The privacy line comes first

This course is about the administration around clinical work, not about clinical decisions. That distinction is the whole of it, and it is worth stating before anything else.

Patient information is the most sensitive category of data there is. A name with a condition attached, a test result, a prescription, a photograph, a phone number linked to an appointment. Pasting any of it into a general consumer AI tool means it has left your control, and what happens to it then depends on terms most people have not read.

The rule for a clinic. Nothing identifying a patient goes into any tool that has not been approved for it, with terms that exclude your input from training and with an agreement appropriate to health data. For most small clinics in Pakistan, the practical version is simpler: remove the identifying details, or do not use the tool.

Removing the name is not enough when the remaining details identify somebody. A rare condition, an unusual age, a specific date and a small town together identify a person as clearly as a name does.

Draft data protection legislation has been moving in Pakistan for several years, so what is currently good practice is likely to become a legal requirement. Building the habit now is cheaper than retrofitting it.

Tell patients what you do, in plain words, if AI touches anything about their care or their records. Trust in a clinic is the whole asset and it does not survive a surprise.