AI Privacy for healthcare
What ships out of the box
SOWA Privacy comes with a built-in Medical preset blacklist – every term below is flagged as personal data automatically, in addition to the regex layer (emails, phone numbers, IBANs, national IDs) and the optional multilingual NER layer.
The preset is enabled with a single click in Settings → Detection → PII Presets (pick "med"). The examples below show common English clinical vocabulary; add organisation-specific terms via the custom Blacklist.
Clinical roles
Roles that, paired with a name, identify a clinical relationship.
Documents & processes
Anything that signals an existing patient record.
Institutions
Hospital and clinic identifiers.
Sensitive diagnoses
Conditions that trigger GDPR Art. 9 special-category protections.
Why this matters for healthcare
GDPR Article 9 – special category data
Health data is one of the categories given extra protection under GDPR Art. 9 – it cannot be processed without a specific lawful basis (explicit consent, vital interests, public health, etc.). Pasting a patient note into ChatGPT without anonymisation is a Art. 9 processing event that most healthcare providers cannot justify.
SOWA Privacy moves the boundary: by the time the text leaves the browser, the protected categories have already been replaced with placeholders. The AI sees [NAME_1] and [CONDITION_2], not "Anna Smith – depression".
HIPAA – covered entities and PHI
For US healthcare providers covered by HIPAA, the same logic applies to Protected Health Information. The anonymisation step happens before any third-party processor (the AI vendor) sees the data, which keeps the upstream relationship inside the original consent boundary instead of expanding it.
Local detection – no cloud round-trip
The detection itself runs entirely in your browser. The regex layer and the medical blacklist need zero network. The optional NER layer downloads a 65 MB model once (HuggingFace) and then runs offline forever. No patient text reaches any SOWA server – SOWA doesn't have one.
Tailor it to your workflow
The Medical preset is the floor, not the ceiling. From Settings → Detection → Custom rules & lists you can:
- Add hospital-specific identifiers (employee badge numbers, internal ward codes, study IDs) to the Blacklist.
- Add safe boilerplate (drug names you cite frequently, public study titles) to the Whitelist so SOWA stops flagging them.
- Add custom regex rules for clinical IDs that match a specific format (e.g.
MRN-\d{8}). - Export and import presets as
.sowa.jsonfiles so an IT admin can ship a standard rule set to every workstation.
SOWA Privacy is a privacy tool, not legal advice. Anonymising prompts is a strong technical mitigation, but each organisation needs to confirm its own data-handling agreements with AI vendors and document the residual risk for its DPIA.