Handling patient messages on WhatsApp without breaking privacy law

What turns a WhatsApp message into sensitive data

The content, not the channel.

Handling patients on WhatsApp, and the personal data that moves with it, is a subject that usually surfaces the day somebody sends a photo of a test result. It starts earlier than that: a person's name next to the name of a medical speciality already says something about their health.

In Argentina the framework is Law 25.326 on the protection of personal data, enforced by the Agency for Access to Public Information (AAIP). Health data gets stricter treatment than the rest. In your country the statute will have another name; the line it draws is the same one.

What patient-rights law adds

The medical record belongs to the patient. Not to the institution that stores it.

Argentina's Law 26.529 governs patient rights and the medical record, and binds to confidentiality everyone who takes part in producing or handling it. Whoever administers that information is its custodian, not its owner.

Translated into everyday conversation: a reply that reveals clinical content to somebody who is not the patient is a legal problem, not a customer service slip.

The practical rule for sorting queries

One question is enough: does the answer say anything about a specific person's health?

Type of query	Example	Can it be automated
Institutional	Opening hours, locations, insurers accepted	Yes
Test preparation	Fasting, what to bring, how long it takes	Yes
Administrative requirements	Referral, paperwork, authorisations	Yes
Coverage and fees	What each plan covers, what you pay	Yes
Clinical content	Results, diagnoses, instructions	No
Data about a specific patient	What was done, when, with whom	No

The first four carry most of the volume and none of them touch sensitive data. The last two are not automated, and that is not a technical limitation: it is the line between informing and practising.

What automated handling actually solves in healthcare

The repeated questions, which in this sector are almost all of them.

How to prepare for a test gets explained the same way every day. An insurer's requirements do not change from one patient to the next. Addresses, opening hours and what paperwork to bring get answered fifty times a week.

All of that is answered from your own documents: the instruction sheet you already wrote, the coverage list, the preparation protocol. The answer comes out of the text you uploaded, not out of what a model happens to know about medicine.

What has to reach a person, always

Four cases, no nuance.

1. Any clinical query. Symptoms, interpretation, what to do.
2. Any request about a specific patient, however administrative it looks.
3. An emergency, real or perceived.
4. A complaint, which is almost never about what it says it is.

The handoff has to be fast and unargued. And it pays to have the reason for the handoff written down, since that is the one action whose motive gets recorded.

Saying there is an automated system on the other side

In healthcare this weighs more than in any other sector.

Argentina's regulatory approach points towards transparency about the use of automated systems, and the AAIP published a guide on the responsible use of artificial intelligence that moves in that direction. Most privacy regimes are converging on the same expectation.

On the practical side: somebody asking about a health matter who finds out late that they were talking to a system feels deceived at the worst possible moment. Saying it up front does not lower satisfaction, it raises it.

The questions for your vendor, healthcare edition

The same ones as any purchase, plus two this sector needs.

• Do you use conversations to train models? The answer has to be no.
• Who on your side can read them?
• Can we sign a confidentiality agreement?
• Can topics be forbidden, so clinical questions are never answered?
• Is there a record of what was answered and what was handed off?

If the vendor does not understand why the last two are different from the rest, they do not know the sector.

The two limits this sector asks about first

Both come up in the first meeting, so they go here.

We do not read the content of images or video: if a patient sends a photo of a referral, the arrival of the image is detected, what it says is not read. Audio is transcribed and kept as an internal note.

And clinical judgement is nobody's but a professional's. What we do is answer what is already written in your documents and take the rest to a person.

Key takeaways

• In healthcare, what makes a message sensitive data is the content, not the channel.
• In Argentina the framework is Law 25.326, enforced by the AAIP; elsewhere the name changes and the criterion does not.
• Patient-rights law establishes that the medical record belongs to the patient.
• Institutional questions, test preparation, requirements and coverage automate well.
• Nothing clinical and nothing about a specific patient gets automated.
• Disclosing that there is an automated system is both a regulatory expectation and common sense.