This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
ChatGPT itself isn't the compliance problem, what you type into it is. A general-purpose AI chatbot has no special status under UK data protection law, and pasting a real patient's name, condition, and history into a public AI tool is processing special category health data the same way any other disclosure would be, with the same obligations attached.
In short: Health information is special category data under UK GDPR, and pasting patient-identifiable details into a general-purpose AI tool with no data processing agreement in place is a real compliance risk, not a grey area. The practical fix is simple: strip identifying details before drafting, then add them back manually before the letter goes out.
The plain-English answer
Using ChatGPT to help draft patient letters, referrals, or treatment notes is genuinely useful and not off-limits for a UK allied health practice. What matters is whether patient-identifiable information goes into the tool along the way. A consumer ChatGPT account has no clinical-grade data protection agreement with your practice, no guarantee about where the input is stored, and depending on account settings, your input may be used to improve the underlying model. None of that is disqualifying for using AI in your workflow, but it does mean identifiable patient details shouldn't be part of what you type in.
Why this matters for your business
A 3-practitioner physiotherapy clinic drafting referral letters is exactly the kind of small, time-pressed practice that benefits most from AI assistance and has the least spare capacity to deal with a data protection incident if something goes wrong. Health data carries a higher bar under UK GDPR than ordinary personal data specifically because the consequences of it leaking or being mishandled are more serious for the person it belongs to.
The habit of pasting in real patient details usually starts small, a name here, a condition there, to save the ten seconds of removing it, and becomes normal practice within a clinic before anyone stops to ask whether it should be. That's the pattern worth interrupting deliberately rather than after a patient asks where their information went.
What UK data protection law actually says
Health information is special category data under UK GDPR, a category that requires an additional lawful condition beyond the standard basis needed for ordinary personal data, and generally a higher standard of care in how it's handled. The ICO's own guidance on special category data sets out what counts and what's required before it can be processed.
The ICO has also published dedicated guidance on AI and data protection, covering how existing UK GDPR principles, fairness, accountability, data minimisation, apply specifically to AI tools. The practical read for a small clinic: a general-purpose AI tool with no clinical data processing agreement isn't automatically banned from your workflow, but treating it the same as a secure clinical system when it isn't one is where practices get into trouble.
What this looks like in practice
Picture the physiotherapist starting to draft a GP referral letter, pasting in the patient's name and injury history directly into ChatGPT to save time getting the first draft down. It's a natural instinct, the details are right there in the notes, and retyping them without the identifying information feels like extra friction. But that's the exact moment identifiable health data leaves the practice's own systems and enters a tool with no clinical data agreement behind it.
The fix the clinic settles on is a simple two-step habit: draft with a placeholder, "Patient X, 34yo, six weeks post ACL reconstruction, presenting with...", get ChatGPT's help with the structure and clinical language, then add the real name and identifying details back in manually before the letter is finalised and sent. The time saved on the actual drafting is unchanged, the only difference is a ten-second substitution step at the start and end. That small habit is the difference between using AI well and creating a real data protection exposure for the sake of convenience.
What you can do about it
A short set of habits covers most of the risk without giving up the time savings AI genuinely offers:
- Strip patient names and identifying details before drafting anything in a general-purpose AI tool, use a placeholder and add real details back in manually afterward.
- Check your AI tool's account settings for whether your inputs are used to improve the model, and turn this off if the option exists, or use a business-tier plan that disables it by default.
- Reserve AI drafting for structure and language, not for storing or looking up real patient information, that still belongs in your clinical records system.
- Agree this as a written practice-wide habit, not something left to individual judgement, so every practitioner in the clinic follows the same approach.
For the fuller picture on evaluating AI tools that do need to handle real patient data directly, such as AI scribes, see our guide on AI tools for healthcare practices, which covers the vendor agreement side of this question in more depth.
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Every tool is judged on one question: could a business with no dedicated IT department actually pick this up and use it on Monday morning.
Related reading: our AI governance by region.
Try our free AI Tool Selector to get a personalised AI tool recommendation for your business.
Is it ever acceptable to use a patient's real name in ChatGPT?
Avoid it where a placeholder would work just as well for drafting purposes. If a specific use case genuinely requires identifiable detail, that's a stronger signal you need a clinical-grade tool with a proper data processing agreement, not a general-purpose consumer AI account.
Does a ChatGPT business or team plan solve this problem?
It reduces some of the risk, business-tier plans typically don't use your input to train the model and offer stronger data handling terms, but they still don't automatically constitute a clinical data processing agreement. Check the specific terms rather than assuming a paid plan is equivalent to a healthcare-grade tool.
What should we do if a practitioner has already been pasting in real patient details?
Stop the practice going forward and introduce the placeholder habit immediately, then document that the change was made. UK GDPR compliance is about demonstrating you took data protection seriously and acted on it, not about a spotless historical record.
Does this apply to voice-to-text or dictation tools too, not just ChatGPT specifically?
Yes, the same principle applies to any AI tool processing patient information, dictation, scribes, or chatbots. The relevant question is always the same: does this specific tool have a proper agreement in place for handling special category health data, or is identifiable information going somewhere without one.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Looking at an AI tool that needs to handle real patient data directly, not just drafting help?
See what to check first