Helse Bergen's Readmission-Risk AI in Norway's Data Protection Sandbox — Legal Basis Confirmed for Development and Clinical Use, With Safeguards

Bergen's hospitals found that 10% of their patients account for more than half (53%) of all bed days, and that many are readmitted within 30 days of discharge. Helse Bergen wanted an automated warning system, built on patients' electronic records, to flag those at high risk so clinicians could arrange extra follow-up.
The project ran in the Norwegian Data Protection Authority's (Datatilsynet) regulatory sandbox for responsible AI. The exit report, published in September 2023, concluded that Helse Bergen has a legal basis under the GDPR to develop and use the tool as clinical decision support, supplemented by Norwegian health-personnel legislation. A legal commentary by INPLP summarises the basis as Article 6(1)(e) for development and Article 6(1)(c) for later use, with Article 9(2)(h) for health data.
The report attaches conditions: patients should receive general information that their data is used to develop AI, and each patient's record should explain the tool's output in terms clinicians and patients can understand. It recommends routine quality control of the algorithm, uniform guidelines for interpreting results so humans keep control of decisions, and warns that distortions in underlying data could lead to discrimination.
Caveats: sandbox conclusions are non-binding guidance, not approval; fully autonomous AI was out of scope; and the published page reports no model accuracy or clinical outcome figures, nor whether the tool has since been deployed.

Read the full analysis: https://www.inplp.com/publications/responsible-use-of-ai-based-tools-in-medical-diagnosis-and-treatment-the-ai-sandbox