Safe everyday use of AI tools in healthcare: a practical guide

AI tools can help with general learning, summarising public guidance, or preparing a first draft. They can also produce confident errors and expose information you did not mean to share. A few steady habits help clinicians use them more safely. This is practical guidance, not legal advice; requirements vary by employer and jurisdiction.

Start with information that cannot identify a patient

For a general explanation, ask a non-identifying question such as, “What should clinicians consider when explaining a new diagnosis in plain language?” Generic educational prompts and synthetic examples (made-up cases) are usually the safest starting points. Use them only where your workplace policy permits and the tool is approved for that purpose.

Do not enter patient names, phone numbers, addresses, record or national identity numbers, exact dates, or images and documents that contain identifiers into an unapproved tool. Avoid combinations of details that could point to one person. Removing a name alone may not be enough: age, a small location, a rare condition, dates, or an unusual event can identify someone when combined. De-identification reduces risk; it does not guarantee anonymity. The Nigeria Data Protection Act 2023 and the NDPC’s General Application and Implementation Directive 2025 provide Nigeria’s data-protection framework, including principles and safeguards for handling personal data. Which obligations apply to a particular workflow depends on its circumstances.

Use the right tool for the job

Use only a tool your healthcare organisation has approved for the intended information and task. Approval for public education material does not automatically mean a tool is approved for patient records, clinical notes, or images. Follow your organisation’s policy, access controls, applicable law, and any patient-consent requirements that apply to the workflow. In Nigeria, check current NDPC guidance as well as the Act; outside Nigeria, follow the rules that apply where you practise and where the information is processed.

Never paste a confidential record into an unapproved tool just to “test” what it can do. For demonstrations or staff training, use synthetic cases or examples that have been properly de-identified under your organisation’s process.

Keep a clinician in control

Treat AI output as a draft, not a finding. It may omit a relevant detail, introduce a fact that was never supplied, or make a plausible-sounding mistake. Before using or recording anything, check it against the source record, correct errors and omissions, and apply your professional judgment. Do not let AI make or document a clinical decision that a clinician has not verified. The World Health Organization’s 2024 guidance on AI for health stresses human oversight and accountability alongside the potential benefits of generative AI.

For example, an AI-generated visit summary can be a useful first draft, but the responsible clinician should confirm medicines, allergies, dates, examination findings, and the plan before it enters the record or is shared with a patient.

If information goes into the wrong tool

Act promptly and calmly:

1. Stop entering information and do not share the conversation or output further.
2. Follow your organisation’s incident-reporting process, even if you are unsure whether the information was retained or viewed.
3. Contact the appropriate privacy or security lead and provide the facts they need, such as the tool, time, and type of information involved. Follow their instructions about next steps.

Before you paste

Ask yourself:

1. Is this prompt free of details that could identify a patient?
2. Is this tool approved for this information and purpose?
3. Have I removed unnecessary detail and checked the relevant policy or consent requirements?
4. Will I verify the output against the record before using it?

Sources

• Nigeria Data Protection Act 2023 — Nigeria Data Protection Commission, enacted 2023.
• General Application and Implementation Directive 2025 — Nigeria Data Protection Commission, issued 20 March 2025; effective 19 September 2025.
• Ethics and governance of artificial intelligence for health: guidance on large multi-modal models — World Health Organization, 2024.