AI Phone Assistant for Medical Practices: 2026 Guide to Section 203 StGB, GDPR and the AI Act

In hardly any other sector is the phone such a bottleneck as in a medical practice: it rings in waves while patients wait at the desk, and every unanswered call means a callback, a missed appointment or an annoyed patient. An AI phone assistant can ease this bottleneck - if it is properly scoped and legally sound. This guide shows what is realistic, where the limits are, what criminal law, data protection law and the AI Act require, and how the costs arise.

Key takeaway: An AI phone assistant answers calls around the clock, books and reschedules appointments, records prescription requests and answers organisational standard questions. It does not replace medical advice or triage. Legally, three sets of rules apply at once: Section 203(3) sentence 2 of the German Criminal Code has expressly permitted engaging external providers since 2017, but requires them to be bound to secrecy; a practice that omits this commits an offence itself under Section 203(4) sentence 2 no. 1. The GDPR requires a data processing agreement and a legal basis under Article 9(2)(h), usually also an impact assessment. The EU AI Act has required disclosure that an AI is speaking since 2 August 2026; if the assistant sorts calls by urgency, the high-risk obligations can apply from 2 December 2027. Plain appointment booking does not fall under them.

Why is the phone the biggest bottleneck in medical practices?

Because calls come in waves and the same person is supposed to answer them while attending to patients at the front desk. Every practice knows the result: busy lines when consultation hours open, callback loops and a team jumping between desk and telephone all day.

The economic damage is twofold: unanswered calls create extra work later (callbacks, rescheduling, no-shows), and staff spend a significant share of their time on enquiries that require no medical qualification - opening hours, appointment changes, prescription orders.

What can an AI phone assistant handle in a practice - and what not?

It handles organisational tasks, not medical ones. This boundary is the decisive point when introducing it - and it should be drawn deliberately narrowly, because it also determines the legal classification.

Emergencies are the most important special case. At the start of the call the assistant points to the emergency number 112 and the on-call medical service 116 117, and forwards immediately on any corresponding indication rather than assessing it itself. A system exercising judgement here would not only be risky but a completely different regulatory matter.

Relief comes exactly where these organisational calls run automatically, while medical concerns still go to the team.

May a medical practice use an AI phone assistant at all?

Yes. Since the 2017 reform of Section 203 of the German Criminal Code, engaging external service providers has been expressly permitted. Before that the legal position was unsettled, and practices operated in a grey area with every IT provider. The governing sentence in Section 203(3) reads:

"The persons named in subsections 1 and 2 may disclose third-party secrets to other persons who assist in their professional or official activity, insofar as this is necessary in order to make use of the activity of those other assisting persons."

Four words carry the entire weight: "insofar as this is necessary". They limit what the assistant is allowed to hear. A system that books appointments needs a name, contact details and a rough indication of the matter. It does not need a diagnostic history. Transmitting more than necessary leaves the scope of the permission, even where the contract is sound.

The same provision applies to tax advisers, supplemented there by Section 62a of the Tax Advisory Act. We have described how the assessment works out in a tax firm bound by professional secrecy separately.

Why does liability fall on the practice rather than the provider?

Because Section 203(4) contains two separate offences. Sentence 1 targets the assisting person, meaning the provider, where its staff disclose a secret. Sentence 2 no. 1 targets the practice, and it targets an omission: failing to ensure that the service provider was bound to secrecy.

This is the point that provider documentation rarely highlights. Binding the provider is not a service the provider performs; it is a duty of the practice. It cannot be delegated, and it arises regardless of whether anything has gone wrong.

The fourth row deserves attention. Where the provider itself engages subcontractors, for instance a cloud operator for speech recognition, it must bind those too. The statute extends the chain expressly: "the same applies to other assisting persons where they make use of further persons". Practices should ask to see the whole chain, not just the first contract.

What must the contract contain to satisfy Section 203?

Four elements, drawn from case law and the commentary on the reform. They are quickly checked, and their absence is immediately apparent.

First, a concrete contractual relationship describing the assistance with the medical activity. A general software licence does not qualify. Second, a limitation of the activity to that purpose. Third, a written undertaking by every person at the provider who may access the data, binding them to secrecy under Section 203 specifically, not merely to data confidentiality under the GDPR. These are two different things, and confusing them is the most common defect. Fourth, continuation of that undertaking along the entire subcontracting chain.

A practical test: ask to see the undertaking that a developer or support agent at the provider has actually signed. If it refers only to "data confidentiality" or cites Article 28 GDPR, the criminal-law layer is missing.

Is an AI phone assistant in a medical practice GDPR-compliant?

Yes, but the requirements are higher than in other sectors. Health data falls under Article 9 GDPR as a special category of personal data and is in principle excluded from processing. Practices rely on the exception in Article 9(2)(h): processing for the purposes of health care and the management of health care systems, which covers appointment organisation. That exception is tied to Article 9(3), which requires the data to be processed by staff subject to an obligation of professional secrecy.

This is where the circle closes back to criminal law. The GDPR basis holds only if the duty of secrecy has been passed through to the service provider. A clean processing agreement without the Section 203 undertaking leaves a gap that affects both regimes. A common error is also to invoke patient consent under Article 9(2)(a): consent would have to exist before processing begins, but the call begins with processing.

Four requirements must be met in practice:

• Processing and hosting in the EU, with a data processing agreement under Article 28 GDPR and all sub-providers bound to confidentiality.
• Data minimisation: the assistant records only what is needed for scheduling - no conversation about symptoms, no storage of medical details.
• Transparency: callers are informed at the start that they are speaking with an AI assistant and how their data is processed.
• Deletion policy: call data is stored only for its purpose and automatically deleted after a defined period.

Where the AI model itself may run so that secrecy holds technically is covered in LLM hosting under Section 203 StGB.

When is a data protection impact assessment mandatory?

As a rule, for large-scale processing of health data. Under Article 35 GDPR an impact assessment is required where processing is likely to result in a high risk to the rights of data subjects, and paragraph 3(b) expressly names large-scale processing of special categories under Article 9. Supervisory authorities additionally publish lists of processing operations for which an assessment must always be carried out.

In practice this means: a single-doctor practice whose assistant only takes a name, a phone number and a requested slot sits differently from a medical care centre processing calls for several locations including the nature of the request. That line should be drawn before launch rather than after, because an assessment carried out late can call the running operation into question. The assessment itself and coordination with your data protection officer remain the practice's responsibility; the provider should supply the technical documentation for it, which does not replace the review.

What belongs in the patient record and what does not?

Section 630f of the German Civil Code requires documentation of the treatment in direct temporal connection with it. Organisational call notes from a phone assistant are not treatment documentation and do not automatically belong in the record. Conversely, a request that does turn out to be treatment-relevant must not get stuck in the assistant system. That calls for a clear rule on which notes are transferred and which are deleted once the retention period expires.

When does the assistant become a high-risk system under the AI Act?

When it assesses calls by urgency or decides on urgent slots. The obligations for high-risk systems under Annex III of the EU AI Act were originally due to apply from 2 August 2026; the Digital Omnibus (Regulation (EU) 2026/1744) moved that date to 2 December 2027. The classification itself is unchanged, and anyone choosing a system today should know it. Annex III no. 5(d) covers AI systems intended to evaluate and classify emergency calls, to dispatch or prioritise emergency response services, and systems for emergency healthcare patient triage.

Article 6(3) of the AI Act offers an exemption: an Annex III system is not high-risk where it poses no significant risk, because it performs a narrow procedural task, improves the result of a previously completed human activity, detects decision patterns without replacing the human assessment, or performs a preparatory task. One qualification removes that exemption again: where the system performs profiling of natural persons, it remains high-risk in every case. An assistant that categorises callers on the basis of earlier contacts should be examined on this point. Anyone relying on the exemption must document the assessment before the system goes into operation.

Does the caller have to be told they are speaking to an AI?

Yes, and this duty applies regardless of the high-risk question. Since 2 August 2026, Article 50(1) of the AI Act has required people to be informed that they are interacting with an AI system unless this is obvious from the circumstances. On the phone it is precisely not obvious, because modern voice systems sound natural.

The information belongs at the start of the call, not in a privacy notice on the website. One sentence is enough, and it should be plain rather than legalistic; the information on data processing under Article 13 GDPR can be combined with it. Details are in our article on the Article 50 disclosure duty; the AI literacy duty under Article 4, in force since February 2025, also covers the practice staff who look after the assistant. The general framework is summarised in our EU AI Act guide for SMBs.

How does the assistant reach the practice management system?

Through an interface to the practice management system, where its maker offers one. This is where many projects fail, and not for legal reasons but technical ones. The 2025 survey by the Central Research Institute of Ambulatory Health Care, covering more than 3,100 practice owners and medical care centre directors, paints a clear picture of the starting position: usability across the 32 practice management systems examined averages 63.1 out of 100 points, a third of practices are considering a switch, and 40 percent complain about poor support availability.

With an interface, the assistant books, reschedules and confirms appointments without double entry and records callback requests in a structured way for the team. Whether one exists is decided by the maker of the management system, not by the provider of the assistant. Three questions settle this before any contract is signed: is there a documented interface for appointments? Is it supported by the maker, or addressed through an unofficial route? And is the interface operator likewise bound under Section 203, if it gets to see data?

Where no interface exists, the assistant remains an intake system: it records the matter and hands it over to the team in structured form. That is less than marketing claims promise, but it relieves the load and is legally straightforward, because nothing is written back.

What does an AI phone assistant cost for a medical practice?

In terms of cost, an AI phone assistant usually has two line items: a one-off amount for dialogue design, telephony integration and calendar connection, and running costs for operation, monitoring and maintenance. For practices the billing model matters more than the level: a flat-rate assistant does not cost more during a flu season, while per-minute billing rises with call volume.

Comparing the alternatives is worthwhile: an external answering service with people usually bills per minute and becomes expensive at high volume; voicemail costs almost nothing but creates callback work instead of preventing it. Details are in our AI phone assistant vs. answering service cost comparison.

How does implementation work in a practice?

In four steps, with a test phase before the assistant takes real calls. The order is not arbitrary, because each step determines the next:

1. Intended purpose and scoping: which concerns may the assistant handle, where is it forwarded immediately? This decision is recorded in writing, because it also determines the classification under the AI Act.
2. Contracts and undertakings: data processing agreement, undertakings under Section 203 StGB for the provider and its subcontractors, clarification of the interface to the practice management system.
3. Dialogue design, integration and testing: conversation flow, the AI disclosure and emergency notice, connection to the phone system (SIP) and calendar; the practice team tests typical calls before the number goes live.
4. Go-live and fine-tuning: launch, monitoring of the first weeks, adjustment of answers.

Which documents should the practice keep on file?

Six. They can be assembled in an afternoon if the provider cooperates, and their absence is the first thing an audit notices.

What differs for medical care centres and hospital outpatient clinics?

The criminal-law position is the same; the organisational one is not. Section 203(1) no. 1 attaches to the person of the doctor, not to the legal form. In a medical care centre the duty under subsection 4 sentence 2 no. 1 therefore falls on the medical director, not on the holding company.

From this follows a practical point that is often overlooked: a framework contract between the holding company and the provider does not automatically discharge the binding duty for every employed doctor. The undertaking has to reach the people to whom the secret was entrusted.

Hospital outpatient clinics are additionally subject to the relevant state hospital act, which may contain its own rules on data processing and varies in strictness between federal states. For multi-site group practices, it must be clarified whether the assistant merges data across locations, because that is a disclosure in its own right and must again be measured against necessity.

What applies to practices in Austria and Switzerland?

The three layers stay the same: criminal law, data protection and AI regulation. Only the provisions have different names.

Austria. The medical duty of confidentiality is laid down in Section 54 of the Medical Practitioners Act 1998 (Ärztegesetz) and expressly binds auxiliary persons as well. Under criminal law Section 121 of the Austrian Criminal Code protects secrets about a person's state of health; assistants are treated like the professionals themselves, and the offence is prosecuted only with the authorisation of the injured party. For data protection the GDPR applies as in Germany, supplemented by the Austrian Data Protection Act. The AI Act applies directly and with the same dates: disclosure under Article 50 has been mandatory since 2 August 2026, the high-risk obligations under Annex III apply from 2 December 2027.

Switzerland. Doctors are in the catalogue of Art. 321 of the Swiss Criminal Code, and their auxiliary persons are expressly included. A breach of professional secrecy is punished on complaint with a custodial sentence of up to three years or a monetary penalty. Under Art. 5 of the Federal Act on Data Protection (FADP) health data are sensitive personal data. Art. 9 FADP permits outsourcing to a processor only if no statutory or contractual duty of confidentiality prohibits it, and requires the practice to satisfy itself that the provider can guarantee data security. If the server is located abroad, Art. 16 FADP applies in addition.

Switzerland does not yet have an AI statute with a disclosure duty like Article 50. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI Convention, and a consultation draft is due by the end of 2026. A practice that nevertheless tells callers at the outset that they are speaking to a digital assistant acts with foresight and can combine the notice with the information on data processing under Art. 19 FADP. Whether an external provider counts as an auxiliary person within the meaning of Art. 321 in Switzerland should be settled with the professional body or a specialist lawyer before deployment.

Do patients accept an AI phone assistant?

Yes, if two conditions are met: the assistant transparently introduces itself as an AI assistant, and it actually resolves the request. Someone who finally gets through after three busy signals and has an appointment within 90 seconds is more likely to experience this as an improvement than as being fobbed off.

It becomes critical when a system pretends to be human, or when it cannot resolve a request and offers no handover. That is why a clear path to a human belongs in every dialogue - available at the caller's request at any time. An overview of all agent types is in Which AI agents exist.

Frequently asked questions about AI phone assistants in medical practices

May a medical practice use an AI phone assistant? Yes, for organisational tasks such as scheduling, prescription requests and general information. Since 2017, Section 203(3) sentence 2 of the German Criminal Code has expressly permitted external service providers to assist in medical activity, insofar as this is necessary for their service. The condition: the provider and its subcontractors must be bound to secrecy. Medical advice and triage remain excluded.

How are emergencies handled? At the start of the call the assistant points to the emergency number 112 and the on-call service 116 117 and forwards immediately on any corresponding indication rather than assessing it itself. Triage by the AI deliberately does not take place.

Who is criminally liable if patient data leaks? Both sides, for different reasons. The provider under Section 203(4) sentence 1 where its staff disclose a secret. The practice under Section 203(4) sentence 2 no. 1 where it failed to bind the provider to secrecy. In each case the penalty is up to one year of imprisonment or a fine.

Is a data processing agreement under Article 28 GDPR sufficient? No. The processing agreement satisfies data protection law, not criminal law. The Section 203 undertaking is a separate declaration with its own addressees: everyone at the provider who may access the data. Binding them to general data confidentiality does not meet the requirement.

Is an AI phone assistant a high-risk system under the EU AI Act? It depends on the intended purpose. Appointment booking, prescription intake and callback notes fall outside Annex III. If the assistant sorts calls by urgency or decides on urgent slots, it approaches Annex III no. 5(d) on emergency call assessment and patient triage. The classification must be documented before deployment.

Do I have to tell patients an AI is on the line? Yes. Article 50(1) of the EU AI Act requires the information unless it follows from the circumstances. With natural-sounding voice systems it does not. A plain sentence at the start of the call satisfies the duty; a note in the website privacy policy does not. The information on data processing under Article 13 GDPR comes on top.

Do we need a data protection impact assessment for the phone assistant? Often yes. Article 35(3)(b) GDPR names large-scale processing of health data expressly as a case requiring an assessment, and supervisory authorities publish supplementary lists. A single-doctor practice whose assistant only takes a name, phone number and requested slot is assessed differently from a medical care centre with several locations. The line should be drawn before launch, because an assessment carried out late can call the running operation into question.

Do the assistant's call notes belong in the patient record? Organisational notes do not. Section 630f of the German Civil Code requires documentation of the treatment, and booking an appointment is not treatment. Conversely, a request that does turn out to be treatment-relevant must not get stuck in the assistant system. That calls for a defined rule on which notes are transferred to the record and which are deleted once the retention period expires.

What does an AI phone assistant cost for a practice? It costs a one-off setup for dialogues, telephony and calendar integration plus running operating costs. What matters most for practices is the billing model: with a flat rate the costs stay the same even in months with many calls, with per-minute pricing they rise with volume. Also check the minimum term and notice periods.

How much time does an AI phone assistant save in daily practice? It depends on the share of organisational calls. Count a typical week: appointment requests, rescheduling, prescription orders and questions about opening hours can be automated, medical concerns cannot. The share of the first group is the realistic upper limit of the relief.

What applies in a medical care centre or hospital outpatient clinic? The same in criminal law, not in organisational terms. Section 203(1) no. 1 attaches to the person of the doctor, not to the holding company. A framework contract signed by the holding company therefore does not automatically discharge the binding duty for every employed doctor. Hospital outpatient clinics are additionally subject to the relevant state hospital act.

May a medical practice in Switzerland or Austria use an AI phone assistant? Yes, under the same basic conditions as in Germany: the provider must be bound into the duty of confidentiality, and the data processing needs a contract. In Austria Section 54 of the Medical Practitioners Act 1998, Section 121 of the Criminal Code, the GDPR and the AI Act apply, including the disclosure duty since 2 August 2026. In Switzerland Art. 321 of the Criminal Code, which expressly includes auxiliary persons, and the Federal Act on Data Protection with Art. 9 on processors apply. Switzerland does not yet have a disclosure duty like Article 50.

Conclusion

Using an AI phone assistant in a medical practice is legally permissible and has been expressly regulated since 2017. The hurdle lies not in the principle but in a duty that is easy to meet and easy to overlook: the practice must ensure that the provider and its subcontractors are bound to secrecy under Section 203 StGB. If it fails to do so, it is the practice that commits an offence, not the provider.

Anyone who deliberately limits the assistant to intake, appointment booking and forwarding stays on the simple side of criminal law, the GDPR and the AI Act and still gains the relief that matters. In practice that means: first set the intended purpose in writing, then obtain the undertakings, then settle the interface question.

This article was published on 29 July 2026, extended with the legal bases on 11 September 2026 and factually revised on 14 September 2026. On 23 September 2026 the article on Section 203 StGB and the GDPR in medical practices from 24 August 2026 was merged into it. It does not constitute legal advice; the orientation on Austrian and Swiss law does not replace advice in those jurisdictions.

Sources

• Federal Ministry of Justice: Section 203 StGB - violation of private secrets, as amended by the 2017 act on the protection of secrets when third parties assist in the work of professionals bound by secrecy
• European Union (2016): General Data Protection Regulation, Articles 9 (including 9(2)(h) and 9(3)), 13, 28, 30 and 35
• European Union (2024): Regulation (EU) 2024/1689 (EU AI Act), Annex III no. 5(d), Article 6(3) and Article 50(1)
• Regulation (EU) 2026/1744 (Digital Omnibus on the AI Act), new date of 2 December 2027 for high-risk systems under Annex III
• Federal Ministry of Justice: Section 630f BGB - documentation of treatment
• Central Research Institute of Ambulatory Health Care (Zi), survey on practice management software 2025, more than 3,100 practice owners and medical care centre directors, 32 systems with 77.4 percent market share, published January 2026
• Austria: Section 54 Medical Practitioners Act 1998 and Section 121 Criminal Code, Austrian Legal Information System
• Switzerland: Art. 321 Swiss Criminal Code and Art. 5, 9, 16 and 19 of the Federal Act on Data Protection (FADP); Federal Office of Communications, Artificial intelligence: the Federal Council's regulatory approach of 12 February 2025