Patient-facing AI triage sits at the highest end of ADM risk
AI symptom-triage tools and care-pathway recommendation systems combine special-category health data with decisions that can materially affect patient safety and access to care. As NHS-wide AI triage rolls out, HealthTech providers need a rigorous, evidence-backed assessment — one built for legal and clinical review, not a self-service checklist.
Rapid NHS adoption is raising the compliance bar, not lowering it
NHS England is accelerating AI rollout, including a new AI triage tool in the NHS App expected to reach over 200,000 patients within twelve months and all app users by 2028. This scale of deployment means digital-health providers face growing scrutiny of exactly how their triage or eligibility models reach a recommendation, and what role a clinician genuinely plays before that recommendation reaches a patient.
Symptom-triage chatbots, eligibility-scoring tools and care-pathway recommendation engines process health data — special-category data by definition — placing them squarely within the Article 22B regime. A permitted route (explicit consent, or contract/legal-authorisation necessity plus a substantial public interest condition) must be documented before any significant solely automated decision can proceed, and clinical sign-off must be shown to be genuinely capable of changing the system's output, not a formality layered on top of it.
A symptom-triage chatbot recommending urgent-care pathways
A digital-health provider's chatbot assesses patient symptoms and recommends whether a patient should seek emergency care, book a GP appointment, or self-manage. A clinician reviews only a sample of flagged high-risk cases; the majority of recommendations reach patients directly. Illustrative example — not a real client or verified statistic.
Most triage recommendations reach patients with no clinician in the loop and no documented legal basis.
The triage decision is classified, a permitted Article 22B route is documented, and escalation routes to clinical review are evidenced.
Where to start
- Classify the triage/recommendation function against Article 22A and 22B given its reliance on health data.
- Document the specific Article 9 and substantial-public-interest condition relied on, with clinical and legal sign-off.
- Evidence that any clinician review is capable of changing the recommendation, not a retrospective spot check.
- Complete a DPIA addressing patient-safety risk alongside standard data-protection risk, and route unresolved cases to legal/clinical review rather than self-certifying.