Art. 321 of the Swiss Criminal Code is one of the oldest and strictest professional secrecy provisions in Europe. For physicians, it is far more than a legal obligation — it is the foundation of the trust relationship with patients. The rise of medical AI raises unprecedented questions about its practical application.
Art. 321 SCC protects all information that a physician acquires in the course of their professional activities — not just diagnosis or treatment, but also personal data, family and professional circumstances, and any other fact disclosed during a consultation.[1]
Violating Art. 321 SCC is an offence prosecuted on complaint, punishable by a custodial sentence or fine. Administrative sanctions (MedPA) and nFADP violations (fine up to CHF 250,000) may also apply.[1]
The concept of auxiliary is central. Under Art. 321 SCC and legal doctrine, an auxiliary is any person collaborating professionally with the physician who is thereby in a position to acquire knowledge of confidential facts.[2]
A Swiss AI provider bound by a data processing agreement including a confidentiality obligation meets this criterion. Recent legal doctrine (Gillieron, HESAV 2025) clarifies, however, that a foreign provider — even if partially hosted in Switzerland — is not considered an auxiliary in the Swiss legal sense if the parent company is foreign. In this case, data transmission constitutes a violation of professional secrecy.
| Condition | Legal basis | Practical check |
|---|---|---|
| Informed patient consent | Art. 321 SCC, Art. 6 nFADP | Privacy notice + verbal explanation |
| Explicit consent for audio | Art. 321 SCC, Art. 6(7) nFADP | Verbal or written before recording |
| Data processing agreement | Art. 9 nFADP | Signed document with AI provider |
| Swiss or adequate hosting | Art. 16 nFADP, Art. 321 SCC | Parent company not subject to CLOUD Act |
| Mandatory medical validation | Art. 21 nFADP, MedPA art. 40 | Physician validates every document before clinical use |
See also our article on nFADP and medical AI in Switzerland for detailed coverage of the concrete obligations under the new data protection law.
Does recording a consultation with AI violate medical secrecy?
No, provided three conditions are met: the patient has been informed and has consented (explicitly for audio recording), the recording remains within the medical sphere (processing by a qualified auxiliary or a contractually bound processor), and data is not transferred to third parties without a legal basis.
Is an AI provider an auxiliary under Art. 321 SCC?
Yes, if the provider is established in Switzerland and bound by a data processing agreement including a confidentiality obligation. A foreign provider is not considered an auxiliary in the Swiss legal sense — which creates a risk of violating professional secrecy if data passes through its servers.
Does medical secrecy apply after the patient's death?
Yes. The duty of secrecy persists even after the patient's death. The physician may only disclose information about a deceased patient with authorisation from the competent cantonal authority or where the law provides a specific exception.
What penalties apply for violating medical secrecy?
Violating Art. 321 SCC is an offence prosecuted on complaint. The penalty can be a custodial sentence or a fine. This is compounded by a possible nFADP violation (fine up to CHF 250,000) and a MedPA violation (revocation of medical licence). Liability is personal — the physician is exposed, not just the software provider.
Data processing agreement included. Exclusive Swiss hosting. Data never used to train the AI.
Try free →