Sorting prior reports with local AI
29.10.2026 
Artificial intelligence, Consulting, Future Healthcare, Healthcare and MedTech Consulting, Industries A new patient arrives for her exam with a folder: doctors’ letters, previous reports, lab results, and a referral form. Before anyone on the team can work with these documents, they have to be scanned, sorted, and assigned to the right patient record. It’s routine work, and this is exactly where AI can help.
The National Association of Statutory Health Insurance Physicians (Kassenärztliche Bundesvereinigung, KBV) takes a similar view. According to its guidance on using AI in medical practices, AI applications can simplify administrative processes and relieve medical staff of routine tasks. Many AI systems send the data to a cloud for this. A local AI model, by contrast, runs on hardware in your practice, so patient data stays in-house while it’s being processed.
We show what this looks like in a live demo at the Southern and Central German Radiology Congress (Süd- und Mitteldeutscher Röntgenkongress) in Hof, Germany. In the demo, a local AI model sorted and structured scanned prior reports and patient documents, presented them in a clear overview, and filed them in an existing file system after a preview. Three questions help make sure that a tool like this delivers the benefit you expect in your practice: which workflow pays off most, how patient data stays protected, and how your team checks the results. This article is for practice owners, practice managers, radiologic technologists, and radiologists who want to use AI for administrative tasks.
Question 1: Where will AI pay off most in your practice administration?
Question 1: Where will AI pay off most in your practice administration?
AI pays off most for workflows that come up often and involve a lot of manual work. Three criteria help you find the right candidates:
- Frequency: How often does the task come up, per day or per week?
- Effort: How much time does a single instance take today, and who on the team handles it?
- Error risk: Where can errors happen today when documents are sorted by hand, and how quickly are they noticed?
A simple tally sheet kept over one or two typical weeks shows where AI would pay off most. It also gives you the baseline figures that you’ll use to measure the benefit later.
For cost-effectiveness, what counts is the time saved minus the time your team needs to check the results. On the other side are fixed costs, e.g., for setup, integration with existing systems, maintenance, and training. The more workflows run on the same platform, the more widely these costs are spread. A brief inventory of your administrative processes shows which workflows you can tackle together.
Our article Reimbursement pressure in radiology: Why it’s time to review your practice IT explains how to estimate the benefit of using AI in advance and how to measure it later.
Question 2: How does patient data stay protected?
Many AI systems are cloud solutions, as the KBV explicitly points out. For cloud services that process health data, Section 393 of Book V of the German Social Code (Sozialgesetzbuch V, SGB V) sets its own conditions. Processing must take place in Germany, the EU, a country with equivalent status, or a third country covered by an adequacy decision. And since July 1, 2025, the provider has generally needed a current C5 Type 2 attestation or equivalent proof based on the criteria catalog of the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI).
If the model runs on hardware in the practice network, however, patient data doesn’t leave the practice for the actual processing. The German Data Protection Conference (Datenschutzkonferenz, DSK), the joint body of Germany’s federal and state data protection authorities, states in its guidance on AI and data protection: “From a data protection perspective, technically closed systems are therefore preferable” (our translation). “Closed” here means a technically self-contained environment with a limited group of users, in which the provider doesn’t use the data for training. The questions for providers below help you check whether a local system meets these conditions.
That said, local doesn’t mean free of obligations. Three points remain, even if no data goes to a cloud:
- Remote maintenance and updates: According to the KBV, a data processing agreement (Auftragsverarbeitungsvertrag) is required whenever an external service provider can access patient or employee data. This also applies to the technician who maintains the AI computer remotely.
- Professional confidentiality: Under Section 203 of the German Criminal Code (Strafgesetzbuch, StGB), you may disclose patient secrets to service providers who assist you, as far as this is necessary for their work. If you haven’t made sure that the service provider was obligated to keep these secrets and the provider discloses one, you’re liable to prosecution yourself.
- IT security: The new computer is subject to the KBV’s IT security guideline (IT-Sicherheitsrichtlinie), like any other system. It belongs in the network diagram, updates must be installed promptly, and it must be clear who installs them. Systems that no longer receive updates must be decommissioned or run in a separate network segment.
Before you start using the system, you also need a risk assessment. If it shows a likely high risk, a data protection impact assessment under Article 35 of the General Data Protection Regulation (GDPR) is required. According to the DSK, this “will often be the case” (our translation) when AI is used. According to the KBV, you generally don’t need patients’ consent unless the data is also used to train or optimize the AI system. You should still inform patients that you use AI, e.g., with a notice posted in the practice.
Ask every provider these questions before you decide:
- Does processing take place entirely within the practice network, or does data leave it, e.g., with error reports or during updates?
- Who gets remote access, and are a data processing agreement and a confidentiality obligation in place?
- Is patient data used to train or optimize the model?
- Who installs updates for the operating system, the AI software, and the model?
- What is the software’s intended purpose, and is it labeled as a medical device?
Question 3: Who checks the result before it goes into the patient record?
The KBV puts it succinctly: In line with the EU AI Act, AI must not make decisions, and safe use always requires human oversight. For results that relate to individuals, the DSK requires a review before any further processing. For sorting prior reports, this means: No document should go into the patient record unless a person has confirmed it.
Research on automation bias shows why this check has to be designed deliberately. A systematic review by Goddard and colleagues in the Journal of the American Medical Informatics Association evaluated 74 studies on decision support systems, including 15 from healthcare and others from fields such as aviation. It describes two types of errors: Users follow an incorrect suggestion from the system, or they fail to act because the system doesn’t alert them. Workload, task complexity, and time pressure make both more likely. As countermeasures, the review names training, emphasizing the user’s responsibility, and a design that displays information rather than recommendations.
For your practice, this results in a review cycle:
- Checkpoint before filing: In our live demo, this is the preview. The documents can be checked before they’re exported in order.
- Checking against the original: The person who confirms a result compares the suggestion with the scanned document, not just with the AI’s output.
- Spot checks: Recheck documents that have already been filed at regular intervals, and record any errors.
- Feedback: Report errors to the person who maintains the system, and check again after updates or model changes.
For reviewers to know what to look for, the team needs to understand typical errors. This is also an obligation: Since February 2, 2025, Article 4 of the EU AI Act has required providers and deployers of AI systems to take measures that ensure AI literacy among their staff. Under the version in force since July 2026, these measures are meant to support the development of AI literacy, and no one has to guarantee a specific level. Our article The EU AI Act by industry shows how the EU AI Act affects individual industries.
That leaves the question of the Medical Device Regulation (MDR). Whether software is a medical device depends on the intended purpose that the manufacturer assigns to it. The guidance document MDCG 2019-11 Rev. 1 from the Medical Device Coordination Group (MDCG) names storage, archiving, communication, and simple search as functions that, on their own, don’t make software a medical device. If, on the other hand, software processes or interprets medical information for a medical purpose, it may fall under the MDR. So ask the provider to confirm the intended purpose in writing. Our page Quality assurance for AI systems describes how we test AI systems in regulated environments.
Conclusion: Process first, then the model
A local AI model answers the question of where the data is processed, and with it, an important part of the data protection question. Whether the investment pays off and whether the results reliably end up in the right record is up to the practice itself: with a measured process, clear rules for service providers, and a review cycle that the team knows. If you answer these three questions before you buy, you can use AI in your administration in a targeted way and demonstrate its benefit.
Would you like to go through a specific process in your practice with us? Talk to us.
FAQ
What matters is whether an external service provider can access patient data, e.g., during remote maintenance or updates. If so, the KBV says one is required.
Generally not, as long as the data is only used for patient care. You should still inform them, e.g., with a notice posted in the practice.
Yes, as it does to every system in the practice network: network diagram, prompt updates, and a defined data backup process.
Results that relate to individuals should be checked before further processing. Approval before filing and regular spot checks make this manageable in everyday work.
That depends on the manufacturer’s intended purpose. Ask the provider about it before you decide.
Sources
- Bundesministerium der Justiz. (n.d.). § 203 StGB: Verletzung von Privatgeheimnissen [Section 203 of the German Criminal Code: Violation of private secrets]. Gesetze im Internet. In German.
- Bundesministerium der Justiz. (n.d.). § 393 SGB V: Cloud-Einsatz im Gesundheitswesen [Section 393 of the German Social Code, Book V: Use of cloud services in healthcare]. Gesetze im Internet. In German.
- Datenschutzkonferenz. (2024, May 6). Orientierungshilfe Künstliche Intelligenz und Datenschutz [Guidance on artificial intelligence and data protection] (Version 1.0). In German.
- European Parliament & Council of the European Union. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act), amended by Regulation (EU) 2026/1744.
- Goddard, K., Roudsari, A., & Wyatt, J. C. (2012). Automation bias: a systematic review of frequency, effect mediators, and mitigators. Journal of the American Medical Informatics Association, 19(1), 121–127.
- Kassenärztliche Bundesvereinigung. (2025, December). Künstliche Intelligenz: Hinweise zum Einsatz in Praxen [Artificial intelligence: Guidance on use in medical practices] [PraxisWissen]. In German.
- Kassenärztliche Bundesvereinigung. (n.d.). IT-Sicherheitsrichtlinie, Anlage 1: Anforderungen für Praxen [IT security guideline, Annex 1: Requirements for practices]. In German.
- Medical Device Coordination Group. (2025, June). MDCG 2019-11 Rev. 1: Qualification and classification of software. European Commission.
