Healthcare (EU — GDPR)

A hospital data office and a clinical product team rarely move at the same speed. Both answer to the same regulator, and both need the special category question settled before a pilot starts. This starter settles the runtime part of it. The paperwork part, including the impact assessment, stays with the data office.

The consent gate is the point of this starter. The gate applies to every call, and a request without a value in that header is blocked. Health, genetic, biometric and clinical research appear as declared categories in the result details. They do not decide which requests face the check, and the header is tested for presence alone. Identity must also carry a user and an organization, so a data subject request can be traced to an actor. Explicit consent is the lawful basis these settings assume, and your record of that consent lives outside the gateway.

Redaction runs in health mode and covers patient identifiers, European health insurance numbers, national identifiers and bank account numbers. It also masks the national health cards used in Italy and France. Special category subjects are handled more firmly, because genetic data, biometric templates, psychiatric notes, infection status and substance use history are blocked instead of masked. Three transfer phrases are blocked as well, including a request to export patient data or to move it to a third country.

Language checks run on the request and the response and allow five deployment languages. Clinical language limits stop a diagnosis, a prescription or a dosage instruction in generated text, and two disclaimers are required. A bias watch sits on the response, and it only answers to hiring, promotion or performance review wording. Clinical prompts do not use those terms, so the watch adds monitoring here and no fairness control. The scoring gate asks for a combined 0.80 and accuracy of 0.88, while citation checks record grounding at 0.85 without blocking.

Redacted capture of every interaction is what the gateway leaves behind, and the audit marker adds only a note that the checks ran. Care decisions are not made here, because clinical judgment belongs to the treating clinician. A lawful basis record and a transfer mechanism are documents you still owe. Pick the United States health starter instead when minimum necessary access drives the same clinical work.