Patient data in your chat inbox: what clinics need to watch for

Most clinics take good care of medical records. Yet the chat inbox an admin keeps open all day is treated as a casual channel — even though it holds symptoms, photos, phone numbers and sometimes test results.

Written from our work setting up and testing chat systems for healthcare providers. This is not legal advice and has not been reviewed by a lawyer or external auditor. On legal matters, follow the regulators listed in the references at the end of this article.

This article walks through the risk points we actually see in chat work at healthcare providers, so you can have a more focused conversation with your clinic's advisers. For interpretation of the law, ask whoever handles this for your clinic directly.

What's inside a clinic's chat inbox

Scroll back through the last two weeks of messages and you'll find at least these four types mixed together.

• Contact details — names, phone numbers, sometimes addresses and dates of birth.
• Health information — symptoms patients describe themselves, medication they take, chronic conditions, treatment history elsewhere.
• Photos — faces, teeth, wounds, test results, sent by patients without anyone asking.
• Financial information — transfer slips, account numbers, sometimes a photo of an ID card sent to claim coverage.

Health information needs stricter care than ordinary personal data, and it ends up in the chat inbox from the very first message without anyone intending it to.

Where clinics slip up without meaning to

Everyone on the team sees every chat

A clinic's LINE account or Facebook page is usually shared by everyone. Whoever is on shift can open any conversation, including ones that have nothing to do with their work. What you should do is give only the access each person needs, and keep a record of who currently has access — and above all, actually remove access for people who have left. That's the step most often forgotten.

Data gets copied out of the system

Screenshots sent to the team's LINE group, phone numbers copied into a personal spreadsheet, photos of the screen sent to the doctor. All of this happens every day because it's convenient, and it puts patient data in places the clinic can no longer track.

Keeping everything forever

Nobody ever deletes anything from the chat inbox. Details of someone who asked one question three years ago are still all there, even though the clinic has no reason to keep them. Having a rule for what you keep and for how long, and actually following it, greatly reduces the damage if something goes wrong.

Sending test results by chat

Patients ask for results in chat because it's easiest. But nobody can confirm from inside the chat that the person messaging from that account is really the owner of the results. That's why many health check-up centers have a firm rule: no results by chat, under any circumstances.

Does an automated chat system make this worse or better?

It depends entirely on how the system is set up. Set up badly, it's one more leak. Set up well, it genuinely helps in three ways.

• It asks only for what's needed — a well-configured system collects just the name, contact number, what the person is interested in and a convenient time — the set your team actually needs to book. It doesn't dig into health history that isn't needed at this stage.
• It doesn't steer the conversation where it shouldn't go — no diagnosing, no conclusions from photos sent in, no recommending medication. Beyond patient safety, these three rules also avoid inviting patients to send more sensitive data than necessary. If a clinic wants the system to ask for face photos for an initial assessment, it must state the purpose and ask for consent first, every time.
• The same answers every time — what must not be said is defined in one place and applied the same way on every shift, regardless of who's on duty that night or how tired they are.

These are the same guardrails described in How far should AI answer your clinic's chat? — set from the day of installation, not added later after something has gone wrong.

Questions to ask a provider before you sign

1. Where is conversation data stored, and for how long? — get the answer in writing, not verbally.
2. Who on the provider's team can access conversations, and when? — some support work requires looking at them. That's not wrong, but you need to know who and when.
3. When you stop using the service, is the data deleted? Can you get a copy back?
4. Does the system use the clinic's data for anything else? — the answer you want to hear is no, and it should be in the contract.
5. Do the LINE account and Facebook page still belong to the clinic? — if you switch providers one day, your customer base has to move with the clinic.

Three things you can do this week without buying anything

• Check who can currently access the clinic's chat inbox, and remove anyone who is no longer with the clinic.
• Agree clearly with your team which topics can be handled in chat and which need a call back, especially test results and symptoms.
• Add a short line to your welcome message saying what data the clinic keeps and what it's used for, and that anyone with symptoms should come in and see a doctor rather than describe them in detail in chat.

The last one matters more than you'd think. Many patients send sensitive information from their very first message without anyone asking. Saying up front that they don't need to go into detail immediately reduces the amount of data the clinic is responsible for — and it costs nothing.

Sources and further reading

1. Personal Data Protection Committee (PDPC) — PDPCLegislation, notifications and guidelines under Thailand's Personal Data Protection Act B.E. 2562 (2019) (in Thai)
2. Personal Data Protection Act B.E. 2562 (2019) — Royal Thai Government GazetteOfficial text as published in the Royal Gazette (PDF, in Thai)