Special category data: the details
Article 9 of the General Data Protection Regulation prohibits processing it unless one of its exceptions applies: the person’s explicit consent, the provision of health care, an obligation in the field of employment or a substantial public interest, among others. An ordinary legal basis isn’t enough: you need both.
For the software that handles it, that translates into specific measures. Access limited to those who need it for their role, a log of every lookup, encryption and an impact assessment when processing is large-scale. With artificial intelligence you also have to decide which data may leave for an outside provider, in which region it is processed and under which data processor agreement.