initials and bed numbers are pseudonymisation, not anonymisation. That's still personal data.
- Use the motivated intruder test: could a determined person work out who it is?
- Ask about the situation, not the person. Never paste identifiable patient data into an unapproved tool.