Gains:
- Ability to define patient data as special personal data and obligations under KVKK
- Ability to implement context anonymization, data minimization, and corporate/policy compliant tool selection
- Understanding the clinical, legal and ethical consequences of a data breach and the chain of prevention
Patient data is a person's most intimate information: their diseases, genetic characteristics, mental health, addictions, sexual health. In Türkiye, Personal Data Protection Law No. 6698 (KVKK) defines health data as special personal data; In other words, it provides the highest level of protection. Carelessly entering this data into an artificial intelligence (AI) tool compromises both patient privacy and legal liability. In this unit, you will learn how to protect patient data when working with AI, anonymization and data minimization, choosing safe tools, and the consequences of a breach. Basic principle: Do not give unnecessary data; anonymize what you give; use only appropriate, policy-compliant tools.
Why is health data private?
According to KVKK, personal data is any information belonging to an identified or identifiable natural person. Health data, on the other hand, is of "special nature": its processing, as a rule, requires explicit consent or special circumstances permitted by law, and stricter security measures are essential. Even if a patient does not have a name; When a rare disease, a specific history, an institution and an age combine, a person can be redefined. That's why the idea of "I deleted the name, I'm safe" is misleading; Indirect identifiers also pose risks.
Attention: Entering health data into an AI service that uses data for model training or whose servers/policies are unclear is a violation of KVKK if there is no explicit consent and appropriate precautions. The responsibility lies with the physician and the institution; "I didn't know" is not a defence.
Three basic defenses
1. Data minimization. Only provide information that is truly necessary for the task. There is no need for the patient's name, ID or address to simplify the language of an epicrisis.
2. Anonymization. Remove or replace direct identifiers (name, surname, ID, file number, phone, address, date) with a label. Also generalize indirect identifiers (rare diagnosis + institution + date).
3. Safe vehicle selection. Choose contracted, corporate and KVKK compliant tools that guarantee that the data will not be used in education. Read the privacy policy: where is the data stored, how long is it kept, who has access?
Step by step: KVKK compliant AI use
- Is this data necessary? Never give what is not necessary.
- Anonymize. Clear direct and indirect identifiers.
- Verify the tool. Policy, retention, educational use, server location.
- Is explicit consent required? If necessary, carry out the process according to the institution's procedure.
- Preserve the output too. Is there identity leakage in AI output?
- Trace and politics. Comply with the corporate data processing record.
three mini cases
Case 1 — Prevented violation. An assistant wants to summarize an interesting case with AI for presentation. First, it extracts the name, ID, file number and date from the text, generalizes the institution and selects a tool approved by the institution that does not use the data in education. Thus, it both speeds up its work and protects privacy.
Case 2 — Risk of indirect identification. A physician enters the phrase “The only pediatric oncology patient in county X” into the AI. There is no name, but this description points to a single child; can be redefined. Per his colleague, the physician generalizes the statement ("a case of pediatric oncology") and eliminates the risk.
Case 3 — Wrong tool. A clinic uses a free tool to respond to patient messages without reading the privacy policy; It later became clear that the tool used the data in training. The institution stops the vehicle, reviews the process and moves to a KVKK-compliant solution. Reading the policy in advance would have prevented this risk in the first place.
Table of identifier types
Genre
example
to be done
Direct identifier
Name, TR ID, file number, phone
Remove/tag
semi-descriptive
Full date of birth, full address
Generalize (year, district)
indirect identifier
Rare diagnosis + institution + history
Generalize the context
free text
Name/event mentioned in the note
Scan and clean
Output leak
Identity in AI-generated text
Also check the output
Four copyable templates
Task: Find and categorize ALL personal/health identifiers in the text below: direct (name, ID, file number, phone, address), semi (full date), indirect (rare diagnosis + institution + date). Replace each with [LABEL], retaining clinical significance.Text: [...]
Task: Assess the risk of RED IDENTIFICATION of this case summary. What combination of information could point to the person? What statements should I generalize to reduce risk? Summary: [...]
Task: Produce a checklist for me to evaluate the privacy policy of an AI tool: is the data used in training, how much is stored, where is the server, who accesses it, is there a KVKK/data processor agreement?
Task: Scan and flag the following AI OUTPUT for any identifying or re-identifying information it may contain. If there are leaks, suggest a cleaned version. Output: [...]
Weak prompt / Strong prompt
Weak: "Ahmet Yılmaz, TC 123..., file 456, X Hospital, summarize the epicrisis of the patient hospitalized with the following diagnosis."
Güçlü: "Simplify an anonymous case summary: Male in his 60s, hospitalization in an internal medicine ward, [DIAGNOSIS], [TREATMENT]. Name, ID, file number, institution and full date are not given. Do not produce any identifying information in the printout."
In the powerful prompt, data is minimized and anonymous; both privacy and output are protected.
Common mistakes
- Thinking "I deleted the name, I'm safe". Indirect identifiers also describe.
- Giving unnecessary data. Information that is not required for the task should not be entered at all.
- Not reading the policy. It should be known whether the tool uses the data in training.
- Not controlling the output. Identity can also be leaked in AI output.
- Bypassing consent. Explicit consent and procedure should not be neglected when necessary.
If violated: next links in the chain
Anonymization and tool selection are preemptive defenses; But if there is a violation, it should be known in advance what to do. KVKK imposes certain obligations on the data controller: to evaluate the violation without delay if a violation is noticed, to inform the relevant persons and, when necessary, the Personal Data Protection Board, to limit the damage. In the clinical environment, this requires the institution, not a single physician, to operate the process as the data controller.
The important thing in practice is not to hide or minimize the violation. The attitude of "it didn't have a name anyway" or "no one notices" further undermines both legal risk and patient trust. The correct reflex is to immediately report the incident to the relevant unit of the institution (data controller/compliance), document which data goes where, and make the correction to prevent recurrence. A violation is also a learning opportunity that reveals the system's weak link: what step was skipped, what rule was missing?
Caution: Concealing a privacy violation may have more severe consequences than the violation itself. Transparent reporting and rapid remediation is the right way to go, both legally and ethically.
In summary
Patient data is special personal data under KVKK and requires the highest protection. Apply three defenses when working with AI: do not provide data that is not needed (minimization), anonymize what you provide (direct and indirect identifiers), choose only tools that are policy compliant and do not use data for training. Also check the output for leaks. The consequences of the violation are clinically, legally and ethically severe; The responsibility lies with the physician and the institution.
Application task
Evaluate the privacy policy of an AI tool you use yourself with the checklist above: is the data used in training, how much is stored, where is the server? Then anonymize a real case text (with your own hand); Find and clear each of the direct, semi, and indirect identifiers. Consider whether there remains a risk of re-identification.
checklist
- [ ] I never gave unnecessary data for the task.
- [ ] I removed/tagged direct identifiers.
- [ ] I generalized semi- and indirect identifiers.
- [ ] I have assessed the risk of re-identification.
- [ ] I have read the privacy policy of the tool and verified its suitability.
- [ ] I checked the AI output for identity leakage.
- [ ] I applied explicit consent and institutional procedure where necessary.