LLMs and Legal Design for Health Data Access

Access to a health record and understanding it are different outcomes. Legal design can help identify barriers in the patient's journey; an LLM may help draft explanations or prototypes. Neither a readable summary nor an attractive interface proves that the information is clinically accurate or that access rights have been fulfilled.

The 2025 chapter by Kovalainen and de Heer on LLMs and health-data access explores this combination as a design approach. Its public abstract describes possibilities, not established patient outcomes. The practical question is which improvements can be demonstrated without losing clinical meaning or control over data.

Separate current rights from phased EHDS requirements

GDPR Articles 12 and 15 govern clear communication and access to personal data under their conditions. They do not require every provider to use an LLM. Other rights, including restriction and portability, have their own scope and conditions.

The European Health Data Space Regulation, Article 105, entered into force on 25 March 2025 and applies generally from 26 March 2027, with significant later phases. The relevant access provisions for patient summaries, electronic prescriptions and dispensations apply from 26 March 2029. The corresponding phase for medical imaging, test results and discharge reports begins on 26 March 2031. Each phase applies only from its date, so check which phase applies on the date of your assessment.

Article 3 addresses access to at least the specified priority categories through access services, with technological practicability and permitted restrictions to consider. Its readable-format requirement should not be turned into an unsupported rule that every original clinical record must be replaced by a personalised AI explanation. Preserve the original record and assess any explanatory layer separately.

Readability gains can coexist with safety problems

In Zaretsky and colleagues' 2024 study of 50 discharge summaries, LLM rewrites improved readability and assessed understandability. Physician reviewers also found omissions and inaccurate statements raising safety concerns. The study evaluated documents; it did not demonstrate better patient health outcomes or reliable independent use across languages and settings.

That distinction should shape the pilot. Test clinical accuracy, completeness and actual user comprehension alongside readability scores. A shorter sentence can still omit a medication qualification or follow-up instruction. An automated reading grade is not a clinical safety test.

Use the design process to investigate, not assume

The Design Council's Double Diamond provides a process for exploring a problem, defining it, developing options and testing delivery. It does not establish the effectiveness of a particular health application.

LLMs may propose interview questions, organise approved notes or draft alternative wording. Synthetic personas are design aids, not evidence of what real patients need. Include patients directly and check whether participation reflects the people who will use the service.

Make data handling and classification explicit

Health data generally engages GDPR Article 9 when the GDPR applies. Identify an Article 6 basis and an Article 9 condition, the controller and processors, access, retention and relevant transfers. Assess whether a DPIA is required. Neither GDPR nor EHDS creates a universal rule that every LLM must run on premises; the actual processing and safeguards need legal and technical assessment.

A health-data interface is not automatically a high-risk AI system solely because it handles health information. Under the AI Act, Articles 2 and 6, examine scope, intended purpose, any regulated-product connection and listed uses. An explanation tool and a clinical decision system may raise different classification questions.

For Swiss work, assess the FADP, healthcare confidentiality and applicable sectoral or cantonal requirements separately. Under FADP Article 5 letter c, health data are sensitive personal data, and Article 22 names their large-scale processing as a case of high risk that requires a prior data protection impact assessment, subject to the exemptions for private controllers in Article 22(4) and (5). The FADP applies to private persons and federal bodies; records held by cantonal public bodies, such as many public hospitals, generally fall under cantonal data protection law. Where the FADP applies, the right of access in Article 25 covers health data, which may be communicated through a health professional the person designates, with their consent. The FDPIC confirms that existing data protection law applies to AI. Serving an EU resident does not by itself activate every EHDS duty or resolve the cross-border analysis.

The electronic patient record under the EPDG, SR 816.1 (German text) is the closest Swiss counterpart to the EHDS access services, and it is voluntary for patients: it requires their express consent, which they can revoke at any time, and they can access their own data. A bill for a new act on the electronic health record (EGDG), which is to replace it, was adopted by the National Council on 14 September 2026 (German text) and now goes to the Council of States. Until the new act enters into force, the EPDG applies.

Swiss regulatory status (checked 26 September 2026). Switzerland has no AI-specific legislation yet. On 12 February 2025 the Federal Council decided that Switzerland should ratify the Council of Europe AI Convention, which applies primarily to state actors, and that sector-specific work should continue, for example in healthcare. The Federal Department of Justice and Police is to prepare a consultation draft by the end of 2026, in particular on transparency, data protection, non-discrimination and supervision. Switzerland signed the Convention on 27 March 2025. When this was checked, the Federal Office of Justice (German text) did not yet list a published draft.

Define the evidence for release