Guide · checked October 2026
Using AI in the cath lab without sending data off site
AI can draft cath lab notes, handovers and audit returns from the record, but the safest early uses keep a person approving every output, cite each statement to its source and, where the trust prefers, run the model on site; NHS guidance allows cloud hosting with safeguards, so the choice is a local governance decision.
The governance picture
NHS England's guidance on off-shoring and public cloud sets out the safeguards needed to host health and care data in the public cloud and says providers should use cloud services in territories deemed adequate, once the local SIRO, with the DPO and Caldicott Guardian, is satisfied with security. All organisations with access to NHS patient data and systems must use the Data Security and Protection Toolkit. The AI and Digital Regulations Service, curated by NICE, MHRA, CQC and HRA, brings regulation and evaluation guidance together for developers and adopters.
Where AI helps, and where it shouldn't decide
- Good fits: drafting from records the user can already see, finding gaps before a case, pre-filling audit fields for confirmation, summarising a handover.
- Keep human: findings, plans, clinical decisions, what gets signed and what gets submitted.
- Prefer rules over models for checks that can be written as rules, such as a missing allergy status.
Questions to ask a supplier
- Where does the model run, and can the app reach anything outside the hospital network?
- Is every statement cited to a source record, and what happens when it isn't?
- Does access follow the user's role, and is break-glass audited?
- What clinical safety and information governance work has been done, and what is still needed?
Myths
- "AI means automated decisions": it can be limited to drafting for a person to confirm.
- "Local means no governance": on-site systems still need IG and clinical safety work.
- "Cloud is banned for patient data": NHS guidance allows it with safeguards.
Where Cath Copilot fits
Cath Copilot runs its AI locally through Ollama, on one PC, a lab host or a hospital server, and the app has no network access beyond its hub. Pre-case flags are deterministic rules, not AI. The model drafts only from records the signed-in user may see, every statement is checked against its source before signing, and the assistant declines clinical advice. Seven roles see the same patient differently, break-glass needs a reason, and actions land in a hash-chained audit log.
A clinical safety and information governance process would come before any use with real patient data. Cath Copilot is a prototype on synthetic data only. It is not a medical device and is not for clinical use.
Questions
Can NHS patient data be processed in the cloud?
NHS England's guidance allows it with safeguards, in territories deemed adequate, once the local SIRO, DPO and Caldicott Guardian are satisfied.
Does Cath Copilot send data off site?
No. Its model runs locally through Ollama and the app has no network access beyond the hub.
Sources
Official pages, checked October 2026. Guidance changes, so check the current version before you rely on it.
General information for healthcare managers and clinical teams, checked October 2026. It is not legal, regulatory or clinical advice; follow the current official guidance and your organisation's own policies. No patient data is used in these examples. Cath Copilot is a prototype running on synthetic data only. It is not a medical device and is not for clinical use. It recommends, drafts, and routes; it never diagnoses, orders, or decides. A clinical safety and information-governance process precedes any use with real patient data.