Identifying data
Italian regulator: don't ask a chatbot to read medical reports
In July 2025 Italy's data protection authority called it alarming that more and more people upload blood tests, X-rays and other medical reports to AI chatbots, asking for an interpretation or a diagnosis.
On 30 July 2025 Italy's data protection authority, the Garante per la protezione dei dati personali, warned in a press release that it is becoming ever more common for people to upload test results, X-rays and other medical reports to generative AI platforms and ask them for interpretations and diagnoses.
The authority considers this alarming for two reasons. People may lose control over health data of great importance to them. And AI tools not designed for the purpose, and not made available as medical devices after the required tests and checks, may give wrong guidance. The Garante therefore asked users to think carefully before sharing health data with generative AI providers, and before relying on automated answers, which should always be checked with a medical professional.
It also advised anyone who does upload something to read the provider's privacy notice, to find out whether the health data in uploaded reports are deleted after the request, deleted later, or kept by the provider to train its algorithms. Many of the best-known services let users decide what happens to the documents they upload.
The Garante also pointed out that both the EU AI Act and Italy's Higher Health Council recognise the need for qualified human involvement whenever AI processes health data. Back in October 2023, in its guidance on national health services built on AI, the authority had stressed that such systems require a proper legal basis, a prior impact assessment, transparency and security.
What can we learn from it?
The warning is addressed to patients, but it applies even more to professionals: uploading someone's test results, discharge summary or expert report to a chatbot hands over another person's health data. AI can still help with understanding a text or clarifying a technical term. In Confiella the model has no access to files: it receives only the reviewed, approved, pseudonymised request, and file storage at the cloud provider is disabled. If a document needs explaining, it is enough to give the excerpt that matters, without names and identifiers, and to check the answer professionally.
Sources
- Garante per la protezione dei dati personali: Referti medici e IA, allarme del Garante privacy sui rischi di un uso scorretto
- AGI: Cosa si rischia se la cartella clinica finisce su ChatGpt
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]