AI documentation in the Swiss medical practice: revDSG, medical secrecy and data flow
A Swiss practice may use AI for documentation. With a local model nothing leaves the practice computer, and consent to the recording is enough. If the transcript text goes to an AI provider in the EU, the practice also needs the patient's documented consent and a processing contract that expressly covers professional secrecy.
Reviewed editorially against the cited primary sources; not individual medical or legal advice.
Legal position as of 25 September 2026, read in Fedlex and the cantonal law collections. This overview is general information, not legal advice. KiPT Voice is currently available to practices in Germany.
Two routes: a local model or an AI provider in the EU
AI documentation produces three kinds of data: the audio recording, the transcript and the draft note. Under Swiss law what matters is whether any of it leaves the practice.
If the language model runs locally, everything stays on the practice computer. If only the transcript text goes to an AI provider in the EU, professional secrecy and the rules on apply as well.
| Question | Local model | AI provider in the EU |
|---|---|---|
| Recording the conversation | Consent under Art. 179ter StGB | Consent under Art. 179ter StGB |
| Does text leave the practice? | No | Yes, only the transcript text |
| Professional secrecy (Art. 321 StGB) | Not engaged, nothing is disclosed | Obtain consent |
| Disclosure abroad | None | Permitted, the EU is listed in Annex 1 DSV |
| Contract with the provider | Not needed | Processing contract under Art. 9 DSG |
Read in the Federal Classified Compilation (Fedlex).
Medical secrecy: auxiliary person or consent
Art. 321 StGB punishes physicians and their who disclose a secret entrusted to them. Disclosure with the patient's consent is not punishable. The article contains no rule on outsourcing to IT providers.
The Federal Council's on the revised Data Protection Act states that a processor who counts as an auxiliary person needs no additional consent. The Federal Supreme Court accepted a law firm's external storage provider as an auxiliary person (2C_1083/2017). The Zurich health directorate, by contrast, treats software providers as third parties in its guidance and asks for consent before treatment.
What the Data Protection Act requires
Health data is . Four articles of the DSG decide the route through an AI provider.
- Art. 9 DSG: processing may be delegated unless a secrecy duty forbids it. The practice checks the provider's data security; sub-processors need its prior approval.
- Art. 16 DSG: disclosure abroad is permitted if the Federal Council lists the state as adequate. EU states are in Annex 1 DSV.
- Art. 19 DSG: patients learn who receives the data and in which state.
- Art. 22 DSG: extensive processing of sensitive data with new technology requires a data protection impact assessment.
Cantons: no outsourcing rule of their own
The cantonal health laws restate the duty of confidentiality but do not regulate outsourcing to IT providers or prescribe where data must be stored. Cantonal data protection laws cover public bodies; private practices fall under the federal DSG.
| Canton | Provision | Outsourcing to IT providers | Data location |
|---|---|---|---|
| Zurich | § 15 GesG: auxiliary persons bound, consent releases | No rule in the law; the health directorate's guidance asks for consent | No requirement |
| Bern | Art. 27 GesG: silence towards third persons | No rule | No requirement |
| Aargau | §§ 19 and 21 GesG: auxiliary persons bound, consent releases | No rule | No requirement |
| St. Gallen | Ordinance 312.0, Art. 14 to 19 | No rule | No requirement |
| Basel-Stadt | §§ 26 and 27 GesG: auxiliary persons bound | No rule | No requirement |
| Lucerne | §§ 22 to 26 GesG | No rule | No requirement |
Read in the cantonal law collections; implementing ordinances only for St. Gallen.
How a practice sets up the route through an EU provider
These steps document the route through an AI provider in the EU cleanly. A practice that does not want it chooses the local model and needs only the first step.
Frequently asked questions
May a Swiss practice send transcripts to an AI provider in the EU?
Yes, if the patient consented beforehand and a processing contract covers professional secrecy. The transfer to the EU itself is permitted under Art. 16 DSG because EU states are listed in Annex 1 DSV.
Does AI documentation breach medical secrecy under Art. 321 StGB?
Not with a local model, because nothing is disclosed. For an external provider it is disputed whether it counts as an auxiliary person. With the patient's consent the disclosure is not punishable.
Does consent have to be in writing?
The law prescribes no form. According to the Federal Supreme Court it must be prior, informed and voluntary (2C_37/2018). Written consent, or consent logged in the system, makes it provable.
May I record the conversation with patients?
Only with the consent of everyone taking part. Art. 179ter StGB also punishes participants who record a non-public conversation without the others' consent.