May a hospital process patient data in cloud AI?

Health data does not belong in web-based standard AI. The direct web and consumer products of OpenAI and Anthropic offer neither §203 provisions nor a C5 attestation. The models are also reachable via hyperscalers with C5 attestation, but under §393 SGB V a cloud provider needs a current C5 Type 2 attestation, processing in Germany, the EU/EEA or a state with an adequacy decision, and a branch in Germany. Local AI avoids this assessment entirely.

How is the staff confidentiality obligation handled under §203?

Hospitals conclude contracts with external providers under Art. 28 GDPR that also cover §203 (4) StGB: employees and participating persons must be bound in text form to protect patient secrets. As a provider, we bind ourselves accordingly and are warned about the criminal consequences.

Is a DPA with the provider enough?

No. The data processing agreement under Art. 28 GDPR only governs data protection. Medical confidentiality under §203 StGB applies additionally - in the hospital for many professionals, whose secret protection extends across the whole institution via §203 (4).

Can AI be operated air-gapped?

Yes. For maximum security the AI runs fully offline in your own data centre, without an internet connection. Patient data does not leave the hospital network.

Does it scale to hospital size?

Yes. Instead of a single appliance, dedicated GPU servers are used, handling discharge letters, tumour-board preparation and coding at large volume and for many users in parallel.

How is the HIS connected?

Through interfaces to your hospital information system (e.g. Orbis, SAP IS-H). The AI adds RAG over internal guidelines, SOPs and documentation to the HIS; processing stays in-house.

What is RAG and why for the hospital?

Retrieval-Augmented Generation combines a language model with a searchable knowledge base. The AI draws answers from internal guidelines, SOPs and case documentation - with source references and access control. This reduces hallucinations and keeps hospital knowledge local.

Does hospital AI fall under the high-risk rules of the EU AI Act?

Administrative applications like drafting discharge letters or coding support are generally not high-risk systems. Diagnostic AI can fall under the MDR as a medical device and, via Annex I, under the high-risk rules, which following the Digital Omnibus only apply from 2 August 2028. The transparency obligations under Art. 50 have applied since 2 August 2026.

Local AI for Hospitals: §203 StGB, HIS Integration and RAG

Timo Wevelsiep25.06.2026Updated: 12.10.2026

#AI
#Hospital
#Clinic
#DataProtection
#RAG

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

AI in the hospital without putting patient data into the cloud? We build local, §203-compliant AI in your data centre - see AI for hospitals and AI for confidentiality professionals, or book an initial consultation.

Discharge letters, tumour-board preparation, DRG coding - in a hospital all of this occurs at large volume and ties up clinical time. AI can provide massive relief here. The problem is not the AI but where the data flows. For patient data, §203 StGB, GDPR Art. 9 and §393 SGB V set high requirements for confidentiality, data processing and participating providers; cloud services for health data additionally require a C5 attestation.

The good news: there is a clear, legal path. For health data, our route runs through AI in your own data centre, air-gapped on request. This article frames the legal situation, shows the permitted operating models, and explains how we build a RAG pipeline on your hospital knowledge - scaled to hospital size.

The legal situation in 2026: §203 StGB and GDPR Art. 9
Why cloud AI becomes a risk for hospitals
Operating models for hospital AI
The RAG pipeline: components step by step
Connecting multiple knowledge sources securely
How we work at WZ-IT
Further guides

Medical confidentiality is criminally sanctioned via §203 StGB. In a hospital many professionals are subject to this duty; seizure protection even extends to the custody of the medical institution. Health data is specially protected under Art. 9 GDPR, plus the state hospital laws.

For engaging external AI providers, §203 (3) s. 2 StGB applies: a participating person may only have secrets revealed to the extent necessary - and is itself included in liability under §203 (4) StGB. Hospitals conclude contracts with providers under Art. 28 GDPR that also cover §203 (4): employees and participating persons are bound to confidentiality in text form.

In practice: health data does not belong in web-based standard AI. The direct web and consumer products of OpenAI or Anthropic offer neither §203 provisions nor a C5 attestation; the models are, however, also reachable via hyperscalers with C5 attestation. When healthcare providers process health data in the cloud, §393 SGB V has required a current C5 Type 2 attestation since 1 July 2025. Processing is permitted in Germany, the EU/EEA, equivalent states or third countries with an adequacy decision, and the processor needs a branch in Germany. The provision does not require a German data-centre location. Local AI avoids these hurdles because the data never leaves the building in the first place. In addition, the EU AI Act's transparency obligations under Art. 50 have applied since 2 August 2026. Following the Digital Omnibus (Regulation (EU) 2026/1744), high-risk obligations apply from 2 December 2027 for Annex III and from 2 August 2028 for Annex I, which covers AI in medical devices, for example (as of October 2026). This article is general information and not legal advice.

Why cloud AI becomes a risk for hospitals

The direct offerings of large AI providers are structurally problematic with patient data:

The subprocessor chain. A large AI provider itself uses subprocessors (Azure, AWS, and others). In a hospital with many professionals, every entity would have to be bound individually - not practically feasible.
The CLOUD Act. US providers are subject to the US CLOUD Act. An EU region does not protect as long as a US parent company stands behind it.
C5 and branch. For health data in the cloud, §393 SGB V requires a C5 Type 2 attestation and a branch of the provider in Germany - regularly not provided by the direct offerings of the large AI vendors.

With local AI in your own data centre most of these requirements disappear: the data stays in-house, air-gapped on request. Because we retain maintenance access, we remain a participating person - which is why we offer the §203 contract package for the build and maintenance phase as an option.

Operating models for hospital AI

At hospital scale we rely primarily on your own hardware:

Dedicated GPU server or LLM hosting. For the large volume of a hospital - many users, high throughput. Operated in your own data centre, air-gapped on request, with an OpenAI-compatible API for HIS integration.
On-premise appliance (AI Cube). For individual departments or as a pilot - turnkey, local.
Managed operation for content without patient data. Guidelines, SOPs, administrative and quality documents can also run in German infrastructure. Patient data stays in your own data centre.

In all models only open-source building blocks are used (no vendor lock-in), and the §203 contract package is available as an option. More on the cross-industry framework under AI for confidentiality professionals.

The RAG pipeline: components step by step

The real value comes not from a bare language model but from Retrieval-Augmented Generation (RAG): the AI answers questions from your internal guidelines and SOPs instead of from generic training knowledge - with source references. This is how we build the pipeline (more under Custom RAG):

Ingestion. Documents are read in from the source systems (guidelines, SOPs, documentation) and normalised.
Chunking. Content is split into meaningful sections, oriented around structure and context.
Embeddings + vector database. Each section is translated into a vector and stored in a vector database (Qdrant) - with access and department metadata.
Retrieval and re-ranking. For a query, the most relevant sections are retrieved and sorted by re-ranking.
Generation. A local model (Ollama or vLLM) formulates the answer - based solely on the retrieved passages, with source references.
Observability and quality. With Langfuse we measure quality, latency and cost and make answers traceable - important for audits.

We run exactly this stack ourselves: our AI offer finder on wz-it.com is a production RAG system on Qdrant, LiteLLM/Mistral and Langfuse.

Connecting multiple knowledge sources securely

We connect multiple knowledge sources into the same RAG pipeline - with enforced access rights:

HIS and case documentation. Connection to your hospital information system for research in the treatment context.
Internal guidelines and SOPs. In-house standards as a RAG source for consistent drafts.
Medical literature and guidelines. Where permitted by licence, as a supplement.
Knowledge base. Hospital know-how and workflows searchable from one place.

The decisive factor is access control: through rights and payload filters in the vector database, every query only sees the sources it is allowed to see - by department and role. This matters especially in a hospital with many departments.

How we work at WZ-IT

We deliver hospital AI as a lifecycle, not as a device purchase:

Advise and design. Workshop, sizing, data classification and the §203 contract framework - before any hardware enters the data centre.
Build and integrate. Setup in your own data centre (air-gapped on request), RAG with access control, HIS integration, confidentiality obligation plus DPA.
Operate and maintain (optional). Updates, monitoring, model upgrades and RAG curation as a contract - or your IT operates it after handover.

The operational contract texts are drafted by qualified professionals; this article does not replace case-specific legal advice.

Further guides

AI for hospitals - the solution page with use cases and hardware options.
AI for confidentiality professionals - the cross-industry §203 framework (also for medical practices and psychotherapists).
Custom RAG - how we build RAG pipelines end to end.
AI hub - local AI infrastructure, LLM hosting and RAG at a glance.

Ready for AI that protects your patients? We build it in your own data centre, §203-compliant, and operate it on request. Book your initial consultation now.