Can dental practices use AI on patient records?

Yes, dental practices can use AI on patient records for the tasks it is genuinely good at, clinical note drafting from dictation, referral and recall letters, and plain-English treatment-plan explanations, provided the special category health data those records contain never reaches a consumer cloud tool. Dental practices, NHS, private and mixed, hold clinical notes, radiographs, medical histories and safeguarding flags: exactly the category of data UK GDPR treats with the strictest conditions, alongside payment plan information most practices also hold.

The question matters because dentistry is a long-tail sector: most practices are small businesses without a dedicated IT department, regulated by the CQC in England with professional standards from the GDC, and that combination is precisely where consumer AI tools quietly leak in, because nobody in a three-chair practice has the time or the mandate to vet a tool properly before a receptionist starts using it to save ten minutes on a letter.

Where does consumer AI actually enter a dental practice?

Through exactly the task it looks most helpful for. A receptionist or practice manager drafting a referral letter, an appointment summary, or a patient communication in a free chatbot is not a hypothetical risk, it is a special-category data disclosure to a cloud provider the moment patient details are typed in, made by someone who almost certainly has not been told this is what they are doing.

What is the special category data problem specific to dentistry?

Clinical notes and radiographs are health data under UK GDPR's special category provisions, which require a specific lawful condition beyond the general basis for processing, commonly explicit consent or a condition tied to healthcare provision. Safeguarding flags can layer child protection or vulnerable-adult considerations on top. And payment plan information, common in private and mixed practices, adds financial data to the same record. A tool built for general consumer use was not designed with any of this in mind.

What does UK GDPR require beyond the special category condition?

The common-law duty of confidentiality that applies to health information generally, independent of and in addition to data protection law, and records-retention expectations that vary by record type and circumstance; specific retention periods are not asserted here and should be confirmed against current professional and regulatory guidance rather than assumed. Both duties apply regardless of whether the record sits in a paper file or an AI-assisted system.

What can AI genuinely help with in a dental practice?

Clinical note drafting from a dentist's spoken dictation during or after a consultation, referral letters to specialists, recall and appointment communications, and translating clinical treatment plans into language a patient can actually follow before consenting to treatment. In every case the output is a draft the clinician reviews and takes responsibility for; the clinical judgement itself remains the dentist's.

Does sovereignty for a small practice mean building a data centre?

No, and this is the point most small-practice conversations get wrong. Sovereignty for a three-chair practice is not infrastructure at the scale of a hospital trust; it can be CPU-selectable inference running on a single machine physically inside the practice, with access controlled per patient and per member of staff, and every action sealed to a record a CQC inspection or a GDC fitness-to-practise inquiry could actually verify. The architecture scales down as cleanly as it scales up.

What should a practice check before adopting any AI tool?

Where patient data actually goes once typed or dictated into the tool, whether the vendor uses that data for model training, and whether the tool can demonstrate an access control model that matches who is actually allowed to see which patient's record in the practice. A tool that cannot answer these plainly is not ready for a dental record, regardless of how convincing its drafting looks.

“A receptionist drafting a referral letter in a free chatbot is a special category data disclosure, whether or not anyone meant it to be.”

How CPU-selectable inference on modest hardware inside a small practice, with per-patient access control and a sealed record, is set out at /sovereign-ai, and the film at /film shows the interface in operation.

Frequently asked questions

Can a dental practice use a free AI chatbot to draft a referral letter?

Not safely if the letter contains identifiable patient clinical information, since that is a special category health data disclosure to a cloud provider outside the practice's control, engaging UK GDPR obligations the free tool was never designed to satisfy.

Does CQC inspection reach AI tools used in a dental practice?

CQC regulates the safety and quality of care provided, and how a practice handles patient information, including through AI tools, falls within that remit as part of information governance and safe record-keeping, though specific inspection criteria for AI tools are not detailed here.

Who is responsible if AI-drafted clinical notes contain an error?

The dentist who reviews and signs off the notes into the patient record remains clinically and professionally responsible, exactly as with any note drafted by a dental nurse or transcription service. AI produces a draft; the clinician's verification is what makes it the record.

Do small practices really need dedicated AI infrastructure, or is that only for hospitals?

Sovereignty scales to the size of the practice. A single machine running inference locally with access controls can serve a small practice appropriately; the principle of keeping patient data inside the practice's control applies regardless of the practice's size, not only at hospital scale.

Can AI be used for treatment-plan explanations given directly to patients?

Yes, as a drafting aid to translate a clinical plan into plain language the patient can follow, provided the clinician reviews the explanation for accuracy before it reaches the patient, since responsibility for what the patient is told about their own treatment remains with the dentist.

What should a practice do before trialling any new AI tool on patient records?

Confirm data handling in writing, run the trial on a small anonymised or consented sample first, and keep a record of what was tested and approved before wider rollout. A short written trial record gives the practice something concrete to show a CQC inspector or a GDC inquiry later, rather than relying on memory of an informal evaluation.