How do you keep patient data governed when using AI?

The risky pattern is handing a general-purpose model a wide copy of patient records and trusting it to behave. Governance replaces that with scope. Each task — drafting a report, suggesting a code, summarising a visit — gets only the minimum context it needs, pulled from the systems of record rather than copied into a separate store. Access is least-privilege and time-bound, so no model and no person sees more than their task requires.

The second half of governance is accountability. Every AI action is written to an audit trail an administrator can inspect: what was read, what was produced, who reviewed it, and when it was signed. A clinician remains the decision-maker at each checkpoint, which is why this is governed healthcare AI rather than autonomous AI — the software proposes and records; the clinician reviews and decides. Data residency, encryption in transit and at rest, and alignment with regimes like Indonesia's UU PDP, Singapore's PDPA and Hong Kong's PDPO are the baseline that sits underneath all of it.