AI features and patients' ID numbers
Which patient details can reach an AI vendor when a practice uses Achekam's AI features, what is removed first, and how to see or switch AI off.
By Achekam · · 5 min read · For Healthcare businesses in South Africa, Nigeria, Kenya
A practice's paperwork is full of identity numbers. They are on scheme remittance advices, on patient account letters, in the reference column of the bank statement when a parent pays a child's account, and occasionally on a supplier's invoice for a patient-specific item. So when a practice manager hears that the books can use AI to read documents, the first question is the right one: what about our patients' ID numbers?
This article answers it for Achekam. It covers where AI appears in a practice's books, what is removed before text goes to an AI vendor, which vendors can be involved and on whose key, how to see every AI request, and how to switch AI off entirely.
Where AI appears in the books
AI in Achekam reads what staff give it. In a practice's books, that means three places:
- Supplier invoices and receipts in Financial Intake. Uploaded documents become suggested postings. AI can suggest, but only a person approves and posts.
- Document Intelligence. Staff can upload a receipt, invoice or statement for AI to read. Achekam then re-checks the totals, VAT and dates and flags any figure not in its own transcription.
- Scanned bank statements. When a statement is a scanned or unrecognised PDF, an AI model can read it where the workspace has one configured, and every amount must appear on the page.
Behind all of these sits one rule: journals proposed from documents, bank lines or adjustments are only candidates. Only a person can approve a candidate and post it, and the AI is refused both steps.
Notice what is not on the list. Nothing there goes looking through patient records by itself. Patient details reach an AI vendor when they are printed in a document someone sends to one of these features.
South African ID numbers removed first
By default, Achekam's AI engine removes South African ID numbers before text is sent to an AI vendor. A remittance advice or a bank statement with a South African ID number in it therefore goes to the vendor without that number.
Three things to understand about this:
- It can be switched off. The removal is a setting in AI settings. Check that it is on, and decide who in the practice is allowed to change it.
- It covers South African ID numbers. It is not described as covering a Nigerian NIN, a Kenyan national ID number, a medical aid membership number or a patient's name. Practices in Nigeria and Kenya, and every practice in respect of other identifiers, should not assume those are removed.
- Some data classes are refused anyway. Document Intelligence refuses restricted data classes, such as payroll and bank data, unless they are allowed for a particular purpose.
The practical conclusion: send AI the documents it is good at, mainly supplier invoices and receipts, and think twice before uploading anything built around patients.
Which vendors, and whose key
Achekam's AI features go through one AI engine. That engine can use Anthropic, OpenAI, Google Gemini, DeepSeek or xAI. It uses the workspace's own API key first, and the platform's key only where that is allowed. Administrators manage this in Settings under "AI models, keys, routing & spend".
With no key at all, every AI feature says so and drafts nothing. A practice that never sets up a key and is not allowed the platform's key simply does not use AI.
One further limit is built into the engine. It refuses any task whose type is giving an opinion, reaching a conclusion, approving or signing. So whatever a vendor's model is capable of, Achekam does not ask it to take decisions on the practice's behalf.
Seeing every AI request
The AI Activity Log lists every AI request with the vendor, the model, the tokens used and an estimated cost. The costs are estimates from vendor list prices, not invoices.
For a practice, the log answers the question an information officer will eventually ask: which AI vendor has been receiving requests, and how many? A monthly look is a sensible rhythm:
- How many requests there were over the month.
- Which vendor and model handled them.
- Whether the volume matches what the practice expected, given the documents it decided to send.
Switching AI off for the whole workspace
A workspace administrator can switch AI off for the workspace. If the partners decide the practice is not ready to use AI with any document, that one setting covers it. The books, bank imports and postings carry on working; they simply rely on people instead of AI suggestions.
A worked example in words: a practice decides to use AI only for supplier invoices. The administrator confirms the South African ID-number removal is on, tells reception never to upload patient letters or remittances to Document Intelligence, and reviews the AI Activity Log at month-end. When the month-end review shows more requests than the supplier invoices explain, the practice manager asks around and finds a new staff member uploading scheme remittances, and puts it right the same week.
A checklist for the practice manager
- Decide whether the practice uses AI at all, and record the decision.
- If it does, confirm whose API key is used and which vendor it routes to.
- Confirm the ID-number removal is switched on.
- Agree which document types may be sent to AI features, and which may not.
- Review the AI Activity Log monthly.
- Know who can switch AI off, and when you would.
For the wider picture of what Achekam's AI can and cannot do, see what Achekam's AI can see, do and refuse. How AI suggests postings from supplier documents in another industry is shown in carrier invoices as suggested postings. South African practices weighing these choices will find the conditions for lawful processing of personal information in the official text of the Protection of Personal Information Act, which also establishes the Information Regulator.
AI in the books is a choice, not a default you have to live with. Decide which documents it may read, keep the ID-number removal on, and let the activity log show you that the practice is doing what it decided.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
