Health data is special category data
Patient health information is special category data under GDPR Art. 9, requiring explicit legal basis for processing. Healthcare providers must ensure that any AI tool handling patient data meets the heightened requirements for sensitive data — including strict purpose limitation, security measures, and contractual safeguards with every processor.