Radiology reports contain health data, which the GDPR treats as a special category of personal data (Article 9). Before starting with an AI-assisted reporting tool, a department therefore needs a clear picture of how data is processed. This post is not legal advice; it lists the questions your data protection officer and legal team should ask, with Raporio's answers.
Five questions to ask
- 1What data is processed? Audio, report text, user account details. Does the tool need the patient's name or ID?
- 2Where and for how long is data kept? Is audio stored, is report text archived, how are deletion requests handled?
- 3Which third-party services are used? Speech recognition and language model providers, and their data use terms.
- 4How is transfer protected? Encryption in transit and, if data leaves your jurisdiction, the legal basis.
- 5Access and audit: who can access what, and are administrative changes logged?
How Raporio processes data
- No patient identity needed. Only the finding is dictated; you do not enter a patient name, accession or ID number. The report is copied into your own PACS/RIS.
- Audio is not stored on Raporio's servers. It is sent to the speech recognition service to be transcribed.
- Report text is archived. So that users can reach their past reports, report text is kept in their account and deleted when the account is deleted.
- Connections are encrypted with HTTPS.
- Third-party services: AI services are used for speech recognition and text formatting. The list and terms are shared during an institutional assessment.
- Administrative actions are logged: licence and user changes can be traced to who did what and when.
The simplest effective safeguard: do not say the patient's name, ID or accession number while dictating. The clinical content of the report is complete without them.
Preparing under the GDPR
- Agree with your legal team on the condition under Article 9 that applies to processing health data in your setting.
- Sign a data processing agreement with the provider (Article 28).
- If third-party services are outside your jurisdiction, assess the basis for international transfers.
- Consider whether a data protection impact assessment is needed for your use case.
- Inform staff and write down usage rules (for example, no patient identifiers in dictation).
- Do not start a pilot with real patient data before this review is complete; if needed, begin with anonymised or sample cases.
If you are planning a pilot, treat the data protection review as its first step. You can reach us through the contact page with questions.
Frequently asked questions
Does Raporio need the patient's name or ID?
No. Only the finding is dictated; the report is copied into your own system.
Is audio stored?
Audio is not stored on Raporio's servers. Report text is kept in the user's account for their history.
Is this legal advice?
No. Your institution should assess its situation with its legal team and data protection officer.
Try it with your own template
Say your findings and Raporio fills in your template. Nothing to install, it runs in the browser.
