The price per line is falling – and the mountain of risks and controls is growing

In the background, a doctor in a white lab coat uses a tap of his finger to interact with a floating white illustration featuring diagrams and text boxes in the foreground.

03.11.2026

Dictation management

Quotes from neighboring countries offer ample staff, lower costs, and seemingly comprehensive contracts. However, outsourcing to other countries brings increased documentation, oversight, response, and legal obligations. Although the work may cross borders, the responsibility remains with the hospital.

The loophole isn’t in the offer

The internal transcription department is understaffed, the backlog of reports is growing, and there’s no budget for additional positions. Then, an offer from Germany arrives with medical terminology, a lower per-line rate, ISO certification, and an order processing agreement.

The proposal includes the data protection argument: Germany is listed in Annex 1 of the General Data Protection Regulation (GDPR), so the transfer requires no additional safeguards. That’s true, yet it’s the least of the issues at hand. Checkbox checked, business case calculated, ready to sign?

Appropriate is not enough

No. The assessment of appropriateness answers only a partial question. All other obligations remain in effect: purpose limitation, data security, informing data subjects, monitoring data processing – including by subcontractors – and, in cases of high risk, a data protection impact assessment. Furthermore, data processing by a third party is only permitted if no statutory or contractual confidentiality obligation prohibits it (Art. 9(1)(b) DSG).

Surgical, psychiatric, and discharge reports not only contain personal data requiring special protection, but their content is also generally subject to professional secrecy under Art. 321 StGB. A disclosure to a foreign country that is permissible under data protection law does not yet answer the question of professional secrecy. Criminal law does not maintain a list of countries.

Physicians may engage support staff, which can include anyone from a practice secretary to an IT service provider. The designation in the contract is not decisive. Access must be necessary; the individuals must be clearly identified, bound by a duty of confidentiality, and effectively integrated into a structure of supervision and control. This is also required by the cantonal data protection commissioners, who are united in the privatim conference: The mere contractual label of “support staff” is not sufficient.

Germany has its own confidentiality protection for contributing individuals under § 203 of the German Criminal Code (StGB). Professional confidentiality therefore does not fall into a legal vacuum at the border. However, the Swiss hospital must verify and be able to demonstrate whether both legal frameworks complement each other seamlessly throughout the specific service chain – considering transcription, quality assurance, support, remote work, and every subcontractor. A simple “We are compliant” does not replace this verification.

The mountain of risks and controls is growing at the border

Across the border lies a second legal jurisdiction. Who is permitted to read or listen to plain text, and where? What confidentiality obligations apply to which individuals? Which authorities have access? What happens in emergency situations or legal disputes? How are audit, deletion, and directive rights enforced? These questions apply regardless of whether humans or AI-supported processes handle transcription. What remains decisive is who receives plain text and where, and which law is binding.

Even the most favorable public assessment contains reservations. A non-legally binding guideline from the Zurich AI Innovation Sandbox from 2025 considers outsourcing to foreign countries to be possible for public hospitals but notes increased risks and the need for additional measures. In contrast, the FDPIC states that using service providers abroad to process medical personal data should be avoided because foreign law does not always offer equivalent protection to that provided by Art. 321 of the Swiss Criminal Code. While this is not a blanket ban, it is a clear warning signal that hospital management cannot simply dismiss by checking off a list of countries.

Standard German is usually insufficient

One item that is rarely included in quotes is language. Medical documentation in Switzerland is a language world of its own. In Germany, the discharge summary is called an “Arztbrief”; in addition, there are cost approval forms, referring physicians, drug names that exist only here, and dictations with a dialectal flavor. Those who hear this daily make corrections on the fly. Those who don’t generate follow-up questions and correction loops that aren’t reflected in the per-line rate. In the worst-case scenario, this results in errors in the report to the referring physician. Therefore, what matters is not the company’s headquarters, but whether the people involved in the transcription process are familiar with Swiss hospital life. This question should be included in every request for proposals and every pilot project.

Surprise does not constitute consent

According to the EDÖB, implied consent extends only as far as disclosures that the average patient can reasonably expect. The treatment team is included in this, but an external transcription center abroad is not.

Anyone who has surgical, psychiatric, or discharge reports transcribed and read abroad should not assume that the individuals involved would have expected this. Silence does not constitute consent. The outsourcing process must be transparent. Depending on the circumstances, additional consent to waive confidentiality may be required.

Responsibility remains with the hospital

While the hospital can delegate the work, it cannot delegate its responsibility. This is no easy task. The hospital must select, instruct, and monitor the service provider, manage subcontractors, ensure the rights of affected individuals, and investigate incidents. For hospitals on a cantonal hospital list, time pressure is an additional factor. Cyberattacks subject to mandatory reporting generally must be reported to the Federal Office for Cybersecurity within 24 hours of discovery. A lengthy escalation chain does nothing to slow down this clock.

Any further use of the data, such as for model training, product improvement, or benchmarking, also requires explicit provisions. The contract must specify whether and for what purposes a provider or one of its subcontractors may use the data beyond the scope of the contract.

Regarding the electronic patient record, the federal government has linked data location and jurisdiction. Data storage facilities must be located in Switzerland and be subject to Swiss law (Art. 12(5) EPDV). Although there is no explicit ban on foreign transcription, this sends a clear signal about the importance of data sovereignty regarding sensitive health data.

Public and public-law hospitals must comply with cantonal information and data protection laws, official secrecy, and outsourcing requirements. Depending on the canton and the risk involved, a data protection impact assessment, prior review, or consultation with the supervisory authority may be required. Anyone who begins this review after the contract has been awarded risks having the project halted, and in the worst-case scenario, facing reputational damage.

Five Questions Before Signing

Who has plaintext access, and where? Consider transcription, quality assurance, support, remote work, and subcontractors.
What confidentiality obligations apply to which individuals? Have the chain of protection, applicable law, and enforceability assessed in writing.
Where is the data stored, and for what purpose? Check the audio, text, backups, deletion, and any secondary use.
Can the hospital take action within hours? Test the reporting channels, logs, forensic analysis, and requests from authorities.
Are patients aware of this? Disclose processing abroad and verify whether consent is required.

The Price of Governance

There is no “No Trespassing” sign at the border. But that is where the steep climb up the actual “mountain of risk and control” begins. With the lower per-line price on the other side of the border, a hospital is effectively purchasing a second legal jurisdiction, more authorized users, and longer response times.

Even if data, processing, and access remain in Switzerland, that does not guarantee security. However, it can reduce legal and organizational complexity and facilitate audits as well as the enforcement of claims. Therefore, the business case must include not only the per-line price but also the cost of governance – and this is rarely included in the proposal.

First published: clinicum 5/26, October 14, 2026