AI can read health data. Where it does so is your decision.

Doctors' letters, findings, applications: much of the work in hospitals, medical practices and health insurance funds starts with a document that contains health data. We build processes in which AI reads on devices in your organization or on your own infrastructure, a person confirms, and every step stays traceable.

§ 393 SGB V · NIS2 · EU AI Act

1. 01

   Incoming mail with health data

   Doctors' letters, findings and requests for cost coverage arrive by post and electronically and have to reach the right case.

   Agent

   Recognizes the document type and reads patient details, date and sender.

   System

   Rules propose the case or department. Reading happens on trusted Macs in your organization; the Relay in between runs in your infrastructure and cannot read the content.

   Human

   A person checks unclear cases and confirms the assignment before the document is filed.

   Products

   Edge AI FabricProcess Core

2. 02

   Applications to health and long-term care insurance funds

   Applications for medical aids, rehabilitation or care services arrive with prescriptions, reports and forms that have to be complete before anyone can decide.

   Agent

   Recognizes the application, reads the relevant details, checks completeness and drafts a query for missing documents.

   Human

   The case worker sends the query and decides on the application. Inputs and rule version are recorded with the decision.

   Products

   INTAKEProcess Core

3. 03

   Models on your own infrastructure

   When healthcare providers or health and long-term care insurance funds process health or social data with a cloud service, § 393 SGB V sets conditions such as a current C5 attestation. For many reading tasks, a specialized model on your own hardware is enough.

   System

   Open models, optimized for the task, run in your own data center or on devices in your organization; where a larger model is needed, access to it stays replaceable.

   Human

   You decide which document types stay on your own model and which processes may use a cloud service.

   Products

   Digital resilience

1. 01 · ReceiveScans from the mail room and electronic mail; text recognition for scans is project work
2. ↓
3. 02 · Read on the deviceDocument type, patient details, date and sender, read on a trusted Mac in your organization
4. ↓
5. 03 · ProposeCase and department according to your rules; the rule version is recorded
6. ↓
7. 04 · ConfirmA person checks unclear cases and confirms the assignment
8. ↓
9. 05 · Hand overTo your systems, with every step in the history; the content stays in your organization

• § 393 SGB V

  C5 Type 2 attestation as a rule since 1 July 2025

  In short

  Healthcare providers, health and long-term care insurance funds and their processors may process health and social data with cloud services only under certain conditions, among them requirements on where the data is processed and a current C5 attestation for the service.

  What software can contribute

  Processing on devices in your organization or on your own infrastructure instead of in a third party's cloud service. Whether a self-operated platform counts as a cloud service under § 393 depends on how it is set up.

• NIS2

  German implementation in force since 6 December 2025

  In short

  Healthcare providers of medium size and above, hospitals among them, have to take risk-management measures and report significant security incidents, starting with an early warning within 24 hours.

  What software can contribute

  Self-hosted operation, documented dependencies and traceable records of who did what.

• EU AI Act

  High-risk obligations from 2 December 2027

  In short

  AI systems that public authorities, or others on their behalf, use to assess whether natural persons are eligible for essential public assistance benefits and services, including healthcare services, are high-risk (Annex III), with requirements including human oversight, documentation and transparency. Whether a system is covered depends on its intended purpose; systems that only perform a narrow procedural or preparatory task and do not profile people can be exempt (Art. 6(3)).

  What software can contribute

  A person decides; drafts go to release, not to sending, and inputs and rule version are recorded with the decision.

05 — Talk to us

Which of your processes with health data run in cloud services today, and which of them could run on your own infrastructure?

After that we talk about documents, devices and what has to run on your own infrastructure.

Talk to an engineer ↗