Ministry of Health bans the entry of patient data into unapproved generative AI tools

- Deputy Minister Approves Practical Guide Regulating the Use of AI Tools and Large Language Models in Clinical Practice

- Outputs Are Advisory Only and Must Not Be Solely Relied Upon for Diagnosis, Treatment, or Prescribing

The Deputy Minister of Health, Sheikh Dr. Salman Khalifa Al-Sabah, issued an administrative decision today, Tuesday, approving and disseminating the Practical Guide for the Use of Artificial Intelligence Language Tools and Large Language Models in Clinical Practice.

In a press statement, the Ministry of Health stated that the decision serves as a regulatory framework for staff in health facilities under the Ministry’s jurisdiction, balancing the benefits of leveraging these technologies against the need to protect patient privacy, ensure safe practice, and uphold professional responsibility.

The Ministry added that the decision aims to enable the safe and responsible use of AI tools, emphasizing that their outputs remain advisory and non-definitive. They do not replace professional judgment or medical responsibility, nor should they be considered a final reference, an approved clinical recommendation, or a substitute for a physician’s or healthcare specialist’s assessment.

The Ministry clarified that the decision stresses the protection of patient data confidentiality and health information. It prohibits the input, upload, or copying of identifiable or sensitive data—including patient names, civil ID numbers, medical record numbers, images, audio recordings, laboratory results, radiology reports, discharge summaries, and screenshots—into any language tool, cloud service, or platform not officially approved by the relevant authorities within the Ministry.

The Ministry confirmed that AI language tools or associated cloud services must not be used with actual patient data, sensitive data, or operational data belonging to the Ministry, unless officially approved in accordance with data protection, information security, cloud computing, patient confidentiality, and applicable technical and legal controls in the State of Kuwait.

The decision prohibits relying on the outputs of these tools as the sole basis for diagnosis, treatment, prescribing, dosage calculation, test interpretation, admission/discharge decisions, referrals, triage, or predicting disease severity.

It noted that using these tools as aids can facilitate learning, organize thinking, expand possibilities, and summarize information, provided that outputs and their sources are rigorously verified and reviewed by the responsible specialist before professional or clinical use.

The Ministry highlighted that the decision classifies usage according to risk level into three categories. The first, low-risk usage, includes general drafting, translation, summarization, and preparation of non-sensitive educational or administrative materials, subject to human review. The second, medium-risk usage, involves summarizing guidelines, organizing differential diagnoses, and reviewing general pharmaceutical information, with source verification.

The Ministry added that the third category comprises high-risk usage, where AI must not be relied upon for decision-making. This includes final diagnosis, treatment selection, prescription or dosage determination, clinical triage, and decisions concerning specific patients.

The Ministry stated that health facilities, departments, and divisions are prohibited from launching, using, or promoting language tools directed at patients or the public to provide health advice, treatment information, triage services, or clinical guidance under the name of the Ministry or any of its facilities, unless a formal evaluation and approval mechanism is established. This mechanism must consider clinical, legal, and technical aspects, information security, data privacy, patient safety, and tool performance monitoring.

She noted that the decision authorized the Ministry, when necessary, to form a technical team or committee to evaluate the proposed artificial intelligence tools and models intended for official use or integration with the Ministry’s systems. The evaluation must consider risk levels, data types, privacy, cybersecurity, performance quality, verifiability of outputs, suitability for the local context, and monitoring mechanisms as well as procedures for handling errors and incidents.

She added that the decision included provisions for documentation and disclosure, emphasizing that no text generated or modified by AI tools may be copied into medical records or official reports without being read, reviewed, corrected, and approved by the responsible specialist.

The Ministry of Health stated that the decision mandates the dissemination of awareness and training materials for staff on the safe and responsible use of these tools, alongside making available public awareness materials that clarify the limitations of AI in health-related topics, including its potential to produce inaccurate, incomplete, or incorrect information, and that it does not replace consultation with a physician or health specialist or reference to approved medical sources.

It further clarified that the decision requires health facilities to report any incident, error, or suspected breach of patient privacy or unsafe use of generative AI tools, including the unauthorized entry of patient or confidential data into unapproved tools, or the use of unverified outputs that could compromise patient safety or the quality of care.