Can you use patient data with AI in Colombia?

This is not legal advice. We are not lawyers. This is what we read in the rules, with the article next to each claim so you can verify it or take it to your lawyer. If you are about to make a decision, consult one.

That said: yes, you can. But the rule runs the opposite way from how most people picture it.

The short answer

Health data is sensitive data under article 5 of Law 1581 of 2012. And article 6 opens like this: “Processing sensitive data is prohibited, except when…”. The starting point is not that you may and there are limits. It is that you may not, unless you fall within an exception — and the first one listed is the patient’s explicit authorization.

Everything else follows from that.

What counts as sensitive data

Article 5 defines them and names two that matter here:

“…as well as data relating to health, sexual life and biometric data.”

Biometrics sits in the same sentence as health. A fingerprint or a face scan to log into the system is not an infrastructure detail: it is another category of sensitive data, with the same default prohibition.

Authorization is not a checkbox

Article 9 requires it to be prior and informed, and obtained by a means that can be consulted later. A verbal yes does not work, because it cannot be retrieved.

Article 12 sets out what must be disclosed when asking for it:

Subsection	What the data subject must be told
a)	What will be done with their data and for what purpose
b)	That answering questions about sensitive data is optional
c)	What rights they have
d)	Who the controller is: identification, address and phone

Subsection b) is the one almost nobody implements. A clinical form where every field is mandatory is already in breach, with or without AI.

The article’s final paragraph closes the loop: you must keep proof of having done it, and give the patient a copy on request. Article 17 b) repeats it as a controller’s duty.

There are exceptions where no authorization is needed — article 10 lists five, including medical or public-health emergency. They are narrow and do not cover a clinic’s daily operation.

The point almost nobody checks: sending the data abroad

If your system uses a language model, that model is probably not in Colombia. That triggers article 26:

“The transfer of personal data of any kind to countries that do not provide adequate levels of data protection is prohibited.”

So who decides which country is adequate? The answer is in section 3.2 of External Circular 005 of 2017 from the Superintendency of Industry and Commerce, which publishes the list. And it contains something that surprises almost everyone:

The United States of America is on the list.

So are Germany, Austria, Belgium, Bulgaria, Cyprus, Costa Rica, Croatia, Denmark, Slovakia, Slovenia, Spain, Estonia, Finland, France, Greece, Hungary, Ireland, Iceland, Italy, Latvia, Lithuania, Luxembourg, Malta, Mexico, Norway, the Netherlands, Peru, Poland, Portugal, the United Kingdom, the Czech Republic, the Republic of Korea, Romania, Serbia and Sweden. External Circular 008 of the same year added Japan.

What it means and what it does not. It means article 26 stops being an obstacle for those destinations. It does not mean you are cleared: the article 6 authorization, the article 17 security duties and the clinical record’s legal reserve are all still there. It removes one barrier, not five.

And if the destination is not on the list, article 26 has ways out — the first being the data subject’s express and unequivocal authorization for that transfer — or it falls to the Superintendency to issue a declaration of conformity.

Since 2024 there are written rules for AI

External Circular 002 of August 21, 2024 is the Superintendency’s specific instruction on personal data in artificial intelligence systems. What it asks for, in short:

• Weigh suitability, necessity, reasonableness and proportionality before processing.
• Precautionary principle: where there is no certainty about potential harm, abstain or adopt preventive measures.
• Risk management: “identify, measure, control and monitor”.
• A privacy impact assessment before design, not after deployment.
• Data quality: “truthful, complete, accurate, up to date, verifiable and understandable”.
• That “publicly accessible” is not the same as “public in nature”: finding data on the internet does not entitle you to process it.

That second-to-last point is the one that changes the order of the work. The impact assessment comes first, and if your process is to build now and review later, you are not meeting it even if the document exists.

The clinical record has its own reserve

Separate from Law 1581. Resolution 1995 of 1999 from the Ministry of Health, article 1:

“The Clinical Record is a private, mandatory document under legal reserve, in which the patient’s health conditions, medical acts and other procedures carried out by the health team involved in their care are recorded chronologically.”

Its article 14 sets who may access it: the user, the health team, judicial and health authorities in the cases provided by law, and other persons determined by law. The final paragraph adds that access is solely for the purposes that are legally appropriate, maintaining legal reserve in every case.

A habeas data authorization does not lift this reserve. They are two distinct layers and you have to satisfy both.

What the law does not say, and why that is worth knowing

We went through all thirty articles of Law 1581. There is no equivalent to article 22 of the European regulation. Colombian law grants no right to avoid automated decision-making, and no right to human intervention in it.

That does not make it irrelevant. It means human review in a Colombian system is a design decision, not an obligation you can cite — and that if someone sells it to you as a legal requirement, they are asserting something the law does not say.

On August 28, 2025 the government filed a bill partially amending Law 1581 — scope of application, demonstrated accountability as a principle, a data protection officer, processing data of people over fourteen. It is a bill. Being a statutory law, it requires an absolute majority in every debate, and we could not verify that it has been approved. If you are making a decision based on it, check its status that day.

What you are risking

Article 23 lists the sanctions: fines of up to 2,000 monthly minimum wages, applied successively while the breach persists; suspension of activities for up to six months; temporary closure. And a subsection d) that exists specifically for this case:

“Immediate and definitive closure of the operation involving the Processing of sensitive data.”

Definitive. It is the harshest sanction in the law and it points exactly at where a clinic lives.

What we decided, and why

Nidova is a medical practice’s management system and it is in production. Three decisions, made by design:

Zero biometrics. There is no fingerprint or facial recognition anywhere in the system. Article 5 puts it in the same category as health, so adding it doubles the sensitive surface in exchange for a login convenience. Not worth it.

Zero automated diagnosis. The system neither issues nor suggests diagnoses. That is the line between managing clinical information and practicing medicine, and we do not cross it.

Human review: the system drafts, a person approves. No response reaches a patient without someone at the practice having seen it. As we said above, the law does not require this of us. We do it because a wrong answer to a patient is not something you fix with a ticket.

What we don’t know

• We are not lawyers and this is not a legal opinion. Every claim carries its article so you can verify it or take it to someone who can.
• We did not review the Superintendency’s sanctions history. We do not know how often subsection d) of article 23 is applied, and we are not going to estimate it.
• We do not know the status of the reform bill beyond that it was filed and that we found no evidence of its approval.
• Complying with the law is not the same as being secure. Those are two jobs, and this post only covers the first.

What to do with this

Three questions for the system you already have running, in order:

1. Does the explicit authorization exist, stored in a way you could produce two years from now?
2. Does the form state that answering questions about sensitive data is optional, as article 12 b) requires?
3. Do you know which country the data goes to when it passes through a model, and is that country in section 3.2?

If any of them is answered with “we’d have to find out”, that is the work.