Ethical and privacy challenges of integrating generative AI into EHR systems in Tanzania: A scoping review with a policy perspective

Abstract

Objectives

This study examines the ethical and privacy challenges of integrating generative artificial intelligence (AI) into electronic health record (EHR) systems, focusing on Tanzania's healthcare context. It critically analyses the extent to which Tanzania's Policy Framework for Artificial Intelligence in the Health Sector (2022) addresses these challenges and proposes regulatory and practical safeguards for responsible generative AI deployment.

Methods

A systematic scoping review was conducted using PubMed, IEEE Xplore, Scopus and Google Scholar to identify relevant studies published between 2014 and 2024. The Preferred Reporting Items for Systematic Reviews and Meta-Analyses extension for Scoping Reviews (PRISMA-ScR) guidelines informed the search and selection process. Fourteen studies met the inclusion criteria and were thematically analysed to identify key ethical and privacy concerns of generative AI in healthcare. Moreover, a policy analysis of Tanzania's AI framework was conducted to assess its alignment with global best practices and regulatory preparedness.

Results

The review identified six key ethical and privacy challenges associated with generative AI in EHR systems: data privacy and security risks, algorithmic bias and fairness concerns, transparency and accountability issues, consent and autonomy challenges, human oversight gaps and risks of data re-identification. The policy analysis revealed that while Tanzania's AI framework aligns with national health priorities and promotes capacity building and ethical governance, it lacks generative AI-specific guidelines, regulatory clarity and resource mobilisation strategies necessary for healthcare settings.

Conclusion

Integrating generative AI into Tanzania's EHR systems presents transformative opportunities and significant ethical and privacy risks. Tanzania's policy framework should incorporate AI-specific ethical guidelines, operationalise regulatory mechanisms, foster stakeholder engagement through participatory co-design and strengthen infrastructural investments. These measures will promote ethical integrity, enhance patient trust and position Tanzania as a regional leader in responsible AI use in healthcare.

Keywords

Generative AI electronic health records ethical challenges privacy concerns data security regulatory frameworks

Introduction

Integrating generative artificial intelligence (AI) into healthcare has opened new frontiers in improving patient care, enhancing diagnostic accuracy and enabling personalised treatment planning.¹ Generative AI, a subcategory of AI, contrasts with traditional AI models by generating new data patterns, simulating human creativity and learning from vast datasets to produce novel insights.² Its ability to analyse large volumes of health data, simulate clinical scenarios and formulate patient-specific predictions positions generative AI as a powerful tool for supporting clinical decision-making.³ By applying sophisticated algorithms and deep learning models, generative AI leverages granular patient information to assist clinicians in delivering more precise, preventive and personalised healthcare interventions.¹

Globally, the increasing adoption of electronic health record (EHR) systems has provided a critical foundation for deploying generative AI in healthcare by enabling the capture and management of comprehensive patient data.^4–7 Reflecting these global trends, Tanzania has also made significant strides in digitising healthcare data management. The adoption of EHR systems in Tanzania is largely driven by the Government of Tanzania Hospital Management Information System (GOTHOMIS), which serves as the primary EHR platform deployed in public healthcare facilities. As of April 1, 2025, approximately 5545 healthcare facilities, accounting for about 74.93% of all health facilities, had adopted various versions of GOTHOMIS.⁸ Adoption is the highest among district hospitals (98.95%), health centres (93.94%) and dispensaries (71.39%) but relatively low in clinics (30%). Despite these efforts, infrastructure readiness, data interoperability and technical capacity persist, particularly in lower-level healthcare facilities.^9,10

However, despite these technological advances, Tanzania's context differs markedly from other developing countries, presenting distinct challenges that complicate the integration of advanced technologies such as generative AI.¹¹ These challenges include limited digital infrastructure, unreliable power supply, low internet connectivity and constrained human resource capacity to manage advanced technologies.¹¹ Moreover, digital literacy among healthcare providers remains a critical barrier, particularly in rural areas.^12,13 The scarcity of high-quality health data and the fragmented nature of health information systems pose further limitations to the meaningful use of AI-driven insights.^14,15 Cultural attitudes towards technology adoption and concerns about privacy and trust in digital health solutions are additional hurdles facing the healthcare landscape in Tanzania.^16–18 These realities complicate the integration of generative AI and expose critical vulnerabilities that require country-specific ethical and regulatory responses.

Nevertheless, globally, health systems are moving beyond digitisation and increasingly exploring integrating emerging technologies like generative AI to unlock greater value from EHR systems. Coupling EHR systems with generative AI transforms how clinical data is utilised.^19,20 Generative AI's capacity to simulate future outcomes, recommend proactive interventions and optimise resource allocation in healthcare ranges from predicting patient deterioration risks to forecasting medication needs. It further supports rapid decision-making, reducing cognitive burdens on clinicians while enhancing healthcare efficiency.^3,21 However, deploying generative AI in healthcare introduces significant ethical and privacy concerns, particularly regarding patient data security, transparency of AI processes and consent mechanisms.²²

In the context of EHR systems, generative AI's reliance on extensive access to sensitive patient information raises critical concerns about data security, patient autonomy and privacy.^3,19 The dynamic learning capability of AI models, which continually evolve based on new patient data, further complicates efforts to maintain data confidentiality.^23,24 Risks of unauthorised access, data breaches and misuse threaten patient trust and the integrity of healthcare systems.²⁵ Consequently, integrating generative AI into EHR systems necessitates rigorous data governance protocols, ethical safeguards and robust regulatory oversight to protect patient rights and ensure responsible AI use.

Beyond privacy risks, the ethical implications of generative AI involve concerns about how patient data are used to inform clinical decisions. Data misuse raises significant ethical challenges.²⁶ Furthermore, biases inherent in datasets or algorithms can result in discriminatory or inequitable clinical recommendations, potentially exacerbating healthcare disparities.²⁷ These concerns reinforce the need for comprehensive ethical and regulatory frameworks to guide AI deployment's technological and human dimensions. Such frameworks must prioritise transparency, accountability, fairness and human oversight to protect patient rights while maximising the benefits of generative AI in healthcare.

Despite the growing global discourse on ethical AI, studies focusing specifically on the challenges and policy responses in developing countries, particularly within African healthcare settings, remain scarce. While Tanzania has outlined a policy framework for AI adoption in healthcare,²⁸ the extent to which this framework addresses the unique risks associated with generative AI remains unclear. Given Tanzania's rapid digital health transformation among infrastructural and regulatory gaps, the country offers a critical case study for examining the ethical and privacy considerations of generative AI in healthcare. This study is therefore justified as it seeks to bridge this knowledge gap by systematically synthesising global evidence on ethical and privacy challenges in healthcare AI, critically evaluating Tanzania's AI policy framework and proposing context-specific safeguards. Moreover, there is a scarcity of studies examining how regulatory frameworks in Developing countries align with ethical AI deployment, making this study timely and essential for informing policy and practice in Tanzania and similar settings. Table 1 outlines the research questions guiding this study.

Table 1.

Research questions.

What are the primary ethical and privacy challenges of integrating generative AI into EHR systems?

How effectively are regulatory frameworks addressing these ethical and privacy concerns?

How does Tanzania's AI policy address the ethical and privacy challenges of integrating generative AI into EHR systems?

What are the regulatory gaps in implementing generative AI in Tanzanian healthcare?

What safeguards can promote ethical AI deployment in EHR systems?

Source: Developed by authors to guide the study.

Methodology

This study employed a systematic scoping review methodology to investigate and synthesise existing literature on the ethical and privacy challenges of integrating generative AI into EHR systems. It was complemented by a policy analysis of the policy framework for artificial intelligence in Tanzania's health sector.²⁸ The methodology comprises three primary stages: literature search, selection and screening and thematic analysis.

Literature search

The literature search was conducted across PubMed, IEEE Xplore, Scopus and Google Scholar, selected for their extensive coverage of healthcare, AI and interdisciplinary research to capture high-quality peer-reviewed articles, reviews and relevant policy documents published between 2014 and 2024. This 10-year range was chosen to include recent advancements while capturing a period marked by significant developments in generative AI and its integration into healthcare systems, particularly in EHR systems. Keywords and search terms included combinations of ‘generative AI’, ‘electronic health records’, ‘ethics’, ‘privacy’, ‘data security’, ‘healthcare AI regulations’ and ‘EHR integration’, explicitly targeting studies addressing ethical and privacy concerns in healthcare AI, with a focus on EHR systems and decision support. This approach was designed to identify comprehensive, multidisciplinary insights relevant to current challenges and considerations in AI-driven healthcare applications. Table 2 presents an example search string used for each database, following the proper format for each platform.

Table 2.

Search strings for each database.

Database	Search string
PubMed	(“generative AI” OR “artificial intelligence”) AND (“electronic health records” OR “EHR” OR “health records”) AND (ethics OR “privacy concerns” OR “data security” OR “patient privacy” OR “data protection”) AND (“regulatory frameworks” OR “healthcare regulations” OR “GDPR” OR “data governance” OR “compliance standards”) AND (transparency OR fairness OR accountability OR “human oversight” OR “ethical guidelines” OR “data de-identification” OR “risk management”)
IEEE Xplore	((“generative AI” OR “artificial intelligence”) AND (“electronic health records” OR “EHR” OR “health records”) AND (ethics OR “privacy concerns” OR “data security” OR “patient privacy” OR “data protection”) AND (“regulatory frameworks” OR “healthcare regulations” OR “GDPR” OR “data governance” OR “compliance standards”) AND (transparency OR fairness OR accountability OR “human oversight” OR “ethical guidelines” OR “data de-identification” OR “risk management”))
Scopus	TITLE-ABS-KEY ((“generative AI” OR “artificial intelligence”) AND (“electronic health records” OR “EHR” OR “health records”) AND (ethics OR “privacy concerns” OR “data security” OR “patient privacy” OR “data protection”) AND (“regulatory frameworks” OR “healthcare regulations” OR “GDPR” OR “data governance” OR “compliance standards”) AND (transparency OR fairness OR accountability OR “human oversight” OR “ethical guidelines” OR “data de-identification” OR “risk management”))
Google Scholar	allintitle: (“generative AI” OR “artificial intelligence”) AND (“electronic health records” OR “EHR” OR “health records”) AND (ethics OR “privacy concerns” OR “data security” OR “patient privacy” OR “data protection”) AND (“regulatory frameworks” OR “healthcare regulations” OR “GDPR” OR “data governance” OR “compliance standards”) AND (transparency OR fairness OR accountability OR “human oversight” OR “ethical guidelines” OR “data de-identification” OR “risk management”)

Source: Developed by authors for systematic literature search.

Selection and screening

Following the initial search across selected databases, a multi-stage screening process was conducted to ensure only studies relevant to the research objectives were included. The screening process applied inclusion and exclusion criteria to guide the selection of appropriate studies.

The inclusion criteria required that studies must: (a) examine ethical, privacy, or security issues related to the use of generative AI in healthcare, particularly in the context of Electronic Health Record (EHR) systems; (b) present findings that directly relate to healthcare settings, including clinical practice, patient data management or healthcare policy; and (c) be published in English between 2014 and 2024.

Relevance to healthcare was determined based on whether the study explicitly focused on healthcare-related contexts or settings, as reflected in the study objectives, keywords, or content. Studies were included if they demonstrated implications for healthcare delivery, data privacy within EHR systems, patient data protection, healthcare governance, or ethical challenges of using AI technologies in medical environments.

The exclusion criteria involved omitting studies that (a) did not address ethical, privacy or security concerns, (b) were unrelated to healthcare contexts or (c) focused exclusively on technical developments of AI models without discussion of their healthcare implications or ethical considerations.

Screening proceeded in three phases. First, titles and abstracts were screened to eliminate studies that failed to meet the inclusion criteria. Second, full-text reviews were conducted to ensure that eligible studies provided substantive discussion on ethical and privacy issues in healthcare AI use. Finally, duplicate records were removed, and reference lists of included studies were manually checked for additional relevant literature.

The Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) flow diagram was employed to illustrate the study selection process, providing transparency on the number of studies identified, screened, assessed for eligibility and included in the final synthesis.²⁹

This review was not registered in the PROSPERO database because it is a scoping review focused on the thematic synthesis of policy and governance-related literature rather than clinical intervention outcomes, which aligns with the common practice in policy and governance-focused scoping reviews.

Data charting

Data from the selected studies were systematically extracted using a predefined data extraction form, capturing study objectives, methodology, main findings, ethical/privacy concerns, regulatory gaps and proposed safeguards. This structured approach ensured consistency in data organisation and analysis (Figure 1).

Figure 1.

Data extraction form.

Data synthesis

Data synthesis followed a thematic analysis approach, which was used to identify, categorise and interpret patterns and recurring themes from the reviewed literature. This process was conducted systematically to align with the research objectives and to ensure a rigorous understanding of the ethical and privacy challenges of integrating generative AI into EHR systems, particularly within the Tanzanian healthcare context.

After completing the data charting process, the extracted data from each study were examined and coded based on emerging issues related to ethical concerns, privacy risks, regulatory frameworks and proposed safeguards. The coding process was both inductive, allowing new themes to emerge from the data, and deductive, guided by the predefined research questions of the study.

The identified codes were then grouped into broader thematic categories that represented the key challenges and concerns reported across the studies. These themes included data privacy and security, algorithmic bias and fairness, transparency and accountability, consent and autonomy, human oversight and data de-identification. Thematic mapping was also employed to explore the relationships between these themes and the regulatory responses reported in the literature.

Moreover, the findings from the thematic analysis were synthesised narratively, providing descriptive summaries of the ethical and privacy challenges, assessing the strengths and limitations of existing regulatory frameworks and highlighting proposed safeguards for responsible AI adoption in healthcare.

Where relevant, the thematic findings were compared and contrasted with Tanzania's AI policy framework to assess its readiness to address the identified challenges. This enabled the contextualisation of global evidence within the Tanzanian healthcare environment, offering insights into regulatory gaps and areas for policy improvement.

Findings

Search results

The literature search yielded 237 articles across various academic databases, including PubMed, IEEE Xplore, Scopus and Google Scholar. Following initial screening, duplicates were removed, resulting in 182 unique records. Titles and abstracts were then reviewed based on the inclusion and exclusion criteria outlined in the methodology section. After this stage, 36 articles were deemed relevant for full-text review.

Additional 22 studies were excluded upon full-text analysis due to factors such as lacking direct relevance to ethical or privacy concerns in healthcare AI or focusing solely on technical implementations. Eventually, 14 studies were selected for inclusion in the review.

The PRISMA flow diagram (Figure 2) illustrates the selection process in detail, showing each stage from the initial search results to the final inclusion of studies for thematic analysis, as proposed by Page et al. (2021). This process ensured a rigorous screening to maintain the quality and relevance of included studies.

Figure 2.

PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) flow diagram.

Study characteristics

The studies reviewed exhibit considerable diversity in geographical focus, methodologies and thematic areas. Among the selected studies, 86% were conducted in high-income countries, such as the USA, Canada and several European nations, while only 14% focused on middle-income countries, with no studies specifically from low-income settings (Figure 3). This highlights a gap in research on the ethical implications of generative AI within under-resourced healthcare contexts, indicating a need for more inclusive research to explore these issues across diverse healthcare environments.

Figure 3.

Geographical distribution of the reviewed studies on ethical implications of generative AI in healthcare.

Qualitative approaches were the most common methodology, comprising 43% of the studies, as researchers aimed to capture perspectives on ethical and privacy concerns.^30–35 Quantitative studies represented 21% of the sample, typically focusing on specific, measurable aspects like data security.^36–38 Mixed-methods studies, which combine quantitative and qualitative data to enrich the depth of analysis, accounted for 7% of the studies.³⁹ Ethical reviews and protocol designs, accounting for the remaining 29%, provided frameworks and standards for ethical AI implementation in healthcare.^40,41 Figure 4 shows the methodological distribution of reviewed studies.

Figure 4.

Methodological distribution of the reviewed studies on generative AI in healthcare.

The studies’ thematic focus also varied, emphasising data security, patient consent mechanisms and fairness in AI algorithms. Table 3 summarises the key characteristics of the studies, including country of origin, methodology, primary focus area and notable findings.

Table 3.

Study characteristics, summarising the key details of each study.

Study ID	Focus area	Key findings	Source
1	AI in Canadian Primary Care	Ethical challenges of bias and inequity; need for regulatory oversight and transparency	³¹
2	AI in Emergency Care	Privacy and autonomy concerns; calls for ethical frameworks and governance	³³
3	Patient Perceptions of AI	Privacy, bias and safety concerns; recommends human oversight and data integrity	³⁴
4	AI in Dentistry	Data protection and accuracy issues; calls for regulatory standards and caution	³⁹
5	AI in Stroke Care	Concerns about dehumanisation suggest ethical guidelines and human involvement	³⁰
6	AI in Paediatrics	Gaps in ethical practices emphasise the need for training and regulatory frameworks	³⁸
7	Human–AI interaction	Data privacy and trust concerns support regular audits and human oversight	³⁶
8	Data Missingness in AI	Data bias and underrepresentation suggest community engagement and ethical guidelines	³⁵
9	AI in Health Research	Privacy and consent issues; advocates for transparency and data de-identification	³²
10	AI for Asthma Care	Data management challenges; promotes transparency and structured guidance	³⁷
11	Responsible AI in Healthcare	Risks of privacy and ethics; recommends ethical frameworks and accountability	⁴²
12	AI for Diabetes Decision Support	Privacy in EHR management calls for transparency and user-centred design	⁴³
13	AI in Surgery	Ethical challenges in autonomy and accountability; supports EU guidelines and transparency	⁴⁰
14	AI for Cardiovascular Data	Emphasises data security and GDPR compliance; continuous monitoring and de-identification	⁴¹

Source: Analysis of the reviewed studies by the authors.

Synthesis of literature review findings

The reviewed studies provide valuable insights into the primary ethical and privacy challenges, the effectiveness of current regulatory frameworks and potential safeguards for integrating AI, particularly generative AI, within healthcare systems. Based on the studies’ collective findings, each research question is addressed.

Primary ethical and privacy challenges of integrating generative AI into EHR systems

Ethical and privacy challenges are central concerns in the reviewed studies, particularly in high-stakes settings like clinical decision support and patient data management. Studies highlight that generative AI poses risks of data bias, security vulnerabilities and loss of human agency in clinical decision-making.^30,31 For instance, biases in training data can result in inequitable healthcare delivery, potentially amplifying disparities in patient care outcomes.^33,38 Such biases are particularly concerning in fields like stroke medicine and paediatric care, where inaccurate predictions could directly impact patient well-being.^30,37

Privacy concerns, especially around data handling, patient consent and data sharing with third-party entities, emerge as critical issues across the studies. Some studies point to the risks of AI systems inadvertently breaching privacy by re-identifying patients through data mining techniques, even after de-identification efforts.^35,41 The sharing of patient data with private companies is another area of concern, as participants in studies express discomfort with the commercialisation of sensitive health information.^32,34

Table 4 summarises the primary ethical and privacy challenges associated with integrating generative AI into EHR systems, along with the frequency of each challenge and the studies in which they appear.

Table 4.

Recurring ethical and privacy concerns.

Ethical/Privacy challenge	Number of studies	Relevant studies
Data privacy and security	11	^{30–35,38,40–43}
Bias and fairness	8	^{31–33,35,38–40,42}
Transparency and accountability	9	^{30,31,33–35,38,40–42}
Consent and autonomy	6	^{33,34,40–42}
Human agency and oversight	7	^{30,33,34,37,38,40,43}
Data de-identification and integrity	5	^{32,34,35,41,42}

Source: Analysis of the reviewed studies by the authors.

Effectiveness of current regulatory frameworks in addressing ethical and privacy concerns

The studies reveal a broad consensus on the insufficiency of existing regulatory frameworks in comprehensively addressing the ethical and privacy issues of AI integration in healthcare. Studies from regions adhering to the General Data Protection Regulation (GDPR), such as those conducted in Europe, indicate that while these frameworks establish foundational data protection standards, they often lack specificity for AI applications, particularly in healthcare contexts.^32,40 For example, GDPR provides general guidance on data protection but does not explicitly account for the ethical complexities introduced by generative AI's autonomous decision-making capabilities.^38,42

Several studies call for AI-specific ethical frameworks beyond data protection, including transparency, accountability and fairness in algorithmic outcomes. Applying frameworks like the European Union's Ethics Guidelines for Trustworthy AI is recommended to ensure non-discrimination and transparency in AI-driven healthcare.⁴⁰ In particular, studies emphasise that robust governance structures and clear ethical standards would help mitigate privacy concerns and enable safer AI integration, especially in under-resourced healthcare environments.^30,41

Table 5 summarises the effectiveness of various regulatory frameworks in addressing ethical and privacy concerns associated with AI in healthcare, as reported by the reviewed studies. This overview highlights differences in regulatory adequacy across regions and underscores gaps in establishing comprehensive, AI-specific ethical guidelines.

Table 5.

Effectiveness of regulatory frameworks in addressing ethical and privacy concerns.

Country	Regulatory frameworks referenced	Perceived effectiveness	Key concerns addressed
Canada	Not specified	Moderate	General need for oversight and transparency
Sweden	Swedish Patient Data Act	Low	Lack of specificity for AI in healthcare
USA	HIPAA	Low	Limited guidance on AI-specific issues
Switzerland	GDPR, Declaration of Helsinki	High	Strong emphasis on data privacy
Canada	SMART on FHIR (Interoperability Standard)	Moderate	Focused on interoperability, lacks ethical specifics
Germany and Switzerland	EU Ethics Guidelines, GDPR	Moderate	Insufficient AI-specific guidelines
Italy	EU Ethics Guidelines for Trustworthy AI	High	Accountability and non-discrimination
Canada	Not specified	Low	Need for more detailed ethical guidance
USA	Not specified	Low	Data protection inadequacies
India	Not specified	Moderate	Suggests the need for comprehensive frameworks
China	Chinese Data Security Law	Moderate	Lacks AI-specific protections

Source: Analysis of the reviewed studies by the authors.

Safeguards to promote transparency, fairness and accountability using generative AI within EHR systems

The reviewed studies propose a range of safeguards to enhance transparency, fairness and accountability when integrating generative AI into EHR systems. Figure 5 illustrates the frequency of studies referencing various safeguards to promote transparency, fairness and accountability in using generative AI within EHR systems.

Figure 5.

Distribution of safeguards to promote transparency, fairness and accountability in using generative AI in EHR (electronic health record) systems.

Human oversight emerges as a critical safeguard, with multiple studies advocating maintaining a ‘human-in-the-loop’ approach in AI-assisted clinical decision-making to allow healthcare professionals to intervene where necessary.^31,34 Human oversight ensures ethical compliance and builds trust among patients and clinicians, especially in cases where AI systems could potentially impact life-critical decisions.³⁷

Transparency measures such as continuous data monitoring, structured de-identification and regular audits are recommended to secure patient data and promote public trust.^41,42 Studies suggest that AI models should be auditable, with clear reporting on model training data and decision-making processes, to ensure clinicians can understand and challenge AI-generated outcomes if necessary.⁴³

Furthermore, the studies highlight the importance of ethical guidelines and participatory co-design in safeguarding AI's fairness and accountability. Engaging diverse stakeholders, including patients, in the design and implementation phases can help prevent biases and ensure that AI systems meet the needs of varied patient populations.^32,38 Such inclusive practices are especially crucial for developing countries, where limited representation in AI training data could lead to suboptimal healthcare outcomes.

Analysis of the Tanzanian policy framework for artificial intelligence in the health sector

The policy framework for artificial intelligence in the health sector, developed by the Tanzanian Ministry of Health, provides a strategic foundation for integrating AI technologies to improve healthcare delivery and outcomes. While this framework reflects an important policy milestone, a critical analysis is necessary to assess its readiness to address the complex ethical and privacy challenges specific to the integration of generative AI in EHR systems.

This analysis evaluates the framework's strengths and limitations based on evidence from the literature review, global AI governance principles and comparative insights from other developing countries, particularly Kenya, Rwanda and Morocco. Table 6 provides a comparative summary of AI governance approaches in selected African developing countries.

Table 6.

AI policy approaches in Tanzania, Kenya, Rwanda and Morocco.

Country	AI policy/strategy availability	Key focus areas	AI in a healthcare context	Generative AI-specific guidelines	Source
Tanzania	AI policy framework for the health sector (2022)	Capacity building, ethical principles, data governance, alignment with the national digital health strategy	Broad ethical principles in healthcare but lacks operational guidelines	Absent	²⁸
Kenya	Digital Economy Blueprint (2019)	Innovation hubs, responsible data use, regulatory sandboxes, capacity building	Supports health tech innovations under regulatory testing environments	Absent (but regulatory sandboxes enable testing of innovations)	⁴⁴
Rwanda	National AI Policy (2021)	Ethical AI, inclusion, data protection, AI governance for multiple sectors	Recognises healthcare as a critical area for AI application with human-centred design emphasis	Absent (but with a strong focus on governance and fairness)	⁴⁵
Morocco	Part of National Digital Strategy (no dedicated AI strategy)	Ethical AI principles integrated with broader digital agenda, privacy, transparency	Healthcare is not explicitly detailed; AI governance is general	Absent	⁴⁸

Source: Developed by authors based on policy documents and reports from the Ministry of Health Tanzania (2022), Kenya ICT Authority (2019), Rwanda Ministry of ICT (2021) and UNESCO (2024).

Strengths of the policy framework

Alignment with national health priorities

A key strength of Tanzania's framework lies in its strong alignment with the National Digital Health Strategy 2019–2024 and its commitment to supporting Universal Health Coverage (UHC). Aligning AI adoption with national health priorities enhances the likelihood of policy acceptance, resource mobilisation and operational integration across healthcare levels. As supported in the literature, policy alignment ensures that AI-driven interventions address priority health challenges and improve healthcare equity.^30,42

Emphasis on capacity building and research development

The framework rightly recognises the importance of strengthening local capacity and fostering research as enablers of responsible AI adoption. It promotes the development of training curricula, establishment of research partnerships and capacity-building programs for healthcare stakeholders. This focus is critical in addressing known barriers such as algorithmic bias, lack of technical expertise and poor data management.^37,41 Similar emphasis is observed in the AI policy of 2021 in Rwanda and the digital economy blueprint of 2019 in Kenya, which prioritises local talent development for sustainable AI integration.^44,45

Recognition of ethical considerations and governance principles

The framework acknowledges the need for ethical standards, patient protection and governance mechanisms in AI implementation. This aligns with recommendations from global AI governance frameworks, including the WHO guidance on ethics and governance of AI for health⁴⁶ and the OECD AI principles,⁴⁷ which emphasise human oversight, fairness, transparency and accountability.³² However, Tanzania's framework addresses these principles in a broad sense, lacking generative AI-specific guidance.

Gaps and challenges in the framework

Lack of specific guidelines for generative AI

While the framework outlines general principles for AI implementation, it lacks explicit guidelines tailored to generative AI. Studies in the review highlight significant risks associated with generative AI, including data privacy breaches, re-identification of de-identified data and algorithmic biases that could exacerbate healthcare disparities.^30,35 Nevertheless, the framework does not provide actionable steps to mitigate these risks or ensure equitable access to AI technologies.

Compared to other developing countries, Tanzania's framework remains at an early stage of operationalising AI governance for healthcare. For example, Kenya and Rwanda have developed explicit national AI strategies that provide clearer governance mechanisms and sector-specific ethical guidelines. In contrast, while demonstrating a commitment to ethical AI principles within its broader digital strategy, Morocco does not yet have a dedicated national AI strategy, limiting the existence of an integrated framework to address sector-specific challenges, such as those emerging in healthcare.⁴⁸ Tanzania's framework similarly reflects this gap, lacking operational guidelines or mitigation strategies for the risks associated with generative AI in EHR systems.

Limited regulatory clarity

Another significant gap lies in the limited regulatory clarity provided by the framework. While it acknowledges the need for enabling policies and regulatory harmonisation, it fails to provide concrete provisions, enforcement mechanisms, or a clear implementation timeline for regulating AI in healthcare. The absence of specific regulatory pathways is problematic, given the complexities of generative AI, as discussed in the literature.⁴⁰ Other developing countries, such as Kenya, have already initiated regulatory sandboxes for testing health innovations under controlled environments, providing models Tanzania could adopt.⁴⁹

Infrastructure and resource constraints

Although the framework identifies infrastructure development as a priority, it lacks detailed strategies for resource mobilisation, scalability and sustainability of AI initiatives. The literature stresses that robust infrastructure, including secure data storage, reliable electricity, high-speed internet and cybersecurity measures, is essential for the safe and effective deployment of AI technologies.^41,42 In contrast, Rwanda's AI strategy provides a clearer infrastructure development roadmap and budgetary considerations. Without specific mechanisms for addressing Tanzania's infrastructural limitations, the framework risks limiting AI adoption in rural and under-resourced settings.

Discussion

Key findings

This study examined the ethical and privacy challenges of integrating generative AI into EHR systems within Tanzania's healthcare sector, with specific attention to the readiness and limitations of the existing policy framework for artificial intelligence in the health sector.²⁸ The findings highlight critical issues that must be addressed to enable responsible and ethical adoption of generative AI technologies in Tanzania while positioning the country within broader regional and global AI governance discourse.

Tanzania's policy framework represents a commendable step towards harnessing AI to enhance healthcare delivery, aligning well with national digital health priorities and global calls for ethical AI adoption.^30,42 Its focus on capacity building, research promotion and ethical governance reflects recognised enablers for successful AI deployment in developing country contexts. However, a closer examination of the framework reveals that its generality, particularly regarding generative AI's unique characteristics, limits its capacity to mitigate emerging risks such as data privacy breaches, algorithmic bias, discrimination and accountability concerns.

The literature strongly supports the argument that generative AI introduces new ethical complexities in healthcare that require policy responses beyond those needed for traditional AI applications.^32,38 Issues such as ensuring informed consent, patient autonomy, data ownership and equitable access to AI technologies are not explicitly addressed in Tanzania's framework. This omission is particularly concerning in a diverse and resource-constrained environment like Tanzania, where unintended algorithmic discrimination and healthcare disparities could easily emerge without robust safeguards.

Moreover, regulatory clarity remains a persistent gap within the Tanzanian policy framework. While the framework acknowledges the need for harmonised and enabling regulations, it does not provide concrete implementation strategies, sector-specific guidelines or enforcement timelines. This is a notable limitation when compared to other developing countries, such as Kenya and Rwanda, which have developed national AI strategies that provide more detailed governance mechanisms.^44,45 For instance, Kenya's regulatory sandboxes for testing innovations offer practical models for controlled AI experimentation in healthcare settings.⁵⁰ In contrast, Morocco's approach operates within a broader digital strategy without a dedicated AI framework, reflecting similar challenges of fragmented governance.⁴⁸

Global governance frameworks, including the WHO Guidance on Ethics and Governance of AI for Health⁴⁶ and OECD AI Principles,⁴⁷ recommend that AI policies should include mechanisms for transparency, human oversight, fairness and accountability. The absence of these specific governance elements within Tanzania's framework presents risks of eroding stakeholder trust and slowing AI adoption.^34,40

In addition to regulatory gaps, infrastructural and resource constraints remain a major barrier to AI scalability in Tanzania. While the framework emphasises the importance of digital infrastructure, it falls short of outlining resource mobilisation strategies or mechanisms for ensuring equitable access to AI innovations across urban and rural settings. This mirrors challenges identified in other Developing countries, where limited investments in infrastructure and poor data quality undermine the transformative potential of AI in healthcare.⁴¹ Addressing these gaps will require multi-stakeholder collaboration, including public–private partnerships and international support mechanisms.

The study findings suggest that the integration of generative AI into EHR systems in Tanzania will necessitate targeted interventions to ensure ethical, equitable and effective deployment. This includes the development of AI-specific ethical guidelines that are sensitive to local contexts, strengthening participatory co-design approaches to incorporate stakeholder perspectives and improving infrastructure for secure data storage, interoperability and high-speed connectivity.^37,43

Importantly, Tanzania holds significant potential to emerge as a regional leader in ethical AI integration within healthcare. With its existing digital health momentum and growing policy infrastructure, the country could set a precedent for other African developing countries by enhancing its policy framework to reflect evolving AI realities. Achieving this vision would enable Tanzania to establish standards for ethical, transparent and inclusive AI deployment in healthcare, delivering benefits such as improved clinical decision-making, operational efficiency and personalised care delivery.

Nonetheless, this trajectory will not be without challenges. Sustained stakeholder engagement will be essential to ensure that the perspectives of patients, healthcare workers, policymakers and technical experts are incorporated throughout the design, deployment and governance of generative AI systems. This participatory approach would foster trust, surface context-specific barriers and ensure equitable access to AI-driven healthcare solutions.

In addition, robust monitoring and evaluation mechanisms should be established to assess AI system performance, detect unintended consequences and inform policy adjustments. Given the rapid evolution of AI technologies, Tanzania's policy framework must remain dynamic and adaptable, allowing for iterative updates that respond to emerging challenges, including algorithmic bias, data privacy breaches and governance complexities.

Study limitations

While this study provides valuable insights into the ethical and privacy challenges of integrating generative AI into EHR systems within the Tanzanian healthcare context, several limitations must be acknowledged.

First and most importantly, the study did not incorporate empirical data from Tanzanian stakeholders such as healthcare practitioners, policymakers or patients. As a result, it lacks direct perspectives from those who would be most affected by the implementation of generative AI in healthcare. This limits the contextual grounding of the findings and the ability to fully capture practical, operational and socio-cultural challenges within local settings. Future research should address this gap by conducting qualitative interviews, focus groups or case studies with key stakeholders in Tanzanian health facilities.

Second, the reviewed literature is heavily dominated by studies from high-income countries, particularly in Europe and North America, with very limited representation from developing countries, including Tanzania. This geographical imbalance may constrain the transferability of some findings, as ethical, regulatory and infrastructural contexts in low- and middle-income countries differ markedly from those in more developed settings.

Third, the study focused exclusively on ethical and privacy challenges related to generative AI integration in EHR systems. Other important dimensions – such as economic viability, technical readiness, user acceptance and organisational capacity – were beyond the scope of this review and remain unexplored.

Lastly, although this study critically analysed the Policy Framework for Artificial Intelligence in Tanzania's Health Sector, it did not assess the degree to which the policy has been implemented or its effectiveness in real-world healthcare environments. The gap between policy formulation and on-the-ground execution remains a critical area for future empirical inquiry, particularly in understanding how regulatory instruments shape or hinder AI integration in practice.

Future studies should adopt mixed-method approaches, incorporate empirical evidence from diverse healthcare and policy stakeholders, and expand the geographical representation of the literature to include more perspectives from low- and middle-income countries. Such efforts would provide a more comprehensive and grounded understanding of the ethical, technical and governance-related challenges of responsible AI deployment in healthcare, especially in resource-constrained settings like Tanzania.

Study implications

This study provides critical insights with significant implications for research, practice and society, particularly in the context of integrating generative AI into EHR systems in Tanzania and similar developing countries,

Research implications

This study extends the growing body of literature on responsible AI integration in healthcare by specifically focusing on the ethical and privacy challenges of generative AI within EHR systems. While previous studies have predominantly examined technical and operational aspects, this study highlights the need for more research that questions ethical considerations, policy readiness and governance mechanisms within developing countries. Future research should explore context-specific AI regulatory frameworks, assess user perspectives (patients and healthcare providers) and develop empirical case studies from Tanzania and comparable environments. Moreover, this study calls for research that investigates the intersection between AI adoption, resistance factors and healthcare equity, particularly focusing on underrepresented healthcare systems in Africa.

Practical implications

For healthcare practitioners, policymakers and technology developers, this study underscores the urgent need to develop and implement AI-specific ethical guidelines that address transparency, accountability, consent, data privacy and fairness in AI-enabled healthcare systems. The findings suggest that healthcare organisations intending to deploy generative AI in EHR systems should strengthen their institutional data governance practices, enhance staff capacity on AI ethics and foster participatory co-design approaches that involve diverse stakeholders in system development and deployment. In addition, regulatory authorities in Tanzania must operationalise the existing AI policy framework by formulating clear implementation guidelines and standards and monitoring mechanisms specifically targeting AI applications in healthcare.

Societal implications

At the societal level, this study highlights the potential risks and benefits of generative AI adoption in healthcare. On the one hand, if well-regulated, generative AI can significantly enhance patient care, facilitate personalised medicine and improve decision-making in resource-constrained health systems. On the other hand, without proper safeguards, AI systems may intensify inequalities, compromise patient privacy and erode public trust in digital health systems. Therefore, there is a pressing societal need for awareness creation and education on AI and data privacy rights, ensuring that patients are informed and empowered in the era of AI-driven healthcare. Strengthening public discourse around ethical AI use, privacy protection and data ownership in healthcare is essential to building societal trust and acceptance of AI innovations.

Conclusion

This study critically examined the ethical and privacy challenges of integrating generative AI into EHR systems, with a specific focus on Tanzania's healthcare context. Drawing from a literature review and policy analysis of the policy framework for artificial intelligence in Tanzania in the health sector, the study highlights significant opportunities and challenges that need to be addressed to ensure responsible and ethical AI adoption in healthcare.

The findings reveal that while generative AI offers transformative potential for enhancing healthcare delivery, it simultaneously introduces complex ethical and privacy risks, including data security vulnerabilities, algorithmic biases, lack of transparency, consent challenges and accountability gaps. The study further established that although the policy framework for artificial intelligence in Tanzania aligns well with national digital health strategies and acknowledges the importance of ethics and governance, it lacks specific guidelines and regulatory clarity for addressing the emerging risks of generative AI integration in healthcare, particularly in EHR systems.

The study recommends the development of AI-specific ethical guidelines, strengthening regulatory and governance structures, investing in digital infrastructure and fostering participatory co-design approaches that involve healthcare professionals, patients and other key stakeholders. Furthermore, the study underscores the need for capacity building among healthcare practitioners and policymakers to enhance understanding and management of ethical and privacy issues in AI adoption.

Importantly, the study calls for future research to incorporate empirical investigations within Tanzanian healthcare settings, explore real-world implementation dynamics and conduct comparative studies with other low- and middle-income countries to identify best practices for ethical AI integration.

The study contributes to the growing discourse on responsible AI adoption in healthcare, particularly within resource-limited settings, and provides valuable insights for policymakers, practitioners, researchers and society at large. By addressing identified gaps and implementing proposed safeguards, Tanzania can position itself as a regional leader in the ethical and equitable use of generative AI technologies in healthcare.

Footnotes

Acknowledgements

The author would like to express gratitude to the University of Dodoma for its support and encouragement throughout the development of this study. Special thanks are extended to the Department of Information Systems and Technology for providing the necessary resources and a conducive environment for this research.

ORCID iD

Augustino Mwogosi

Ethical considerations

The study adhered to the ethical guidelines for conducting reviews and policy analyses.

Author contributions

Augustino Mwogosi conceptualised the study, conducted the systematic literature review, analysed Tanzania's policy framework, synthesised the findings and drafted the manuscript. The author also revised the manuscript critically for intellectual content and approved the final version for submission.

Funding

The author received no financial support for the research, authorship, and/or publication of this article.

Declaration of conflicting interests

The author declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

References

Sezgin

. Artificial intelligence in healthcare: complementing, not replacing, doctors and healthcare providers. Digit Health 2023; 9. https://doi.org/10.1177/20552076231186520

Schlagwein

Willcocks

. ‘ChatGPT, Et al.’: the ethics of using (generative) artificial intelligence in research and science. J Inf Technol 2023; 38: 232–238.

Murphy

Thomas

. Generative AI in spinal cord injury research and care: opportunities and challenges ahead. J Spinal Cord Med 2023; 46: 341–342.

Agyemang-Duah

Mensah

Peprah

, et al. Facilitators of and barriers to the use of healthcare services from a user and provider perspective in Ejisu-Juaben municipality, Ghana. J Publ Health (Germany) 2019; 27: 133–142.

Hansen

Baroody

. Beyond the boundaries of care: electronic health records and the changing practices of healthcare. Inf Organ 2023; 33: 100477.

Enahoro

Ogugua

Anyanwu

, et al. The impact of electronic health records on healthcare delivery and patient outcomes: a review. World J Adv Res Rev 2023; 21: 451–460.

Razzano

. A scoping review on the impacts of electronic health record systems on healthcare delivery. Int J Health Sci Res 2024; 14: 276–282.

President’s Office Regional Administration and Local Government . Status of using EHR in Tanzania public primary healthcare facilities. Dodoma: Tanzanian Ministry of Health, 2025.

Mwogosi

Kibusi

. Unveiling barriers to EHR implementation for effective decision support in Tanzanian primary healthcare: insights from practitioners. Health Informatics J 2024; 30. https://doi.org/10.1177/14604582241304698

10.

Mwogosi

Mambile

. Insights into the current state of electronic health records adoption and utilisation in Tanzanian public primary healthcare facilities: a survey study. Rec Manag J 2024. Epub ahead of print. https://doi.org/10.1108/RMJ-04-2023-0023

11.

Shidende

Mwogosi

. Exploring the impact of generative AI tools on healthcare delivery in Tanzania. J Health Organ Manag 2025. Epub ahead of print. https://doi.org/10.1108/JHOM-01-2025-0007

12.

Lestari

Miranda

Fuady

. Barriers to telemedicine adoption among rural communities in developing countries: a systematic review and proposed framework. Clin Epidemiol Glob Health 2024; 28: 101684.

13.

Theonest

Ngowi

Kussaga

, et al. Status and future prospects for mobile phone-enabled diagnostics in Tanzania. PLOS Digital Health 2024; 3: e0000565.

14.

Mwogosi

. AI-driven optimisation of EHR systems implementation in Tanzania’s primary health care. Transform Govern: People Process Policy 2025; 19: 288–315.

15.

Dakika

Saronga

. Examining Factors Influencing the Use of Health Management Information Systems Data for Health Facility Planning in Kigoma Ujiji and Kigoma District Council, Tanzania. Morogoro, Tanzania: Mzumbe University, 2024, vol. 7.

16.

Whitehead

Talevski

Fatehi

, et al. Barriers to and facilitators of digital health among culturally and linguistically diverse populations: qualitative systematic review. J Med Internet Res 2023; 25: e42719.

17.

Eugene Shiyo

. Handling of electronic health records in Tanzania: awareness and use of available regulations. East African J Educ Soc Sci 2024; 4: 17–28.

18.

Nittas

Daniore

Chavez

, et al. Challenges in implementing cultural adaptations of digital health interventions. Commun Med 2024; 4: 7.

19.

Cairns

, et al. Generating synthetic mixed-type longitudinal electronic health records for artificial intelligent applications. NPJ Digit Med 2023; 6: 98.

20.

Ghosheh

Zhu

. A survey of generative adversarial networks for synthesizing structured electronic health records. ACM Comput Surv 2024; 56: 1–34.

21.

Zhang

Kamel Boulos

. Generative AI in medicine and healthcare: promises, opportunities and challenges. Future Internet 2023; 15: 86.

22.

Yoon

Drumright

van der Schaar

. Anonymization through data synthesis using generative adversarial networks (ADS-GAN). IEEE J Biomed Health Inform 2020; 24: 2378–2388.

23.

Murdoch

. Privacy and artificial intelligence: challenges for protecting health information in a new era. BMC Med Ethics 2021; 22: 22.

24.

Lim

Hong

Lam

WST

, et al. Novel technical and privacy-preserving technology for artificial intelligence in ophthalmology. Curr Opin Ophthalmol 2022; 33: 174–187.

25.

Bani Issa

Al Akour

Ibrahim

, et al. Privacy, confidentiality, security and patient safety concerns about electronic health records. Int Nurs Rev 2020; 67: 218–230.

26.

Morley

Machado

CCV

Burr

, et al. The ethics of AI in health care: a mapping review. Soc Sci Med 2020; 260: 113172.

27.

Flores

Kim

Young

. Addressing bias in artificial intelligence for public health surveillance. J Med Ethics 2024; 50: 190–194.

28.

MoH. Policy framework for artificial intelligence in Tanzania Health Sector 2022. https://www.moh.go.tz/storage/app/uploads/public/65c/61f/590/65c61f59087ac486047849.pdf (accessed August 12, 2024).

29.

Page

McKenzie

Bossuyt

, et al. The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. Br Med J 2021: n71. https://doi.org/10.1136/bmj.n71

30.

Amann

Vayena

Ormond

, et al. Expectations and attitudes towards medical artificial intelligence: a qualitative study in the field of stroke. PLoS One 2023; 18: e0279088.

31.

Darcel

Upshaw

Craig-Neil

, et al. Implementing artificial intelligence in Canadian primary care: barriers and strategies identified through a national deliberative dialogue. PLoS One 2023; 18: e0281733.

32.

McCradden

Baba

Saha

, et al. Ethical concerns around use of artificial intelligence in health care research from the perspective of patients with meningioma, caregivers and health care providers: a qualitative study. CMAJ Open 2020; 8: E90–E95.

33.

Petersson

Vincent

Svedberg

, et al. Ethical considerations in implementing AI for mortality prediction in the emergency department: linking theory and practice. Digit Health 2023; 9. https://doi.org/10.1177/20552076231206588

34.

Richardson

Smith

Curtis

, et al. Patient apprehensions about the use of artificial intelligence in healthcare. NPJ Digit Med 2021; 4: 140.

35.

Rose

Barber

Preiksaitis

, et al. A conference (missingness in action) to address missingness in data and AI in health care: qualitative thematic analysis. J Med Internet Res 2023; 25: e49314.

36.

Esmaeilzadeh

Mirzaei

Dharanikota

. Patients’ perceptions toward human-artificial intelligence interaction in health care: experimental study. J Med Internet Res 2021; 23: e25856.

37.

Seol

Shrestha

Muth

, et al. Artificial intelligence-assisted clinical decision support for childhood asthma management: A randomised clinical trial. PLoS One 2021; 16: e0255261.

38.

Wang

, et al. Comparative survey among paediatricians, nurses and health information technicians on ethics implementation knowledge of and attitude towards social experiments based on medical artificial intelligence at children’s hospitals in Shanghai: a cross-sectional study. BMJ Open 2023; 13: e071288.

39.

Giannakopoulos

Kavadella

Salim

, et al. Evaluation of the performance of generative AI large language models ChatGPT, Google Bard, and Microsoft Bing Chat in supporting evidence-based dentistry: comparative mixed methods study. J Med Internet Res 2023; 25: e51580.

40.

Cobianchi

Verde

Loftus

, et al. Artificial intelligence and surgery: ethical dilemmas and open issues. J Am Coll Surg 2022; 235: 268–275.

41.

Samaras

Bekiaridou

Papazoglou

, et al. Artificial intelligence-based mining of electronic health record data to accelerate the digital transformation of the national cardiovascular ecosystem: design protocol of the CardioMining study. BMJ Open 2023; 13: e068698.

42.

Gupta

Kamboj

Bag

. Role of risks in the development of responsible artificial intelligence in the digital healthcare domain. Inf Syst Front 2023; 25: 2257–2274.

43.

Tarumi

Takeuchi

Chalkidis

, et al. Leveraging artificial intelligence to improve chronic disease care: methods and application to pharmacotherapy decision support for type-2 diabetes mellitus. Methods Inf Med 2021; 60: e32–e43.

44.

Kenya ICT Authority. Digital economy blueprint powering Kenya’s transformation. 2019.

45.

Rwanda Ministry of ICT and Innovation. The National AI Policy. Kigali, 2021.

46.

WHO. Ethics and governance of artificial intelligence for health. Geneva, 2021.

47.

OECD. AI principles. 2024.

48.

UNESCO. Global AI Ethics and Governance Observatory 2025.

49.

Ngari

. Regulatory Sandboxes in Africa 2021. https://empowerafrica.com/regulatory-sandboxes-in-africa/ (accessed April 14, 2025).

50.

Latif

. Regulating digital health and health apps in Kenya: lessons learnt. SSRN Electron J 2025. https://doi.org/10.2139/ssrn.5122386