Hospitals, health records, medical AI, research data
Healthcare and medical data
Patient data is shared on a promise. Attestation turns the promise into something the hospital can check.
Health data is the most sensitive data most people have, and the most useful for research and AI. Hospitals want to use cloud services and AI models. Their legal duty is to know who can see the data and what software touches it. A contract answers the first question. Attestation answers the second, at the moment the data is sent.
Who this is for
- Hospitals and health systems, that want cloud and AI without losing control
- Health software and AI vendors, selling into hospital procurement
- Research networks and data spaces, that pool records across institutions
- Medical device makers, whose devices produce and process patient data
Where the problem shows
A hospital sends records to an AI serviceThe data protection officer asks what runs on the other side. The honest answer today is a vendor document.
Several hospitals pool data for a studyEach must be sure the others' data is processed only by the agreed analysis, and that the result contains no raw records.
A diagnostic model is updatedThe model that was clinically validated is no longer the model that answers. Someone should be able to show which version read which scan.
A connected device in a ward is patched or repairedIt handles patient data and may control therapy. It should prove its software before it reconnects.
A regulator or patient asks who processed a recordThe answer should come from evidence, with the software version included.
What we deliver
- A design in which patient data is released only to software that has proved what it is, with the proof kept as a record.
- Verification the hospital runs itself, so its data protection officer checks evidence and does not rely on a vendor statement.
- For data spaces: attested processing environments, and rules for what happens when the analysis code changes.
- Evidence mapped to GDPR, the Swiss data protection act and the European Health Data Space.
Questions worth answering
- When records leave the hospital, what proves which software receives them?
- Can you show which model version produced a given result?
- After a vendor update, who confirms the service is still the one you approved?
Across the life cycle
DesignBuildMake or deployOperateUpdateRetire
The stage that decides here: operate. Data is released at the moment of use. The proof has to be fresh at that moment, every time. See attestation in the product life cycle.
Rules your buyers cite
GDPRSwiss Federal Act on Data ProtectionEuropean Health Data SpaceEU AI ActNIS2
Our work in this industry
Attested AIAI passportAttested devicesContinuous compliance
Go deeper
Working on healthcare and medical data? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.