AI for medical practices:relief at the front desk,not in the consulting room

In a medical practice, AI mainly takes pressure off the organisation: phone assistants answer calls and book appointments, AI chats draft practice notices and emails, and dictation can be turned into structured documentation faster. Medical decisions stay with the doctors. Because practices handle health data, special rules apply: Article 9 GDPR across the EU and, in Germany, the duty of confidentiality under section 203 of the Criminal Code.

Nikolai Schöbel and Jeremias Burger

Co-founders of Scalableloops GmbH. Nikolai Schöbel leads online marketing and AI strategy, Jeremias Burger the AI architecture. Both build AI systems and train teams on them in their own agency work.

How does an AI phone assistant take pressure off reception?

In many practices the phone is the biggest source of interruption at the front desk. An AI phone assistant answers calls, understands the request in natural language and handles routine cases itself. Providers such as Doctolib describe their assistant like this: it answers calls, books, reschedules or cancels appointments and takes messages about repeat prescriptions or referrals for the team.

Three questions decide whether it works. First: what may the assistant handle on its own, and what always goes to a person? Anything that sounds like an emergency or needs a medical judgement is not for the AI; it is passed on immediately or answered with a clear pointer to the emergency number. Second: how does a message reach the team, and who deals with it by when? Third: which data does the assistant ask for, and where is it stored?

There is also a legal duty. Article 50 of the EU AI Act has applied since 2 August 2026: people interacting directly with an AI system must be told so unless it is obvious. For a practice, that means the assistant says at the start of the call that the caller is speaking to an AI. More in our article on AI disclosure for chatbots. Many principles from customer service in other sectors apply here too, see Use AI for customer service.

How can AI support documentation without handing over responsibility?

In documentation, AI can take on the typing: dictation becomes text, loose notes become a clear structure, recurring letters become drafts. The medical content always comes from the doctor, and every line is read before it is filed. The AI organises and words; it does not add anything.

That matters most with wording that sounds clinical. Language models can write convincingly and still add something that was never said. So give a clear instruction: “Transcribe this dictation into a structured text. Keep every detail word for word, add nothing, summarise nothing and mark anything unclear with UNCLEAR.”

Where this work happens is decisive. Dictation relating to patients does not belong in a freely available AI chat but in a system with a contract, a confidentiality obligation and a known storage location. Some practices look at solutions that run on their own network; we describe the pros and cons in our article on local AI for business. For team meetings without patient data, see Use AI for meeting minutes.

What do medical confidentiality and the GDPR mean for AI in a practice?

Under Article 9 GDPR, health data is one of the special categories of personal data. Processing it is prohibited in principle. One of the exceptions covers health care and treatment, on condition that the data is handled by professionals subject to professional secrecy or by other people under an obligation of confidentiality.

In Germany, criminal law adds another layer. Under section 203 of the Criminal Code, a doctor who discloses a secret entrusted to them without authorisation commits an offence. The law allows practices to involve external service providers where this is necessary for their work, but the practice must make sure those providers are bound to confidentiality; if it does not, the practice itself can be liable.

For AI tools this means: patient data never goes into a personal AI account. Every provider that processes patient data needs a data processing agreement under Article 28 GDPR and a confidentiality obligation. Check with your data protection officer that both are in place, where the data is stored and whether a data protection impact assessment is needed. In its guidance of 6 May 2024, the German Data Protection Conference (DSK) expects such an assessment to be required in many cases when AI is used.

What does the EU AI Act require of practice owners?

Besides Article 50, Article 4 of the EU AI Act is the one that matters most for practices. It has applied since 2 February 2025 and, since 27 July 2026, in the version amended by the Digital Omnibus, Regulation (EU) 2026/1744. Anyone who uses AI systems must take measures that support the development of their staff's AI literacy. That applies whatever the size or specialty, including a single-handed practice with three receptionists.

A specific level of competence per person is no longer required, and the regulation does not prescribe a particular training format or certificate. A short briefing on the actual tool works well: what it can do, where it gets things wrong, which data is off limits and who decides what. Keep a record of what you have done. We explain the details in our article on the AI literacy obligation under Article 4.