These Danish hospital departments shared confidential patient data in AI project

Region Hovedstaden and Region Sjælland shared confidential patient data from more than 100,000 messages in an artificial intelligence project without informing the affected patients. The initiative involved sensitive health information being processed in what experts characterize as an unlawful AI test project.

The involved departments span several medical specialties across the healthcare system. Rigshospitalet contributed the largest share of data, accounting for nearly 40 percent of the total project. Other participating units included a clinic for child and adolescent psychiatry, a cancer department, a cardiology department, and a pain clinic.

The project bypassed standard legal requirements regarding data handling. The authorities did not fulfill their mandatory notification duties under GDPR, failed to obtain proper consent or legal basis for processing sensitive health data, and breached confidentiality rules outlined in the Danish Health Act by transferring private medical details to an external tool without patient knowledge.