Who this is for
- Private healthcare providers using AI with patient data
- Practice managers and clinic owners responding to DPO queries
- DPOs and governance leads preparing AI evidence reviews
What your DPO may ask for
Checklist
- AI tool and use-case inventory
- Purpose of processing
- Categories of personal data
- Special category health data indicators
- Lawful basis and Article 9 condition indicators for review
- DPIA screening record
- DPIA readiness information
- Records of Processing Activities indicators
- Controller/processor mapping
- Data Processing Agreements
- Data residency and hosting information
- Sub-processor list
- International transfer indicators
- Privacy notice and patient transparency wording
- Staff guidance and training evidence
- AI incident records, where relevant
When a DPIA may be likely required or strongly indicated
A DPIA is required under UK GDPR Article 35 where processing is likely to result in high risk. In a healthcare AI context, risk indicators may include special category health data, new technology, voice or audio processing, automated evaluation, large-scale processing, vulnerable data subjects or significant effects on patients. ELSA AI does not make the final legal determination. We identify DPIA indicators and prepare a structured readiness position for DPO/legal review.
Common evidence gaps
Checklist
- AI tools not recorded in a register
- Free or personal AI tools used without a patient-data boundary
- Vendor DPAs missing
- Sub-processors unknown
- Privacy notice not updated
- No evidence of staff guidance
- No clear DPIA status
What ELSA AI can help produce
The Diagnostic produces DPO-ready structured evidence for review and adoption.
Outputs include
- DPIA Readiness and Patient Data Exposure Note
- Vendor Data Position and Evidence Tracker
- AI Tool and Use Case Inventory
- Source and Guidance Mapping Appendix
- Launchpad option for DPIA readiness workpack
The issue is not simply that AI tools exist. The issue is having no documented governance position when someone asks how that AI use is controlled. Clinical AI Exposure Diagnostic™ page explains scope, timeline and fees.
Advisory governance support only. Not legal advice, DPIA sign-off, CQC certification, ICO approval, insurer coverage advice, MDO indemnity advice or clinical safety case sign-off. Final decisions remain with the clinic’s accountable officers and advisers.
Need this evidence mapped for your clinic?
The Clinical AI Exposure Diagnostic™ gives clinic leadership a board-ready view of AI use, patient-data exposure, evidence gaps and priority actions in four working days from completed intake.