Can a medical practice use AI with patient data?

That depends on purpose, legal basis, necessity, data paths, and technical and organisational measures. Health data under Article 9 GDPR and German confidentiality under § 203 StGB require a case-specific assessment. Local processing can reduce external recipients but does not replace that assessment.

Is ChatGPT Business categorically prohibited for a medical practice?

No. Product and plan, configuration, contract, data region, subprocessors, purpose, and data all matter. Identifiable patient data should not be entered into an external service without documented approval. Local AI is an alternative where tightly controlled data paths are required.

Is the AI Cube compliant with § 203?

The AI Cube can be configured as a technical foundation for a use aligned with § 203. Whether an actual process satisfies the requirements depends on data sources, roles, external connections, support access, and the practice's organisational rules.

Is a PMS connection included?

No. The PMS, available interfaces, and data required for the workflow must be assessed first. A PMS connection is a separate integration project.

Can staff create their own knowledge spaces?

Yes. Depending on permissions, Open WebUI supports personal and shared knowledge spaces using uploaded documents. Automatic synchronisation with PMS, DMS, or network storage is separate.

What does it cost to start?

The AI Cube costs from €7,999 excl. VAT one-time, including hardware, Open WebUI, an agreed local model, hardening, setup, briefing and shipping. Patching, backup, monitoring and support are covered by AI Cube Care from €349.90 excl. VAT per month; the first twelve months run with the device, after that Care is cancellable monthly. Integrations are agreed separately.

Local AI in medical practices: patient data, § 203, and practical workflows

Timo Wevelsiep25.06.2026Updated: 12.10.2026

#AI
#MedicalPractice
#DataProtection
#RAG
#HealthData

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

Introduce local AI for practice knowledge, drafts, and documentation? The AI Cube brings a fully preconfigured AI platform into the practice network. The medical-practice solution page explains the commercial path; an initial consultation clarifies use and boundaries.

A medical practice rarely needs “some AI”. It needs a constrained workflow: find internal knowledge, complete an approved template, structure documentation, or prepare a draft for professional review. Only then should it decide which data may be processed and whether a local platform, external service, or combination fits.

This article explains the local path. It makes no blanket legal promise and is not data-protection or legal advice. As of October 2026.

Which tasks make a useful first step
What § 203 StGB and Article 9 GDPR require
Compare cloud and local operation objectively
What the AI Cube brings to a practice
Use practice knowledge without a PMS connection
When a PMS connection is a separate project
Introduction in four stages
Operations after deployment
Sources

Which tasks make a useful first step

Start with tasks where a professional reviews the result and the data scope can be constrained:

search practice SOPs, approved guidelines, or internal procedures;
prepare text drafts from practice templates;
structure or summarise non-diagnostic documentation;
translate patient information into clearer language with professional review;
make internal training and quality material searchable.

The closer a function comes to diagnosis, treatment decisions, risk assessment, or automated care, the more quality, liability, medical-device, and AI Act requirements change. The EU AI Act's transparency obligations under Art. 50 have applied since 2 August 2026. Following the Digital Omnibus (Regulation (EU) 2026/1744), high-risk obligations apply from 2 December 2027 for Annex III and from 2 August 2028 for Annex I, which covers AI in medical devices. The AI Cube is not a medical device and does not replace professional judgement.

Physicians are among the professionals covered by German Section 203 StGB. Health data is also a special category under Article 9 GDPR. An AI process must therefore define purpose, legal basis, necessity, recipients, access, retention, and deletion.

Section 203 does not prohibit every collaboration with IT providers. It recognises participating persons but places conditions on necessity and confidentiality. GDPR, professional rules, and potentially other regulation apply alongside it. A data processing agreement is one component, not complete approval of the workflow.

Our guide for confidentiality professions explains the technical and organisational assessment. General data-protection criteria are covered under GDPR-compliant AI.

Compare cloud and local operation objectively

External AI services differ significantly between consumer, business, enterprise, and API offerings. Data use, retention, regions, SSO, logs, and subprocessors depend on the exact product. “Cloud AI is always prohibited” is therefore as inaccurate as “a business plan is automatically approved”.

Local AI moves model inference, chat, and potentially retrieval into practice infrastructure. This can reduce external recipients and international transfers. Updates, telemetry, web search, cloud models, remote maintenance, and backups can still create outbound paths. Those functions must be documented and constrained rather than assumed away.

Anyone processing health data in a cloud has needed a current C5 Type 2 attestation from the provider under Section 393 SGB V since 1 July 2025. Processing is permitted in Germany, the EU/EEA, equivalent states or third countries with an adequacy decision, and the processor needs a branch in Germany.

What the AI Cube brings to a practice

The AI Cube is a preconfigured local AI platform on hardware with 128 GB of unified memory. It includes Open WebUI, a local model runtime, an agreed and tested model, base setup, hardening, functional testing, initial setup, and support.

Staff receive a familiar chat interface. According to permission, they can work with the approved local model, upload documents to knowledge spaces, share team knowledge, provide templates and prompts, and switch between approved models.

The AI Cube costs from €7,999 excl. VAT one-time, including setup, briefing and shipping. On top of that comes AI Cube Care from €349.90 excl. VAT per month; the first twelve months run with the device, after that Care is cancellable monthly. It is usually ready within two weeks after configuration approval. Personal delivery and setup within Germany can be arranged.

Use practice knowledge without a PMS connection

Initial value does not require immediate PMS integration. A practice can build a constrained Open WebUI knowledge space with approved SOPs, templates, device manuals, or training material. Staff upload content deliberately and receive answers grounded in the collection.

This manual path keeps scope and permissions manageable. It tests value and working practice before automated data flows are created. It does not mean patient data belongs in the knowledge base without specific approval.

When a PMS connection is a separate project

A PMS connection needs specific answers: system and release, documented interfaces, required fields, read or write access, mapping of practitioners and cases, professional review, and handling of errors, changes, and deletion.

Only then can an integration be judged technically useful and organisationally approvable. WZ-IT scopes APIs, middleware, or RAG pipelines separately. We do not promise compatibility with every PMS in general.

Introduction in four stages

1. Select a workflow

Define one result, responsible users, and excluded data. For example: search internal SOPs, not automate diagnosis.

2. Configure the platform

Network, users, local model, Open WebUI, update, and support paths are prepared and documented on the AI Cube.

3. Test with approved material

The practice uses representative, approved documents. It assesses grounding, clarity, failure cases, latency, and professional review effort.

4. Expand integration deliberately

Only after value is established should automated sources, PMS, secure remote access, or custom workflows follow. This avoids building the largest interface before knowing whether the workflow works.

Operations after deployment

Local AI still needs updates, security review, backup, monitoring, and a model-change process. With AI Cube Care, WZ-IT provides patching, backup, monitoring and support from €349.90 excl. VAT per month; the confidentiality agreement under Section 203 of the German Criminal Code is available as an option with AI Cube Care. Backup targets, maintenance windows and available service levels are documented to match the use case.

Remote support does not receive a blanket open path. Approvals, identities, and logging are agreed. Staff and additional sites can be connected through VPN or NetBird where required.